MarketPegasus Project (investigation)
Company Profile

Pegasus Project (investigation)

The Pegasus Project is an international investigative journalism initiative that revealed governments' espionage on journalists, opposition politicians, activists, business people and others using the private Pegasus spyware developed by the Israeli technology and cyber-arms company NSO Group. Pegasus is ostensibly marketed for surveillance of "serious crimes and terrorism". In 2020, a target list of 50,000 phone numbers leaked to Forbidden Stories, and an analysis revealed the list contained the numbers of leading opposition politicians, human rights activists, journalists, lawyers and other political dissidents.

Software
The Pegasus spyware was developed by the Israeli cyberarms company NSO Group. It can be covertly installed on mobile phones (and other devices) running most versions of iOS and Android. The spyware is named after the mythical winged horse Pegasus—it is a Trojan horse that can be sent "flying through the air" to infect phones. Usages of the Pegasus spyware have been monitored for years. Amnesty has argued that the digital invasion is correlated with real-life consequences for spied targets, via psychological or physical damages. The NSO Group exports are overseen by the Israeli Ministry of Defense's Defense Exports Control Agency (DECA). ==Investigation==
Investigation
Origins and members In 2020, a list of over 50,000 phone numbers believed to belong to individuals identified as "people of interest" by clients of the Israeli cyberarms firm NSO Group was leaked to Amnesty International and Forbidden Stories, a media nonprofit organisation based in Paris, France. This information was passed along to 17 media organisations under the umbrella name "The Pegasus Project". Over several months, over 80 journalists from The Guardian (United Kingdom), Le Monde and Radio France (France), Die Zeit, Süddeutsche Zeitung, WDR and NDR (Germany), The Washington Post and Frontline (United States), Haaretz (Israel), Aristegui Noticias and Proceso (Mexico), Knack and Le Soir (Belgium), The Wire (India), Daraj (Syria), Direkt36 (Hungary), Some emerging unverified online services claim to be able to assess an infection by Pegasus, but their usage is discouraged as possible scams themselves. Amnesty and Forbidden Stories received numerous queries for checking devices but were not able to satisfy the demand for assistance. A French journalist noted that "in a matter of cyber-surveillance, we observe that abuse is de facto the rule". Forbidden Stories argues the Pegasus software and its usages de facto constitute a global weapon to silence journalists. Forensic Architecture and the Pegasus Project lead a data analysis and built a data visualisation plotting attempt hacking of dissidents together with real-life intimidations, threats or violence. They have argued that Pegasus has become a key tool for states to repress their own people. == Regions and targets ==
Regions and targets
Targets include known criminals as well as human rights defenders, political opponents, lawyers, diplomats, heads of state and nearly 200 journalists from 24 countries. The Guardian mentioned 38 journalists in Morocco, 48 journalists in Azerbaijan, 12 journalists in the United Arab Emirates and 38 journalists in India as having been targeted. implying possible full access to their mobile phones' data: • Abdelaziz Bouteflika, former President of Algeria Hungary Used against opposition journalists, opposition leaders and critics. • Szabolcs Panyi, a Hungarian investigative journalist for , hacked in 2019. • Dávid Dercsényi, a Hungarian investigative journalist (HVG). • György Gémesi, a right-wing opposition politician, mayor of Gödöllő and president of the Alliance of Hungarian Local-Governments. • , president of the Hungarian Bar Association, and nine other lawyers. • Zoltán Varga, a businessman and owner of Central Media Group, which publish opposition press products (24.hu). He would go on to claim that "all [his] phones are tapped". • Five close friends and other Indian National Congress party officials were in the leaked list of potential targets. was also targeted. Some opposition politicians such as Mamata Banerjee even claimed that Pegasus was used to keep track of the meetings between the two. • Ashok Lavasa, an ex-Election Commissioner of India who flagged Prime Minister Narendra Modi's poll code violation in the 2019 Indian general election was targeted. • Alok Verma, who was ousted as the head of the Central Bureau of Investigation (CBI) by Prime Minister Narendra Modi in 2018 was a target. • Numerous Indian politicians including Deputy Chief Minister of Karnataka G. Parameshwara, as well as close aides of then Chief Minister H. D. Kumaraswamy and senior Congress leader Siddaramaiah. • Abhishek Banerjee, a West Bengal politician of the All India Trinamool Congress, and the nephew of incumbent Chief Minister of West Bengal Mamata Banerjee. • Siddharth Varadarajan, a New Delhi–based, American investigative journalist and founder of The Wire. Varadarajan joined the Pegasus Project investigation. • The inner circle to the 14th Dalai Lama Tenzin Gyatso, the 17th Karmapa Ogyen Trinley Dorje and other Tibetan figures, including: • Tempa Tsering, the Dalai Lama's envoy to Delhi ItalyRomano Prodi, former Prime Minister of Italy and former President of the European Commission, was spied on while he was working as the UN Special Envoy to Sahel. Mexico Used against anti-corruption journalists, opposition leaders and a