Demonstrations and inquiries: the global impact of the Pegasus project

The Pegasus project investigation has reverberated across the world; claims about the use of invasive spyware, and the governments that use the technology, have provoked demonstrations, political outrage and calls for industry regulation.

Here, Guardian reporters pull together the impact of the investigation, which has put a spotlight on the government customers of the Israeli company NSO Group.

In Paris, there was shock across the political class and special security discussions at the Élysée Palace after Emmanuel Macron’s phone number, as well as those of his former prime minister and the majority of his 20-strong cabinet, appeared in a leaked database seen by the Pegasus project consortium.

Macron chaired an urgent national security meeting on Thursday morning to discuss the use of Pegasus spyware and cybersecurity. The 43-year-old president, who presents himself as tech-savvy and has several phones, has ordered multiple investigations to be carried out.

“The president is following this subject closely and takes it very seriously,” said Gabriel Attal, a government spokesperson. He said France had decided to readjust its security protocols, especially those regarding Macron. Attal did not say if there was any evidence to suggest Macron’s phone had been hacked, and did not say what security protocols had been changed. But an official in the Élysée Palace said his phone and phone numbers had been changed.

NSO said Macron was not a “target” of any of its customers, meaning the company denies there was any attempted or successful Pegasus infection of Macron’s phone.

Research by the Pegasus project suggested Morocco was the country that may have been interested in Macron and his senior team, raising fears their phones were selected by one of France’s close diplomatic allies.

The former environment minister François de Rugy, whose mobile phone showed digital traces of activity associated with NSO Group’s spyware, according to forensic analysis undertaken by the Pegasus project investigation, demanded clarification from Rabat and asked for an audience with the Moroccan ambassador.

Morocco has said it “categorically rejects and condemns these unfounded and false allegations”, adding that it was “erroneous” and “false” to say the country had infiltrated the phones of national or foreign public figures.

In Hungary, the Pegasus project showed through forensics that investigative journalists and the circle of one of the country’s last remaining independent media owners had their phones infected with Pegasus.

The revelations caused an outcry in Brussels and in Hungary. The government of the far-right prime minister, Viktor Orbán, did not issue a firm denial , first saying it was “not aware” of the surveillance taking place, then denying only “illegal surveillance”. In Hungary, only the signature of the minister of justice is required to approve surveillance requests.

Three opposition MPs on the seven-person parliamentary national security committee called an extraordinary meeting of the committee for next Monday to discuss the allegations, but the four members from Orbán’s Fidesz party blocked it from convening.

Péter Ungár, one of the opposition MPs on the committee, said he had been shocked by the allegations. “If the justice minister signed off on any of this, I don’t know how she can keep her position,” he said.

On Wednesday morning, Orbán announced a referendum on a controversial law that conflates homosexuality with paedophilia and bans any portrayal of LGBT issues to children. In Hungary, it was widely seen as an attempt to deflect attention from the Pegasus project.

“It is not surprising, but still shameful, that Orbán fails to face the legal and political consequences for the Pegasus spyware scandal and instead chooses to continue his LGBTIQ-phobic campaign,” said Dávid Vig, the head of Amnesty International’s Hungary office. “If the government authorised the use of spyware on Hungarian citizens illegally, it will need to face the consequences.”

In India, the Pegasus project has shaken the political establishment. As the parliamentary monsoon session kicked off on Monday, the agenda was dominated by reports the mobile phone numbers of the leader of opposition Congress party, Rahul Gandhi, several of his close associates, as well as ministers, journalists, activists and a sitting judge were all on the leaked list. Congress members accused Narendra Modi’s government of “treason”, and called for the resignation of the home minister, Amit Shah.

The debates and opposition in parliament got so heated that the session had to be adjourned twice on Tuesday, as Congress and other politicians brandished placards in the chamber demanding answers from the Modi government, and describing any use of spyware as “an affront to democracy”. Mamata Banerjee, the leader of another opposition party, the Trinamool Congress, demanded that the supreme court look into the claims to “save democracy” in India.

The Modi government denied any unauthorised surveillance had taken place. The newly appointed IT minister, Ashwini Vaishnaw – whose own number, it later emerged, was on the leaked list of numbers – said the stories were an “attempt to malign Indian democracy and its well-established institutions”, a sentiment echoed by several senior figures in Modi’s ruling Bharatiya Janata party.

The reaction to the Pegasus project grew as the week wore on.

The Israeli defence minister, Benny Gantz, was forced to defend granting export licenses for the software sold by NSO Group to foreign governments, claiming that “countries that purchase these systems must meet the terms of use”, which are solely for criminal and terrorism investigations.

Reports have since emerged that the government is setting up a multi-agency task force to deal with the fallout and investigate whether “policy changes” are needed regarding sensitive cyber exports.

For ordinary Israelis, long accustomed to the idea that their technological prowess is the envy of other nations, the Pegasus project has exposed “the dark side of Israeli hi-tech”, the columnist Ben-Dror Yemini wrote in Yedioth Ahronoth newspaper.

