We see Project Pegasus, we must have Open Source Smartphones: let’s discuss
Spyware can make your phone your enemy. Journalism is your defence | Laurent Richard and Sandrine Rigaud
Today, for the first time in the history of modern spying, we are seeing the faces of the victims of targeted cyber-surveillance. This is a worldwide scandal – a global web of surveillance whose scope is without precedent.The attack is invisible. Once “infected”, your phone becomes your worst enemy. From within your pocket, it instantly betrays your secrets and delivers your private conversations, your personal photos, nearly everything about you. This surveillance has dramatic, and in some cases even life-threatening, consequences for the ordinary men and women whose numbers appear in the leak because of their work exposing the misdeeds of their rulers or defending the rights of their fellow citizens.All of these individuals were selected for possible surveillance by states using the same spyware tool, Pegasus, sold by the NSO Group.Our mission at Forbidden Stories is to pursue – collaboratively – the work of threatened, jailed or assassinated journalists. For the Pegasus project, we investigated this new threat against press freedom for months, working alongside more than 80 journalists from 16 media organisations.Quick GuideWhat is in the Pegasus project data? ShowWhat is in the data leak?The data leak is a list of more than 50,000 phone numbers that, since 2016, are believed to have been selected as those of people of interest by government clients of NSO Group, which sells surveillance software. The data also contains the time and date that numbers were selected, or entered on to a system. Forbidden Stories, a Paris-based nonprofit journalism organisation, and Amnesty International initially had access to the list and shared access with 16 media organisations including the Guardian. More than 80 journalists have worked together over several months as part of the Pegasus project. Amnesty’s Security Lab, a technical partner on the project, did the forensic analyses.What does the leak indicate?The consortium believes the data indicates the potential targets NSO’s government clients identified in advance of possible surveillance. While the data is an indication of intent, the presence of a number in the data does not reveal whether there was an attempt to infect the phone with spyware such as Pegasus, the company’s signature surveillance tool, or whether any attempt succeeded. The presence in the data of a very small number of landlines and US numbers, which NSO says are “technically impossible” to access with its tools, reveals some targets were selected by NSO clients even though they could not be infected with Pegasus. However, forensic examinations of a small sample of mobile phones with numbers on the list found tight correlations between the time and date of a number in the data and the start of Pegasus activity – in some cases as little as a few seconds. What did forensic analysis reveal?Amnesty examined 67 smartphones where attacks were suspected. Of those, 23 were successfully infected and 14 showed signs of attempted penetration. For the remaining 30, the tests were inconclusive, in several cases because the handsets had been replaced. Fifteen of the phones were Android devices, none of which showed evidence of successful infection. However, unlike iPhones, phones that use Android do not log the kinds of information required for Amnesty’s detective work. Three Android phones showed signs of targeting, such as Pegasus-linked SMS messages.Amnesty shared “backup copies” of four iPhones with Citizen Lab, a research group at the University of Toronto that specialises in studying Pegasus, which confirmed that they showed signs of Pegasus infection. Citizen Lab also conducted a peer review of Amnesty’s forensic methods, and found them to be sound.Which NSO clients were selecting numbers?While the data is organised into clusters, indicative of individual NSO clients, it does not say which NSO client was responsible for selecting any given number. NSO claims to sell its tools to 60 clients in 40 countries, but refuses to identify them. By closely examining the pattern of targeting by individual clients in the leaked data, media partners were able to identify 10 governments believed to be responsible for selecting the targets: Azerbaijan, Bahrain, Kazakhstan, Mexico, Morocco, Rwanda, Saudi Arabia, Hungary, India, and the United Arab Emirates. Citizen Lab has also found evidence of all 10 being clients of NSO.What does NSO Group say?You can read NSO Group’s full statement here. The company has always said it does not have access to the data of its customers’ targets. Through its lawyers, NSO said the consortium had made “incorrect assumptions” about which clients use the company’s technology. It said the 50,000 number was “exaggerated” and that the list could not be a list of numbers “targeted by governments using Pegasus”. The lawyers said NSO had reason to believe the list accessed by the consortium “is not a list of numbers targeted by governments using Pegasus, but instead, may be part of a larger list of numbers that might have been used by NSO Group customers for other purposes”. They said it was a list of numbers that anyone could search on an open source system. After further questions, the lawyers said the consortium was basing its findings “on misleading interpretation of leaked data from accessible and overt basic information, such as HLR Lookup services, which have no bearing on the list of the customers' targets of Pegasus or any other NSO products ... we still do not see any correlation of these lists to anything related to use of NSO Group technologies”. Following publication, they explained that they considered a "target" to be a phone that was the subject of a successful or attempted (but failed) infection by Pegasus, and reiterated that the list of 50,000 phones was too large for it to represent "targets" of Pegasus. They said that the fact that a number appeared on the list was in no