radiofree.asia

Category: Surveilled

  • CPJ calls for transparent investigation into Ukraine surveillance of Bihus.Info journalists

    New York, February 9, 2024—The Committee to Protect Journalists expressed deep concern on Friday over the surveillance by Ukraine’s domestic security service (SBU) of journalists with the country’s investigative outlet Bihus.Info and called for a transparent investigation into SBU’s actions.

    On Monday, Bihus.Info published an investigation which said that 30 members of a branch of the SBU, the Department for the Protection of National Statehood, spied on its journalists and filmed them using illegal recreational drugs at a private party in a hotel on December 27. The outlet said that the cameras used to surveil its staff had been placed in the hotel before the party and that the hotel’s security cameras had shown several SBU agents entering the hotel ahead of the event. 

    “CPJ is deeply concerned that Bihus.Info journalists were spied on by the Ukrainian security service, which is responsible for combating national security threats. Investigative journalists are not a threat, but the foundation of a healthy democracy,” said Gulnoza Said, CPJ’s Europe and Central Asia program coordinator. “Ukrainian authorities must ensure their investigation into this illegal surveillance of the media is quick and transparent and hold those responsible to account.” 

    The story broke last month, when YouTube channel Narodna Pravda published a video showing Bihus.Info employees apparently using drugs and recordings of phone conversations about obtaining cannabis and MDMA (also known as Ecstasy) – both of which are illegal in Ukraine. The video, which Bihus.Info director Denys Bihus acknowledged as genuine, has since been taken offline.

    Anastasiya Borema, head of communications at Bihus.Info, told CPJ at the time that their analysis of the video showed that the journalists’ phones had been tapped for about a year.

    On January 22, Ukraine’s national police said they had registered four cases of privacy violation at the request of four Bihus.Info representatives.

    President Volodymyr Zelensky condemned the surveillance, said the matter was under investigation, and signed a decree on January 31 dismissing Roman Semenchenko, head of the Department for the Protection of National Statehood.

    SBU responded to Monday’s investigation by Bihus.Info with a statement on Tuesday that said it had launched a criminal investigation into illegal surveillance and that it had originally acted on information claiming that employees of Bihus.Info were clients of drug dealers.

    “We believe that independent media are an integral part of a modern democratic society and no actions of individuals can cast a shadow on any of the newsrooms and mass media in general, and all employees of the SBU must act exclusively to ensure the protection of the national interests of the state and society,” it said.

    Also on Tuesday, Ukraine’s parliament voted to summon the head of the SBU, Vasyl Malyuk, over the affair. On the same day, Malyuk posted a statement saying that the “actions of individual employees” of the Department for the Protection of National Statehood were “truly outrageous” and “unacceptable” and the Office of the Prosecutor General said in a statement that it had instructed the State Bureau of Investigation (DBR), which investigates crimes committed by public officials, to carry out a pre-trial investigation into criminal proceedings over illegal surveillance. “Violations of the rights of journalists are unacceptable and are subject to careful consideration and appropriate response,” Attorney General Anriy Kostin said in the statement.

    Bihus.Info’s Borema told CPJ that the criminal cases into the surveillance of their journalists had been transferred from the SBU and the police to the DBR.

    “We are waiting for the continuation of the story and punishment for its participants and organizers,” she said. “The head of the department was fired, while about 30 people were involved in the surveillance operation. These people could not have come up with this operation on their own, so it was approved by the top management,” adding: “The editorial staff of Bihus.Info believes that the order to surveil the journalists was given either by the SBU leadership or by other government bodies.”

    Several investigative Ukrainian journalists have faced threats, violence, and harassment over their work since Russia’s full-scale invasion of the country. Journalists seeking press accreditation previously told CPJ that they had been questioned by the SBU and pressured to take certain approaches in their reporting. 

    On February 3, the military relaxed the accreditation rules that were in place since March 2023 and that had been criticized for limiting the journalists’ access to the frontline.

    SBU’s spokesperson Artem Dekhtiarenko declined to respond to CPJ’s query as to whether the surveillance operation had been sanctioned by a prosecutor and referred CPJ to the agency’s previous statements.

    Editor’s note: The 12th paragraph in this report has been updated to clarify a quote attribution.  


    This content originally appeared on Committee to Protect Journalists and was authored by Arlene Getz/CPJ Editorial Director.

    This post was originally published on Radio Free.

  • CPJ calls for an investigation into the targeting of journalists with Pegasus spyware in Jordan

    Beirut, February 1, 2024 – The Committee to Protect Journalists is highly alarmed by the targeting of journalists with Pegasus spyware in Jordan and repeats its calls for an immediate moratorium on the sale, transfer, and use of such surveillance technologies, as well as a ban on spyware and its vendors that facilitate human rights abuses, and urges Jordanian authorities to investigate its use in the country. 

    Between 2020 and 2023, at least 16 journalists and media workers in Jordan were targeted by Pegasus spyware, along with 19 other individuals, including activists, lawyers, and civil society members, according to a new joint investigation published on Thursday by rights group Access Now, University of Toronto-based research group Citizen Lab, and other partners. Four of the journalists named in the report, Hosam Gharaibeh, Rana Sabbagh, Lara Dihmis, and Daoud Kuttab, told CPJ in interviews that they believe they were targeted due to their journalistic work. The report does not name the source of the attacks.

    Access Now’s report does not name the other 12 journalists and media workers, and CPJ was unable to immediately identify them. Previously, in 2022, CPJ called for an investigation into the use of Pegasus spyware on two Jordanian journalists, including Suhair Jaradat.

