Democracy, Activism and Journalism under espionage attack
It's called Pegasus, and it's a spyware, which is a type of software that collects information about users' online activity without their consent.
Its peculiarity, compared to other spyware, is that it can be installed on users' devices through the so-called "zero-click attack" which means without "phishing" (messages or e-mails that invite the recipient to click on a link) and so it doesn't involve any interaction by the owner of the device.
The software, developed and marketed for 8 million euros per single license, by NSO Group, an Israeli company that works under the concession of the Jewish government, mainly exploits the weak points of mobile phones to collect text messages, intercept phone calls, geolocalize the user, copy the passwords, also being able to activate the microphone and the camera.
According to a report published by Amnesty Security Tech Lab, led by the Italian Claudio Guarnieri, it would have served to monitor over 50.000 telephone users of journalists, politicians, lawyers, and even 13 heads of state (including 3 Europeans) by the following governments : Azerbaijan, Bahrain, Hungary, India, Kazakhstan, Mexico, Morocco, Rwanda, Saudi Arabia, Togo, and the United Arab Emirates.
On the other hand, Amnesty International denounces its illicit use against human and civil rights activists in 45 countries around the world since 2016, when it was first discovered on iPhones, exploiting a vulnerability that was activated by clicking on a missed call from WhatsApp.
According to the Amnesty International report, Pegasus can obtain "administrator privileges" on the device, to exploit it "more than its owner can".
Guarnieri, in an interview with the Guardian, one of the newspapers that published the NSO Group documents, openly stated that there is nothing that can be done to prevent this kind of cyber attack from happening again.
Among the documents obtained there is also a list of about 50,000 telephone numbers chosen to be infected with Pegasus. These numbers are not linked to the identity of their respective users, but journalists who worked on the confidential material have identified 1,000 people scattered in over fifty countries.
Among them are more than 600 politicians and government officials, 65 corporate executives, 85 human rights activists and 189 journalists from various publications such as New York Times, Associated Press, CNN, Financial Times, The Economist, France 24, Reuters and others. One of the highest profile journalists was Roula Khalaf, the editor of the Financial Times.
According to The Washington Post's investigation, hundreds of politicians, including 13 heads of state, were potential targets for infection.
Amnesty’s Security Lab conducted a forensic analysis of some of the phones on the list, which was peer-reviewed by Citizen Lab, a group based in the Toronto University that has been tracking suspected cases of Pegasus infections for years. Of the 67 smartphones analyzed, evidence of successful infection was found on 23 and evidence of attempted infiltration on 14.
The UN High Commissioner for Human Rights Michelle Bachelet said the apparent widespread use of Pegasus spy software to illegally undermine the rights of those under surveillance, including journalists and politicians, was “extremely alarming” and confirmed “some of the worst fears” surrounding the potential misuse of such technologies.
“Use of surveillance software has been linked to arrest, intimidation and even killings of journalists and human rights defenders”, she added.
In fact, among the names object of Pegasus' illegal surveillance there were numerous family members of Jamal Khashoggi, as well as his girlfriend Hatice Cengiz and the Turkish officials investigating the murder. Khashoggi, 60, a journalist from Saudi Arabia and opponent of the regime, was in fact brutally killed in his country's consulate in Turkey.
Last week another mercenary spyware vendor came into focus of Citizen Lab, the interdisciplinary laboratory based at the University of Toronto and working on the intersection of freedom of information, communication technologies, human rights, and global security.
According to Citizen Lab, Candiru, a secretive Israel-based company, is selling spywares exclusively to governments. Using Internet scanning, Citizen Lab identified more than 750 websites linked to Candiru’s spyware infrastructure and found many domains masquerading as advocacy organizations such as Amnesty International, the Black Lives Matter movement, as well as media companies, and other civil-society themed entities.
The fact that world and other political leaders themselves may have come into the spyware technology’s crosshairs is a wake-up call for them and states worldwide to step up and regulate this industry. If world leaders are being targeted in this way then it further confirms that everyone’s rights, including human rights activists, journalists and lawyers, are at risk.
Agnès Callamard, Secretary General of Amnesty International, openly declared that these revelations must act as a catalyst for change: “The surveillance industry must no longer be afforded a laissez-faire approach from governments with a vested interest in using this technology to commit human rights violations.”
This investigation has been possible thanks to the Pegasus Project, a ground-breaking collaboration by more than 80 journalists from 17 media organizations in 10 countries coordinated by Forbidden Stories, a Paris-based media non-profit, devoted to protect and publish the work of journalists who are threatened, jailed, or killed across the world.
Cover photo: howtostartablogonline.net - Creative Commons BY 2.0 License.