judge. • Cecilio Pineda Birto (died 2 March 2017), a Mexican investigative and anti-corruption journalist. His phone was added as a Pegasus target just weeks before his assassination. • , a Mexican judge, former president of the Inter-American Court of Human Rights. • Edwy Plenel, a French journalist, co-founder and publishing editor at opposition newsroom Mediapart, hacked in 2019 by Morocco. • , a French journalist also at Mediapart, hacked in 2020 by Morocco. • Ahmed Gaid Salah, former Chief of Staff of the Algerian People's National Armed Forces Michał Woś, deputy minister of justice, requested a parliamentary committee to divert funds from a ministry-run fund to "combat crime." Once approved, the Central Anticorruption Bureau (CBA) purchased the licenses for PLN 33.4 million. The transaction with NSO Group was camouflaged with unrelated invoices. The contract for 40 licenses to be used over three years was mediated by Matic, a company established by former Militia and Security Service associates. The spyware was first deployed in November 2017. In 2020, Rzeczpospolita reported that the bulk of evidence in a corruption case against former Civic Platform politician Sławomir Nowak was obtained using Pegasus. The CBA denied ever buying the license, still the government assured it had court permission. In December 2021, Citizen Lab announced to have found multiple hacks into phones of prominent opposition figures during the 2019 parliamentary elections that the right-wing populist party Law and Justice (PiS) of Jarosław Kaczyński won by a slim margin, which lead to a further erosion of judicial independence and press freedom. As of 25 January 2022, the reported victims include: • Roman Giertych, a lawyer representing top opposition politicians, and the deputy prime minister in 2006–2007 Kaczyński's Cabinet, The hack against Brejza was later confirmed by Amnesty International. • Michał Kołodziejczak, a farmer and leader of the social movement Agrounia, • Tomasz Szwejgiert, a journalist and alleged former associate of the CBA, hacked while co-authoring a book about Mariusz Kaminski, head of the CBA. • Katarzyna Kaczmarek, wife of (referred to as "agent Tomek"), former policeman and former CBA officer, later a PiS MP. On 17 January 2024, the Polish Parliament established a commission of inquiry into operational and exploratory activities involving Pegasus. The scope of the commission's work will cover the period from November 16, 2015 to November 20, 2023. Saudi Arabia , Saudi women's rights activist, was placed on Pegasus target's list then abducted, arrested and tortured. Used against an opposition journalist and a women's rights activist since 2018. • Jamal Khashoggi (died 2 October 2018), a Saudi-American investigative and opposition journalist, a contributor to The Washington Post, assassinated by Saudi operatives. Khashoggi, his wife Hanan El-Atr and phones of other people close to him have been targeted before and after his assassination. • , Khashoggi's partner, was infected with Pegasus with forensic evidence of the spyware found on 6, 9 and 12 October 2018, a few days after Khashoggi's assassination. • Khashoggi's contacts Yasin Aktay, Yahya Assiri, Hanan El-Atr, Abdullah Khashoggi, Madawi al-Rasheed, and Azzam Tamimi were also targeted. • , Turkey's Istanbul chief prosecutor in charge of the Khashoggi murder's investigation, who later charged 20 Saudi operatives, is on the list of leaked targets. • Loujain al-Hathloul, a prominent Saudi women's rights activist, selected in 2018, likely by the United Arab Emirates (an ally of Saudi Arabia), before her abduction and return to Saudi Arabia for arrest and possibly torture. She was released from prison in February 2021, but her freedom of movement is still limited. United Arab Emirates Used against human rights activists, local leaders and local nobility and Sheikh Maktoum family members. With more than 10,000 people of interest linked to Dubai, it was one of the most extensive uses of Pegasus. The targets were mainly from the UAE and Qatar, but also included people from Egypt, Lebanon, Iraq, Yemen, and Saudi Arabia. the NSO Pegasus license was stripped from Dubai due to human rights concerns The list of "people of interest" includes her phone number as well as the phone number of 8 of her closest aides, advisers and friends, including personal assistant, security staffs, one of her lawyers advising her in her custody and divorce dispute with Sheikh Maktoum. • Alaa al-Siddiq (died 19 June 2021), an Emirati human rights activist, executive director of the human rights organisation ALQST and the daughter of Muhammad al-Siddiq, one of the UAE-94 pro-democracy political prisoners. Following the 2011 Arab Spring, Alaa al-Siddiq was self-exiled to Qatar then the UK since 2012. All of her family members were stripped of their UAE nationality. Following her death in a car accident in 2021 in the UK, the UAE refused her body to be taken back to the country for burial. Citizens Lab found traces of Pegasus surveillance on her phone. • Ahmed Mansoor, an Emirati human rights and reformist blogger, confirmed hacked by Pegasus. Arrested in 2011, pardoned, then arrested again in 2017 with 10 years sentences. Detained in dire conditions. • Over 3,000 Qataris. • European, Asian human rights activists supporting rights in the Gulf countries. == Reactions ==
Reactions
