Data leak reveals that Israeli spyware was used to target dissidents, journalists

The investigation of a data leak has revealed that governments targeted journalists, dissidents, and activists using information sold to them by an Israeli spyware company.

The NSO Group, which was founded in 2010, has been mired in controversy for years over its Pegasus hacking technology. The malware allows the tool’s users to extract information from iPhone and Android devices. A French media nonprofit called Forbidden Stories coordinated “The Pegasus Project” with a number of journalists and media outlets to investigate a data leak of over 50,000 phone numbers.

The investigation found that authoritarian governments used Pegasus to target over 180 journalists across at least 20 countries. This includes Saudi Arabia and the UAE, who apparently targeted the family of slain Washington Post journalist Jamal Khashoggi, before and after his murder. In Mexico the journalist Cecilio Pineda was targeted by the malware just weeks before his 2017 murder.

“The Pegasus Project lays bare how NSO’s spyware is a weapon of choice for repressive governments seeking to silence journalists, attack activists and crush dissent, placing countless lives in peril,” said Secretary General of Amnesty International Agnes Callamard. “These revelations blow apart any claims by NSO that such attacks are rare and down to rogue use of their technology. While the company claims its spyware is only used for legitimate criminal and terror investigations, it’s clear its technology facilitates systemic abuse. They paint a picture of legitimacy, while profiting from widespread human rights violations.”

These new revelations have brought increased scrutiny of the Israeli government, which sold NSO the export license it needed to work with foreign governments. The Israeli Defense Ministry had previously declared that it would not sell technology to governments that commit human rights abuses. Last year then-Israeli Minister of Defense (and now Prime Minister) Naftali Bennett publicly celebrated the fact that NSO had worked with the Israeli military to follow COVID exposure among the country’s population.

In 2019 Facebook sued NSO after almost 1,400 WhatsApp users were hacked through Pegasus technology. These hacks also included a number of journalists and activists. The company vehemently denied those claims. “The sole purpose of NSO is to provide technology to licensed government intelligence and law enforcement agencies to help them fight terrorism and serious crime,” it said in a statement at the time, “Our technology is not designed or licensed for use against human rights activists and journalists. We consider any other use of our products than to prevent serious crime and terrorism a misuse, which is contractually prohibited. We take action if we detect any misuse.” 

NSO has released a similar statement in response to this new round of allegations:

The report by Forbidden Stories is full of wrong assumptions and uncorroborated theories that raise serious doubts about the reliability and interests of the sources. It seems like the “unidentified sources” have supplied information that has no factual basis and are far from reality.

After checking their claims, we firmly deny the false allegations made in their report. Their sources have supplied them with information which has no factual basis, as evident by the lack of supporting documentation for many of their claims.
In fact, these allegations are so outrageous and far from reality, that NSO is considering a defamation lawsuit.

The company’s website claims that there are “contractual obligations requiring NSO’s customers to limit the use of the company’s products to the prevention and investigation of serious crimes, including terrorism, and to ensure that the products will not be used to violate human rights.”