“The problem is that the moment a country buys the programme, it can turn any dissident into a target … Things that have happened and may still be happening in some countries are liable to begin to happen in other countries, including Israel itself. We need to keep a watchful eye.”

NSO has denied the database has anything to do with it or its customers. It says it has no visibility into its clients’ activities, and has said the reporting consortium made “incorrect assumptions” about which clients used the company’s technology.

Morocco was suspected of having an interest in the possible targeting of Macron and this week Mediapart, a French online investigative journal, said it had begun legal proceedings against Morocco after analysis showed the phones of its co-founder Edwy Plenel and a reporter, Lénaïg Bredoux, had been infected with Pegasus.

The Moroccan authorities strongly denied Rabat’s intelligence services had been using NSO spyware. On Wednesday, the public prosecutor ordered a government inquiry into what it said were “false spying allegations”.

A day after the Pegasus project launched, the investigative journalist Omar Radi was sentenced to six years in prison in Rabat on rape and espionage charges that rights groups say are trumped up.

Amnesty International first alleged Radi’s phone was targeted and spied on in June 2020.

On Thursday, Morocco said it was suing Amnesty and the Paris-based nonprofit media organisation Forbidden Stories for defamation in a Paris court. The two organisations initially had access to the leaked list and shared it with media partners.

In Mexico, the first lady, Beatriz Gutiérrez Müller, called on the attorney general’s office to investigate the revelations made by the Pegasus project, breaking ranks with her husband who said he would not make a criminal complaint into the number of politicians and innocent civilians whose mobile numbers appeared in the leaked list.

At least 50 people around the president, Andrés Manuel López Obrador – known as Amlo – – including Gutiérrez Müller, three sons, three brothers, aids, advisers and even his cardiologist, were among those of potential interest to clients of NSO, according to the Pegasus project investigation.

Mexico was NSO’s first client and three security agencies are known to have operated Pegasus over the past decade.

Amlo said the federal government no longer spied on political opponents, journalists or activists, and that any existing Pegasus contracts would be cancelled.

In a statement, the attorney general’s office said the NSO contracts signed by the fugitive Tomás Zerón, who was director of the criminal investigation agency (AIC) under Enrique Peña Nieto, were subject to an ongoing criminal investigation. Zerón fled to Israel last year to escape charges of embezzlement, torture and forced disappearence.

Earlier this week, images of Peña Nieto celebrating his birthday were published on Instagram. Nieto has not responded to the allegations despite multiple attempts by the Pegasus project to reach him.

Questions were asked in the British parliament in the aftermath of revelations that more than 400 UK phone numbers appeared in the leaked list, led by Lady Uddin, an independent peer, who herself was among those whose numbers were listed.

The principal government responsible for selecting the UK numbers between 2017 and 2019 appears to have been the United Arab Emirates, traditionally a British ally, in a case that has the potential to be politically embarrassing for both sides.

Speaking in the House of Lords on Thursday, Uddin asked, “in the light of the Guardian investigation”, whether the UK “is fully aware and made representations about potential illegal surveillance of British citizens and institutions?”

A day earlier, a UK government minister, Lord True, had told the Lords that “we have raised our concerns several times with the government of Israel about NSO’s operations”.

There were also complaints from the Muslim Association of Britain, an umbrella group, whose chair, Raghad Altikriti, was another whose number appeared on the list. It said the leak raised “serious questions of national security” and asked was “the British government aware” of the listing and the potential targeting of individuals.

Human rights lawyers said they were examining the reports carefully and were seeking to prepare civil action to force further disclosures from NSO Group.

Apple came under pressure after the Pegasus papers investigation revealed how spyware seems able to defeat the security measures built into some devices. Versions of the Pegasus malware were found to work on iOS 14.6, at the time the newest version of the operating system for iPhones available to end users.

That means the software used a “zero-day” vulnerability – meaning one that had been fixed for zero days before it was exploited. The specific weakness was in iMessage, Apple’s messaging app.

The company said, in a statement that could be paraphrased but not quoted from, that the security of iMessage was improved in iOS 15, due to be released in the autumn.

In a statement, Apple said: “Security researchers agree iPhone is the safest, most secure consumer mobile device on the market … we continue to work tirelessly to defend all our customers, and we are constantly adding new protections for their devices and data.”

In its latest statement in response to the Pegasus project stories, NSO said that “in light of the recent planned and well-orchestrated media campaign led by Forbidden Stories and pushed by special interest groups, and due to the complete disregard of the facts, NSO is announcing it will no longer be responding to media inquiries on this matter and it will not play along with the vicious and slanderous campaign.

“We will state again: the list is not a list of targets or potential targets of Pegasus. The numbers in the list are not related to NSO group. Any claim that a name in the list is necessarily related to a Pegasus target or Pegasus potential target is erroneous and false.”

Comments are closed.