Originally designed for criminal or intelligence operations, these privately developed technologies are increasingly being used by state agencies to spy on critical and investigative reporters and monitor private communications.
While this form of targeted surveillance is believed to still be limited on a global scale, major revelations in recent years have laid bare the increasing use of these tools against bloggers, activists and journalists, in democracies and dictatorships alike 鈥 already with deadly consequences.
In this report, IPI documents the use of such spyware and speaks to affected journalists, researchers and rights groups to highlight the threats such technologies pose to the profession and to media freedom more widely in an increasingly digitalized world.
Pegasus spyware
While various spyware tools exist in the global market, one in particular has faced heavy scrutiny in recent months. Developed by private Israeli cyberarms firm NSO Group, Pegasus is a mobile surveillance tool which and infects its operating system without the user鈥檚 knowledge.
When installed, it can target private data, monitor SMS, calls and encrypted chats, and collect passwords for social media accounts. It can even turn on the user鈥檚 microphone or camera and access maps to trace the user鈥檚 location, travel history and home address.
Hatice Cengiz (R), the fiancee of murdered Saudi journalist Jamal Khashoggi, and Jeff Bezos (L), CEO of Amazon and owner of The Washington Post. EPA-EFE/Tolga Bozoglu.
The dangers of such technology have made international headlines in recent weeks after it was alleged Pegasus had been used by Saudi Crown Price Mohammed Bin Salman to of Amazon founder and Washington Post owner Jeff Bezos.
However, over the past half-decade Pegasus has secretly been used by government agencies to try and snoop on dozens of journalists in countries around the world.
In a groundbreaking 2018 , cybersecurity research laboratory published evidence that the spyware may have been used in 45 counties in a two-year period between 2016 and 2018. Many of these were autocratic states with poor human rights records where independent media is heavily restricted, such as the United Arab Emirates (UAE) and , and others where crackdowns on independent media were actively underway, such as and .
In response to these revelations, NSO Group has repeatedly its technology has been used to target civil society and has stressed it only sells its products to 鈥済overnment intelligence and law enforcement agencies鈥 for the 鈥渟ole purpose鈥 of investigating suspected terrorists and other serious criminals.
However, several publicly reported cases involving journalists have indicated its spyware is being used by intelligence agencies far more widely, and unscrupulously. Such revelations have raised serious concerns over whom Pegasus sells its technology to and a lack of knowledge about exactly who it is being used to spy on.
Emerging trend
The first journalist discovered to have been targeted with Pegasus was Emirati blogger in 2016, who worked with Citizen Lab to reveal the use of the spyware. He was followed shortly after by , a Moroccan columnist, press freedom advocate and co-founder of the Moroccan Association for Investigative Journalism (AMJI). In 2017, he received suspicious SMS messages carrying malicious links.
A year later, in December 2018, it was revealed that Pegasus had been used by Saudi assassins to target Washington Post columnist. A U.N. report into his death revealed authorities in Riyadh had access to some of Khashoggi鈥檚 communications through Pegasus spyware installed on the phone of a friend and fellow dissident, allowing them to partially track his movements before his assassination.
On other occasions, the spyware was allegedly used to target those protecting journalists and human rights defenders. In August 2018, it was revealed that Pegasus had been used to try to spy on an Amnesty International staff member.
Elsewhere, an in Panama in 2017 emerged amid allegations the country鈥檚 former president Ricardo Martinelli had illegally ordered the use of Pegasus to spy on 150 people, including journalists, while he was president from 2009 until 2014. Though he was found not guilty by a Panamanian court, the U.S. Department of Justice maintained he created and oversaw a 鈥渟ophisticated program鈥 of surveillance.
Fresh revelations
During 2019, further scandals involving NSO Group emerged. In a highly explosive allegation in October, WhatsApp publicly accused the company of allowing government spies to exploit its app to facilitate on the phones of 100 civil society members, including journalists, in 20 countries.
A smartphone screen displays the logo of the mobile application WhatsApp. EPA-EFE/Hayoung Jeon.
The biggest operation here was in India, where it was disclosed that Pegasus was used in an 鈥渦nmistakable pattern of abuse鈥 to via WhatsApp on at least 24 Indian journalists, lawyers, academics and activists for a two-week period until May 2019.