NSO Group's response Vetting and licence contract NSO Group did not deny the presence of its spyware, responding to the report by stating they rigorously vetted its customers' human rights records before allowing them to use its spy tools. Once sold, NSO Group says it does not know nor can see how its client governments use its spyware. The CEO of NSO Group categorically claimed that the list in question is unrelated to them, the source of the allegations can not be verified as a reliable one. "This is an attempt to build something based on a crazy lack of information... There is something fundamentally wrong with this investigation." The owner of the company that developed the Pegasus spyware categorically refutes all allegations, stating that the list of the phone numbers in question has nothing to do with the Pegasus spyware. Haaretz argued such invasive monitoring technology is the weapon of choice for autocratic governments, allowing continuous monitoring of opponents, preventing protests from the beginning before they are organised, and discouraging sources to share information with journalists. This technology should, therefore, be shared only with countries with independent and solid rule of law. The International Press Institute, an international press freedom network, denounced the abuse of spying on journalists, calling formal investigations and accountability. Tamer Almisshal, an investigative journalist for Al Jazeera Arabic, said, "[The hacking of the Al Jazeera staffers' and journalists' phones is] a crime against journalism. Based on this spyware, journalists have been arrested, disappeared, or even killed. Khashoggi is just one example". In a statement, the said they were "shocked" by the revelations and also stated: "If this is the case, it is unacceptable, outrageous and illegal, full information must be disclosed to the public immediately". In a tweet, the Press Club of India (PCI) issued a statement: This is the first time in the history of this country that all pillars of our democracy — judiciary, Parliamentarians, media, executives & ministers — have been spied upon. This is unprecedented and the PCI condemns unequivocally. The snooping has been done for ulterior motives. What is disturbing is that a foreign agency, which has nothing to do with the national interest of the country, was engaged to spy on its citizens. This breeds distrust and will invite anarchy. The Govt should come out clean on this front and clarify. Similarly, the Editor's Guild of India also released a statement directed against the alleged spying made by the Indian government, saying: This act of snooping essentially conveys that journalism and political dissent are now equated with 'terror'. How can a constitutional democracy survive if governments do not make an effort to protect freedom of speech and allows surveillance with such impunity?It asked for a Supreme Court monitored enquiry into the matter, and further demanded that the inquiry committee should include people of impeccable credibility from different walks of life—including journalists and civil society—so that it can independently investigate the facts around the extent and intent of snooping using the services of Pegasus. Companies Amazon's cloud computing subsidiary AWS stated they had terminated "relevant infrastructure and accounts" linked to NSO Group, following an investigation by Amnesty International that discovered Amazon CloudFront was being used to infect targets with the Pegasus malware. The CEO of WhatsApp, Will Cathcart, called for a global moratorium on the use of unaccountable surveillance technology and defended the use of end-to-end encryption following the reports. National governments Algeria In a statement released, Algeria's public prosecutor has ordered an investigation into the reports that the country may have been a target of the Pegasus spyware. France After the revelations of the Pegasus Project investigation, in which it was revealed that the French president Emmanuel Macron was targeted, In the aftermath of these revelations, Macron changed his telephone number and replaced his phone. Furthermore, he ordered an overhaul in security procedures. Macron reportedly contacted Israel's prime minister Naftali Bennett to discuss Israel's internal investigation and express concern that his data appeared on the list of potential targets and urged Bennett to conduct an inquiry. French intelligence (ANSSI) confirmed that Pegasus spyware had been found on the phones of three journalists, including a journalist of France 24, in what was the first time an independent and official authority corroborated the findings of the investigation. Hungary A statement from the office of Viktor Orbán in Hungary stated that they were not aware of any alleged data collection. On November 4, 2021, Lajos Kósa, Member of Parliament and Vice President of Fidesz, member of the Parliamentary Defence and Law Enforcement Committee, admitted that the Ministry of Interior had purchased and used the Pegasus software. India The government has not denied the usage of Pegasus spyware in their response so far. The government has also denied the request for investigation or an independent Supreme Court inquiry by the opposition into the matter. The official response of the Government of India to The Washington Post stated that "[t]he allegations regarding government surveillance on specific people has no concrete basis or truth associated with it whatsoever" and that such news reports were an attempt to "malign the Indian democracy and its institutions". They further stated that each case of interception, monitoring and decryption is approved by the Union Home Secretary and that there exists an oversight mechanism in the