The Lie That the Innocent Need Not Fear Surveillance Has Been Shattered

By Paul Lewis, Guardian UK

19 July 21

Our investigation shows how repressive regimes can buy and use the kind of spying tools Edward Snowden warned us about

illions of people are inseparable from their phones. Their devices are within reach – and earshot – for almost every daily experience, from the most mundane to the most intimate.

Few pause to think that their phones can be transformed into surveillance devices, with someone thousands of miles away silently extracting their messages, photos and location, activating their microphone to record them in real time.

Such are the capabilities of Pegasus, the spyware manufactured by NSO Group, the Israeli purveyor of weapons of mass surveillance.

NSO rejects this label. It insists only carefully vetted government intelligence and law enforcement agencies can use Pegasus, and only to penetrate the phones of “legitimate criminal or terror group targets”.

Yet in the coming days the Guardian will be revealing the identities of many innocent people who have been identified as candidates for possible surveillance by NSO clients in a massive leak of data.

Without forensics on their devices, we cannot know whether governments successfully targeted these people. But the presence of their names on this list indicates the lengths to which governments may go to spy on critics, rivals and opponents.

First we reveal how journalists across the world were selected as potential targets by these clients prior to a possible hack using NSO surveillance tools.

Over the coming week we will be revealing the identities of more people whose phone numbers appear in the leak. They include lawyers, human rights defenders, religious figures, academics, businesspeople, diplomats, senior government officials and heads of state.

Our reporting is rooted in the public interest. We believe the public should know that NSO’s technology is being abused by the governments who license and operate its spyware. But we also believe it is in the public interest to reveal how governments look to spy on their citizens and how seemingly benign processes such as HLR lookups can be exploited in this environment.

The Pegasus project is a collaborative reporting project led by the French nonprofit organisation Forbidden Stories, including the Guardian and 16 other media outlets. For months, our journalists have been working with reporters across the world to establish the identities of people in the leaked data and see if and how this links to NSO’s software.

It is not possible to know without forensic analysis whether the phone of someone whose number appears in the data was actually targeted by a government or whether it was successfully hacked with NSO’s spyware. But when our technical partner, Amnesty International’s Security Lab, conducted forensic analysis on dozens of iPhones that belonged to potential targets at the time they were selected, they found evidence of Pegasus activity in more than half.

One phone that has contained signs of Pegasus activity belonged to our esteemed Mexican colleague Carmen Aristegui, whose number was in the data leak and who was targeted following her exposé of a corruption scandal involving her country’s former president Enrique Peña Nieto.

The data leak suggests that Mexican authorities did not stop at Aristegui. The phone numbers of at least four of her journalist colleagues appear in the leak, as well as her assistant, her sister and her son, who was 16 at the time.

Investigating software produced and sold by a company as secretive as NSO is not easy. Its business is surveillance, after all. It meant a radical overhaul of our working methods, including a ban on discussing our work with sources, editors or lawyers in the presence of our phones.

The last time the Guardian adopted such extreme counter-espionage measures was in 2013, when reporting on documents leaked by the whistleblower Edward Snowden. Those disclosures pulled back the curtains on the vast apparatus of mass surveillance created after 9/11 by western intelligence agencies such as the National Security Agency (NSA) and its British partner, GCHQ.

In doing so, they instigated a global debate about western state surveillance capabilities and led to countries, including the UK, admitting their regulatory regime was out of date and open to potential abuse.

The Pegasus project may do the same for the privatised government surveillance industry that has turned NSO into a billion-dollar company.

Companies such as NSO operate in a market that is almost entirely unregulated, enabling tools that can be used as instruments of repression for authoritarian regimes such as those in Saudi Arabia, Kazakhstan and Azerbaijan.

The market for NSO-style surveillance-on-demand services has boomed post-Snowden, whose revelations prompted the mass adoption of encryption across the internet. As a result the internet became far more secure, and mass harvesting of communications much more difficult.

But that in turn spurred the proliferation of companies such as NSO offering solutions to governments struggling to intercept messages, emails and calls in transit. The NSO answer was to bypass encryption by hacking devices.

Two years ago the then UN special rapporteur on freedom of expression, David Kaye, called for a moratorium on the sale of NSO-style spyware to governments until viable export controls could be put in place. He warned of an industry that seemed “out of control, unaccountable and unconstrained in providing governments with relatively low-cost access to the sorts of spying tools that only the most advanced state intelligence services were previously able to use”.

His warnings were ignored. The sale of surveillance continued unabated. That GCHQ-like surveillance tools are now available for purchase by repressive governments may give some of Snowden’s critics pause for thought.

In the UK, the whistleblower’s detractors argued breezily that spying was what intelligence agencies were supposed to do. We were assured that innocent citizens in the Five Eyes alliance of intelligence powers, comprising Australia, Canada, New Zealand, the UK and US, were safe from abuse. Some invoked the dictum: “If you have done nothing wrong, you have nothing to fear.”

The Pegasus project is likely to put an end to any such wishful thinking. Law-abiding people – including citizens and residents of democracies such as the UK, such as editors-in-chief of leading newspapers – are not immune from unwarranted surveillance. And western countries do not have a monopoly on the most invasive surveillance technologies. We’re entering a new surveillance era, and unless protections are put in place, none of us are safe.