Though WhatsApp declined to confirm exactly how many of those targeted were journalists, it stressed it was 鈥渘ot an insignificant number鈥. So far, at least five Indian journalists have publicly to reveal they were targeted. Among them were editors, defence correspondents, strategic affairs analysts, and former BBC journalists.
One of those targeted spoke to IPI under the condition of anonymity. 鈥淚 don鈥檛 know why I was chosen, but I鈥檓 not surprised鈥, he said. 鈥淚 was contacted by Citizen Lab to inform me that there had been an attempt to hack my phone through a call I received. It鈥檚 not the first time this kind of thing has happened to me, and I don鈥檛 think it will be the last time.鈥
Further revelations came at the end of January when New York Times journalist Ben Hubbard came forward to allege he was by Saudi Arabia using NSO technology via a June 2018 SMS message. According to , which investigated the attempt hack, the text contained a hyperlink to a website used by a known Pegasus operator linked to Saudi Arabia.
Mexico: The 鈥榖iggest customer鈥 for digital surveillance tools
While these cases have drawn more headlines, by far the most widespread use of Pegasus against journalists so far has been discovered in Mexico, which already faces an epidemic of violence against journalists and impunity. Investigations there have revealed authorities abused Pegasus to target the phones of at least over the last few years, in what was the 鈥渟ystematic harassment鈥 of civil society.
鈥淭he Mexican government is undoubtedly the biggest customer in the world when it comes to digital surveillance tools鈥, Luis Fernando Garc铆a, executive director of the Network in Defense of Digital Rights (R3D) in Mexico, told IPI in a recent interview.
In 2017, R3D worked with rights group Article 19 and Citizen Lab to publish a major into the use of Pegasus in Mexico, sparking a and a criminal probe. They found that three separate 鈥渙perators鈥 鈥 or government bodies 鈥 were using Pegasus against and human rights defenders.
Former Mexican President Enrique Pe帽a Nieto. EPA-EFE/Leonardo Mu帽oz.
After the revelations, the government of then-President Enrique Pe帽a Nieto initially denied purchasing spyware from NSO. When a special freedom of expression prosecutor was assigned to investigate, the government backtracked and the former president using the spyware, though he insisted it was never for political purposes and only to tackle crime.
Casting doubt upon this claim, several Mexican journalists contacted by Citizen Lab and R3D have come forward publicly over the last few years to reveal they were spied on. Many of those targeted by Pegasus were investigative journalists specializing in or on drug cartels and organized crime, Garc铆a said. Others had been investigating the Mexican president himself, or federal authorities.
Watching Mexico鈥檚 watchdogs
Among them was well-known radio and television personality and investigative journalist Carmen Aristegui, who broke the 鈥, which implicated former Mexican president Pe帽a Nieto. Her son and members of her news team were also targeted. Meanwhile, Salvador Camarena and Daniel Liz谩rraga, both journalists specializing in investigating corruption with the organization Mexicans Against Corruption and Impunity, were also with infection attempts. Carlos Loret de Mola, a prominent radio and television journalist, was repeatedly targeted in 2015 while carrying out an investigation into allegations of extrajudicial executions by police in Michoac谩n.
Among the most disturing cases concerned award-winning journalist , who was murdered in May 2017 in Sinaloa state by unknown gunmen who stole his investigative files, laptop and mobile phone. Days after the murder, his colleagues, the director of R铆o Doce, and even his grieving widow began receiving messages with purporting to have information about the identity of C谩rdenas鈥檚 killers. In reality, they were attempts to infect their phones with Pegasus.
An anonymous hacker uses malware to hack passwords and personal data. SHUTTERSTOCK/Suttipun.
As chilling as each of these cases is, they represent only the known attacks. From the information that has been made public, Garc铆a said, it is believed the Mexican authorities had a license to use Pegasus 500 times. 鈥淚magine 500 bullets that can be used to target people鈥, he said. 鈥淎nd this doesn鈥檛 mean 500 attempts. You can use it against people as many times as is needed until you are able to successfully infect them. Right now it鈥檚 impossible to know exactly how many journalists have been targeted.鈥
To make matters worse, the license for Pegasus was renewed twice under the former Mexican government, Garc铆a added, at an estimated cost of $40 million. After his election in 2018, the new left-wing president Andr茅s Manuel L贸pez Obrador his administration would not use the spy software. However, in October 2019 it was again that Pegasus had been used to spy on journalists鈥 phones in Mexico.
