180 journalists surveilled

ISLAMABAD: A global investigation into the leaked data of phone records has revealed that more than 50,000 numbers were targeted through Israel-made surveillance software by its client governments in different countries which are hostile towards journalists,activists and political opponents. At least, 180 journalists were surveilled through the Pegasus software the Israeli firm, NSO Group, sold to different governments.

More than 2000 Pakistanis and Indians were also targets of surveillance done through Pegasus between 2017 and 2019, the identities of Pakistanis are not known. An earlier report indicated that around a couple of defense and intelligence officials from Pakistan were also spied through this software.

The data leak contains phone numbers selected by government clients of NSO Group for spying from 2016 onward; the time and date of selecting a number for surveillance, is also part of the record. Forbidden Stories, a Paris-based non-profit journalism organization, and Amnesty International initially had access to the list that it later shared with 16 media organizations. More than 80 journalists worked together over this investigation named the Pegasus Project.

The issue was initially popped up when WhatsApp discovered the breach and filed a lawsuit against NSO Group in May 2019 in which it accused the company of “unauthorized access and abuse” of its services. All the intrusion exploited a vulnerability in WhatsApp software that would allow the users of the malware to access messages and data on the targets’ phones. Further investigation revealed the Pegasus is capable of hacking the phone and reporting back all the activities to the operator. Such attacks are carried out by sending a text message containing a malicious link to the target’s phone. If the target clicked, a malicious page would open on their web browser to download and execute the malware, infecting the device. Various tactics are used for the purpose. They would send spam messages just to frustrate the target, then send another message telling them to click on the link to stop receiving the spam. Such techniques are used in order to manipulate targets into clicking by embedding the link in messages designed to appear to their fears and interests, said Claudio Guarnieri, head of Amnesty International’s Security Lab. The messages might include news of interest to the target or promotions for things they know you want, he added.

This is how audacious individuals are tricked into surveillance. In Hungary, for example, journalist Szabolcs Panyi exposed spy intrigues and murky arms deals. In India, Paranjoy Guha Thakurta investigated the links between business and political interests and in Azerbaijan, Sevinj Vaqifqizi caught vote-rigging on tape.

In Hungary, Szabolcs Panyi exposed spy intrigue and murky arms deals. In India, Paranjoy Guha Thakurta probed the ties between business and political interests. In Azerbaijan, Sevinj Vaqifqizi caught vote-rigging on tape. “Separated by thousands of miles, these journalists have one thing in common: their governments considered them a threat,” noted the Organized Crime and Corruption Reporting Project which is a partner in the Pegasus Project. All three were among dozens of journalists and activists around the world whose smartphones were infected by Pegasus: spyware made by Israeli firm NSO Group that is able to secretly steal personal data, read conversations, and switch on microphones and cameras at will.

The editor of the Financial Times is one of more than 180 editors, investigative reporters and other journalists around the world who were selected as possible candidates for surveillance by government clients of the surveillance firm. In Azerbaijan where the longtime dictator Ilham Aliyev tolerates little dissent, the phone numbers of six dissidents or activities in the country whose private correspondence was featured in 2019 are listed in the leaked records.

In India, different activists were found in the data. Umar Khalid, a student activist at Jawaharlal Nehru University in Delhi was selected ahead of a possible targeting in late 2018, shortly before sedition charges were filed against him. He was arrested in September 2020 on charges of organizing riots and police claimed the evidence against him included more than one million pages of information gleaned from his mobile phone, without making it clear how the information was obtained.

Forbidden Stories, which coordinated this investigation claims that more than 2000 Indian and Pakistani numbers were selected as targets between 2017 and 2019. It hasn’t identified Pakistani numbers. Indian journalists in the target list that it reported are from nearly all media outlets including The Hindu, Hindustan Times, the Indian Express, India Today, Tribune and The Pioneer. Also, the local journalists were targeted. Included among them were Jaspal Singh Heran, editor in chief of a Punjab language newspaper. Phones of the editors of The Wire—Siddharth Varadarajan and ML Venu --- were infected; Venue’s phone was hacked this month. Others in the list were a columnist, Prem Shankar Jha, investigative reporter, Rohini Singh, diplomatic editor, Devirupa Mitra and contributor, Swati Chaturvedi.

In Saudi Arabia, Loujain al-Hathloul, a women’s rights activist was selected for possible targeting weeks before her 2018 abduction in the UAE and forced to return to Saudi Arabia where she was imprisoned for three years and allegedly tortured. Despite her release in February this year, she is not permitted to speak to journalists or move freely within Saudi Arabia.

In Mexico, campaigners, lawyers and rights defenders were targets including a judge, Eduardo Ferrer Mac-Gregor Poisot, who was the president of the Inter-American court of human rights and a catholic priest, Alejandro Solalinde. In London, a prominent human rights lawyer, Rodney Dixon, whose clients included a British student jailed in UAE and the fiancée of Jamal Khashoggi, was also among the targets.

The highest number of journalists and dissidents targeted through this surveillance software were in Azerbaijan (48), India (38), Morocco (38) and UAE (12). Journalists in Hungary, Turkey, Qatar, Algeria, Spain, France, Uganda, Togo, D. R. Congo, United Kingdom, Kazakhstan, Bahrain, Saudi Arabia, Rwanda and Mexico were also in the target list. They are apart from those working with the world’s leading media organizations like the Wall Street Journal, CNN, New York Times, Al Jazeera, Bloomberg, Agence France-Presse, the Economist, Reuters and Voice of America.

The NSO Group, in a clarification to media organizations working on the Pegasus Project, said its products are only for use against terrorist organizations and serious criminals. The statistics it shared suggest 51% of its markets are intelligence agencies, 38% law enforcement agencies and 11% military. It said it doesn’t sell software to private individuals or entities.

Based on the geographical clustering of the numbers on the leaked list, reporters working on Pegasus Project identified potential NSO Group clients from more than 10 countries: Mexico, Azerbaijan, Kazakhstan, Hungary, India, United Arab Emirates, Saudi Arabia, Bahrain, Morocco, Rwanda and Togo.