form of a review committee headed by the Union Cabinet Secretary and that any such interceptions have been done under the due process of law. The Indian IT Minister Ashwini Vaishnaw in a statement in parliament stated that the reports were "highly sensational" and that they had "no factual basis". He further stated that NSO themselves had rubbished the claims. He stated that the existence of numbers in a list was not sufficient evidence to indicate that the spyware was used and said that the report itself stated the same and without the physical examination of the phone such claims cannot be corroborated. The Minister of Home and Internal Security Amit Shah in a statement on his blog insinuated that this was an attempt to disrupt the monsoon session of the parliament and that the opposition parties were "jumping on a bandwagon" and were trying to "derail anything progressive that comes up in Parliament". He stated that the report was an attempt to "derail India's development trajectory through their conspiracies". Replying to allegations from the opposition, Minister of State in Ministry of Home Affairs Ajay Kumar Mishra said that there is no reason for a probe and the people who made the allegations are "political failures". In the aftermath of the revelations by the investigations of the Pegasus Project, the head of the Israeli parliament's Foreign Affairs and Defence Committee announced a commission to investigate the allegations of misuse of Pegasus for surveillance and hacking. In December 2021, the Israeli Defense Ministry imposed new restrictions on the export of cyber warfare tools as a result of the scandals involving NSO. Kazakhstan In the revelations made by the investigation, it came to light that the Kazakhstan's former Prime Minister, Bakhytzhan Sagintayev, could have been targeted. However, top officials have claimed that these reports and allegations of the president being spied on were "without evidence". Furthermore, the deputy head of Kazakhstan's presidential administration Dauren Abaev said the list of targets was "rather intriguing information without any evidence". The then-Moroccan ambassador to France, Chakib Benmoussa, also denied reports that his country's authorities had spied on French President Emmanuel Macron. Morocco later sued Amnesty International and Forbidden Stories for defamation, with lawyer , acting on behalf of the government, saying that the Moroccan state "wants all possible light cast on these false allegations", and that it "does not intend to let the multiple lies and fake news spread these past few days go unpunished". It also issued defamation citations against Le Monde, Mediapart and Radio France on 28 July 2021, and filed an injunction request against the German newspaper Süddeutsche Zeitung on 2 August. Pakistan The Prime Minister of Pakistan, Imran Khan, whose name was revealed to be in the list, Rwanda Rwanda, through a statement by Vincent Biruta, Minister of Foreign Affairs and International Cooperation, denied using Pegasus and claimed that "false accusations" of the country using Pegasus were "part of an ongoing campaign to cause tensions between Rwanda and other countries, and to promote disinformation about Rwanda domestically and internationally." Saudi Arabia Saudi Arabia's official Saudi Press Agency has denied all allegations of its use of Pegasus spyware on journalists and human rights activists as "baseless". The allegations were dismissed as "untrue". United Arab Emirates A statement released by the UAE's foreign minister stated that the allegations of use of the Pegasus spyware by the UAE on journalists and individuals were "categorically false" and that such allegations had no evidentiary basis and they denied all allegations. The Indian IT minister made a statement that similar claims were made in the past regarding Pegasus for WhatsApp which had no factual basis and was even denied by the Supreme Court of India. However, many of the statements made by the Indian IT minister were verified by the Internet Freedom Foundation and were not found to be accurate. West Bengal Chief Minister Mamata Banerjee alleged that the central government intends to "turn India into a surveillance state" where "democracy is in danger". On July 26, 2021, The West Bengal Chief Minister announced a commission of inquiry into the alleged surveillance of phones using Pegasus. Retired Supreme Court judge Justice Madan B Lokur, and former Chief Justice of Calcutta High Court, Justice (retd) Jyotirmay Bhattacharya, have been appointed as members of the commission. In India, some news articles were released making claims that Amnesty never claimed that the leaked phone numbers were of NSO's Pegasus spyware list. However, these reports were later proven to be false, and Amnesty issued a statement stating that it categorically stands by the findings of the investigation and that the data is irrefutably linked to potential targets of Pegasus. The European Parliament awarded the 2021 Daphne Caruana Galizia journalism prize to the Pegasus Project. Government investigations On 20 July 2021, it was reported that French prosecutors would investigate allegations that Moroccan intelligence services used Pegasus to spy on French journalists. France's national agency for information systems security (ANSSI) identified digital traces of Pegasus on three journalists' phones and relayed its findings to the Paris public prosecutor's office, which is overseeing the investigation into possible hacking. == See also ==
tickerdossier.comtickerdossier.substack.com