Even if the president鈥檚 claim were true, the physiological damage for Mexico鈥檚 media may already be done, Garc铆a said. 鈥淢any journalists are scared they have been targeted by Pegasus and don鈥檛 even know about it鈥, he said. 鈥淭his has had a ripple effect through the journalistic profession and has worsened the atmosphere of self-censorship in Mexico鈥.
In a country currently in the midst of a and with for murder of journalists anywhere in the world in the past decade, the surveillance of reporters by the state will only worsen the situation.
Despite the special prosecutor assigned to investigate the misuse of Pegasus, in the last two years there have been no meaningful results and investigations have stalled, Garc铆a added. 鈥淲e鈥檝e seen no major reform of the system or of the oversight which is needed to govern it鈥, he said. 鈥淭here is a global urgency to tackle this issue and ensure we have proper regulations in place for the use of such technology. In Mexico we were at least able to file lawsuits against the government and have some legal protections and rights. I can鈥檛 even imagine how this technology could be used in more autocratic governments elsewhere in the world.鈥
A crowded market
In recent months, NSO Group and those with it have faced mounting . It was recently that the company is under investigation from the FBI, and it is also facing other lawsuits in聽. This global attention is putting the company under increasing pressure to review who it sells its technology to.
Worryingly, however, Pegasus is by no means the only spyware technology on the market that can be used to monitor journalists. Several other Western companies sell surveillance technology which allows certified government agencies to break into phones and emails.
One of these firms, Milan-based Hacking Team, likewise stresses that it does not sell its product to 鈥渞epressive regimes鈥. However, 21 states, including and the United Arab Emirates were to have used the spyware. In many cases, it has been used directly against media outlets and journalists. In 2014 for example, numerous attempts were made using the firm鈥檚 spyware to target staff working at an diaspora satellite media channel well-known for its criticism of the government.
A programmer shows a sample encrypted code. EPA/Ritchie B. Tongo.
Many other digital surveillance systems are also in use around the world, and often the technology is 鈥渉ome grown鈥. While nowhere near as sophisticated as Pegasus, they can still be used to great effect. In Egypt for example, intelligence services were recently using their own spyware system to target and track prominent critics of the regime, including many journalists. Spies targeted the victims鈥 emails with a sophisticated phishing technique, according to cyber security firm .
In Iran, meanwhile, numerous journalists have been monitored online by the country鈥檚 using a programme called Lawful Interception Management Systems (LIMS). Many have been subsequently arrested and given heavy sentences. In Central Asia, the story is much the same. Repressive governments such as Kazakhstan have advanced surveillance systems to spy on journalists both in the country and abroad. Among the worst abusers is , whose National Security Service (SNB) has been accused of regularly using surveillance tools to monitor independent journalists.
In addition to its growing program, China is suspected of carrying out targeted campaigns against diaspora news websites. Between November 2018 and May 2019, a number of English-language diaspora news sites were targeted in spyware attacks attempting to gain passwords and IP addresses. Similar attacks were also aimed at several online news websites of the persecuted ethnic聽 group, including the Turkistan Times, Turkistan Press and Uighur Times. According to , such attempted malware infections 鈥渨ere part of a state-backed attack 鈥 likely [by] China 鈥 designed to target the Uighur community鈥.
Growing trend
Unfortunately this trend, while small, appears to be growing as more countries both democratic and autocratic upgrade their surveillance capabilities with spyware and other sophisticated spyware and malware tools.
Crucially though, rather than mass surveillance systems developed by government agencies, the tools being used to spy on journalists now are instead increasingly being bought from privately owned, profit-driven companies in the West.
While many of these states are assumed to also be using the technology for legitimate intelligence gathering operations, there is no escaping the conclusion that journalists and other members of civil society have, and will continue to be, unlawfully spied on by their governments.
In a post-Snowden world, the threat this kind of digital surveillance poses to private communications, source protection and secrecy for whistle-blowers, are abundantly clear. It has already been shown that such access to journalists鈥 communications can facilitate attacks 鈥 even fatal ones 鈥 on the press.
Going forward, unless more is known about which countries are using spyware tools, and until safeguards are put in place against their abuse through greater regulation and oversight, it is likely this illegal surveillance of journalists and other members of civil society will increase. If allowed to expand unchecked, this could further damage privacy rights and media freedom in the coming years.