way indicative of whether it had been selected for surveillance using Pegasus. What is HLR lookup data?The term HLR, or home location register, refers to a database that is essential to operating mobile phone networks. Such registers keep records on the networks of phone users and their general locations, along with other identifying information that is used routinely in routing calls and texts. Telecoms and surveillance experts say HLR data can sometimes be used in the early phase of a surveillance attempt, when identifying whether it is possible to connect to a phone. The consortium understands NSO clients have the capability through an interface on the Pegasus system to conduct HLR lookup inquiries. It is unclear whether Pegasus operators are required to conduct HRL lookup inquiries via its interface to use its software; an NSO source stressed its clients may have different reasons – unrelated to Pegasus – for conducting HLR lookups via an NSO system.This investigation began with an enormous leak of documents that Forbidden Stories and Amnesty International had access to. In this list of more than 50,000 phone numbers identified in advance of potential surveillance by clients of NSO Group, we even found the names of some of our colleagues – journalists we had worked with on past investigations.But the scale of this scandal could only be uncovered by journalists around the world working together. By sharing access to this data with the other media organisations in the Forbidden Stories consortium, we were able to develop additional sources, collect hundreds of documents and put together the harrowing evidence of a surveillance apparatus that has been wielded ferociously against swaths of civil society – outside of all legal restrictions.Among those whose phone numbers appear in the data: human rights defenders, political opponents, lawyers, diplomats, and heads of state – not to mention more than 180 journalists from nearly two dozen countries. Some are local reporters, others renowned television anchors. Many investigate corruption and political scandals that threaten the highest levels of power. Most already face censorship and intimidation. But few of them could have imagined having been selected by their governments for possible targeting by such an invisible and invasive form of surveillance.The list of journalists targeted using Pegasus is long: award-winning Azerbaijani journalist Khadija Ismayilova; reporter Szabolcs Panyi from Direkt36, a Hungarian investigative media outlet; freelance Moroccan journalist Hicham Mansouri; the director of the French investigative site Mediapart, Edwy Plenel; and the founders of the Indian independent media the Wire, one of the few news organisations in the country that does not rely on money from private business entities.For NSO Group’s government clients, Pegasus is the perfect weapon to “kill the story”. Invasive surveillance of journalists and activists is not simply an attack on those individuals; it is a way to deprive millions of citizens of independent information about their own governments. When they hack a journalist’s phone, they are able to extract the most sensitive information that it holds. What was that journalist working on? Who are their sources? Where are they stashing their documents? Who are their loved ones? What private information could be used to blackmail and defame them?Q&AWhat is the Pegasus project?ShowThe Pegasus project is a collaborative journalistic investigation into the NSO Group and its clients. The company sells surveillance technology to governments worldwide. Its flagship product is Pegasus, spying software – or spyware – that targets iPhones and Android devices. Once a phone is infected, a Pegasus operator can secretly extract chats, photos, emails and location data, or activate microphones and cameras without a user knowing.Forbidden Stories, a Paris-based nonprofit journalism organisation, and Amnesty International had access to a leak of more than 50,000 phone numbers selected as targets by clients of NSO since 2016. Access to the data was then shared with the Guardian and 16 other news organisations, including the Washington Post, Le Monde, Die Zeit and Süddeutsche Zeitung. More than 80 journalists have worked collaboratively over several months on the investigation, which was coordinated by Forbidden Stories.Journalists have long thought that new technologies – the armada of encrypted communications that they rely on – are their allies, critical blockades against censorship. With the existence of cyber-surveillance tools as advanced as Pegasus, they have been brutally awoken to the fact that the greatest threats are hiding in the places they once thought to be the safest. The Pegasus project poses important questions about the privatisation of the surveillance industry and the lack of global safeguards for everyday citizens.When a threat as large as this emerges, imperilling fundamental rights such as the right to free speech, journalists need to come together. If one reporter is threatened or killed, another can take over and ensure that the story is not silenced. Forty-five years ago, the first collaborative journalism project was launched after the murder of Don Bolles, a journalist in Phoenix, Arizona. In 2018, Forbidden Stories coordinated the Daphne project in the wake of the assassination of Daphne Caruana Galizia in Malta. We have continued to pursue the work of journalists who have been murdered for their work – whether that was investigating environmental scandals or tracking Mexican drug cartels – alongside dozens of news organisations.The collaboration of journalists from around the world is without a doubt one of the best defences against these violent attacks on global democracy.
 
  Laurent Richard is the founder and director of Forbidden Stories, a consortium of journalists that was awarded the 2019 European press prize and the 2021 George Polk award for its work continuing the investigations of threatened reporters. Sandrine Rigaud is the editor-in-chief of Forbidden Stories.
