Military-grade spyware found on journalists’ and activists’ phones: report

Military-grade spyware licensed by an Israeli firm was used in attempts to hack into smartphones belonging to journalists and activists, according to a new investigation by The Washington Post and 16 media partners.

The Post reported on Sunday that the spyware, licensed from the Israeli firm NSO Group to governments for tracking terrorists and criminals, was used in attempts to hack into 37 phones belonging to journalists, human rights activists, business executives and two women who were close to murdered Saudi journalist Jamal Khashoggi. Some of the hacking attempts were successful.

The phones were included on a list of more than 50,000 numbers, many of which were based in countries that are known to surveille their citizens and are recognized clients of NSO Group, according to the investigation. It is not known how many of the phone numbers on the list were ultimately targeted or surveilled.

Amnesty International and Forbidden Stories, a Paris-based journalism nonprofit organization, both had access to the list and shared it with the news outlets, which conducted additional research and analysis as part of an investigation.

The investigation, dubbed the Pegasus Project, did, however, say that forensic analysis of the phones, conducted by Amnesty’s Security Lab, revealed that many of them have a “tight correlation between time stamps associated with a number on the list and the initiation of surveillance, in some cases as brief as a few seconds.”

The lab scrutinized 67 phones where attacks were thought to have occurred, according to the investigation, 23 of which were found to be successfully infected and 14 of which showed evidence of attempted infiltration.

The remaining 30 tests were inconclusive, in several instances because the phones were replaced.

While the numbers on the list were “unattributed,” the Post said reporters were able to track down and identify upward of 1,000 people throughout more than 50 countries through research and interviews on four continents.

The numbers identified were traced to several Arab royal family members, at least 65 business executives, 85 human rights activists, 189 journalists, and more than 600 politicians and government officials.

Heads of state and prime ministers were also reportedly on the list.

The journalists on the list included reporters working overseas for CNN, The Associated Press, Voice of America, The New York Times, The Wall Street Journal, Bloomberg News, Le Monde in France, the Financial Times in London and Al Jazeera in Qatar.

NSO Group rejected the findings of the investigation, calling them exaggerated and baseless, according to the Post. It also claimed that it does not operate the spyware that is used by clients and “has no insight” into their own intelligence efforts.

The company said its customers are 60 intelligence, military and law enforcement agencies across 40 countries, according to the Post. It would not, however, reveal specifics on any of them because of client confidentiality obligations.