    “The new revelations that journalists and media workers in Jordan have been targeted with Pegasus spyware underscores the need for an immediate moratorium on the use and sale of this technology, and a ban on vendors facilitating abuses,” said Sherif Mansour, CPJ’s Middle East and North Africa program coordinator, in Washington, D.C. “Journalists are not legitimate surveillance targets, and those responsible for these attacks should be held accountable.”

    According to the report, phones belonging to Sabbagh and Dihmis, who cover the Middle East and North Africa as a senior editor and an investigative reporter, respectively, at the Organized Crime and Corruption Reporting Project (OCCRP), were targeted with Pegasus spyware.

    “What bothered me most was the impact of the surveillance on my sources, and friends, and relatives,” said Sabbagh, who is also the co-founder of Arab Reporters for Investigative Journalism. “Because of the nature of OCCRP’s work, it is a principal target for surveillance agencies. They wish to keep crime and criminality hidden. We work to expose it. And with this type of work comes a very high price.”

    Dihimis called the revelation “quite the violation,” adding that “as a journalist, it was a reminder of the importance of being cautious in terms of secure communication — to protect yourself but also your sources and colleagues. As a person, it spurred a lot of paranoia,” she added.

    Kuttab, a Palestinian-American journalist based in Jordan and a 1996 recipient of CPJ’s International Press Freedom Award, was targeted by Pegasus spyware multiple times, according to the report.

    On March 8, 2022, two weeks after the first incident, Kuttab was arrested when he arrived at Queen Alia International Airport outside of Jordan’s capital, Amman. He was detained under the Cybercrime Law for an article written in 2019 and was released a few hours later on bail, the report said.

    The report detailed seven other attempts to infect Kuttabʼs mobile device with Pegasus, including a 2023 attempt in which the attacker impersonated a journalist from media outlet The Cradle asking questions about Jordanʼs cybercrime law while sending malicious links.

    “I will not be intimidated, and I will not censor myself,” Kuttab told CPJ. “It is highly irritating to be spied on, but that also comes with the job nowadays. Whatever I know, I publish, but my only concern is my sources and their protection.”

    Gharaibeh, director of Jordan’s Radio Husna, and the host of its morning talking show, was targeted successfully multiple times and there were also several failed attempts to infiltrate his phone, the report said.

    When asked by CPJ about the apparent reason behind the recurrent attacks, Gharaibeh said that “it could be anything from monitoring the journalists and their sources to exploiting the journalists and silencing them.”

    According to Access Now, the victims in the report were targeted using Pegasus with both zero-click attacks, in which spyware takes over a phone without the user’s knowledge, and attacks in which a user has to click a link. 

    CPJ has documented the use of Pegasus to target journalists around the world in order to monitor their phones’ cameras, microphones, emails, texts, and calls. Journalists have been targeted with the software in Jordan, Morocco, the United Arab Emirates, and Saudi Arabia, among other countries.

    CPJ emailed NSO Group for comment, but received no response. NSO Group says it only licenses its Pegasus spyware to government agencies investigating crime and terrorism.

    CPJ offers guidance for journalists and newsrooms on spyware targeting and general digital safety.


    This content originally appeared on Committee to Protect Journalists and was authored by Committee to Protect Journalists.

    This post was originally published on Radio Free.

  • Israel to investigate alleged police use of Pegasus spyware against local journalists, others

    New York, February 7, 2022 – In response to news reports that Israel will investigate its police force’s alleged use of NSO Group’s Pegasus spyware to hack the phones of Israeli journalists, among others, the Committee to Protect Journalists issued the following statement calling on authorities to ensure the harmful technology is not used against journalists:

    “Israel’s government should fully and transparently investigate whether police used NSO Group’s Pegasus spyware against Israeli journalists, and should take concrete steps to curtail the technology’s use against members of the media in Israel and around the globe,” said Justin Shilad, CPJ’s senior Middle East and North Africa researcher. “By allowing Pegasus spyware to proliferate worldwide, the Israeli government has unleashed a monster that now appears to be going after Israeli journalists.”

    According to a report Monday in the Israeli daily newspaper The Calcalist, Israeli police used the spyware against Aviram Elad, former editor-in-chief of the online Israeli news outlet Walla, and other unnamed Walla journalists. The report said that police deployed spyware without warrants during their investigation in one of the alleged corruption cases into former Prime Minister Benjamin Netanyahu. The report also alleged the use of the spyware against Israeli chief executives, activists, political advisers, and Netanyahu’s son Avner Netanyahu.

    In an email to CPJ, an Israeli police spokesperson said that the Israeli police commissioner, Yaakov Shabtai, asked the minister of internal security to establish an “external and independent” review committee to look into the allegations, instate rules about technology, and “restore public trust” in the police.

    Reached by CPJ via messaging app, Elad said he couldn’t immediately comment as he was still looking into the allegations in the report.

    Last year, the Pegasus Project, an investigation conducted by an international journalist consortium, revealed at least 180 journalists were named as potential Pegasus targets. CPJ has documented the use of Pegasus spyware against journalists across the globe. NSO Group has repeatedly told CPJ in the past that it licenses the spyware to fight crime and terrorism.


    This content originally appeared on Committee to Protect Journalists and was authored by Committee to Protect Journalists.

    This post was originally published on Radio Free.

  • Opinion: The dilemma facing journalists covering the Beijing Olympics

    I don’t envy journalists from around the world who are entering China to cover the Beijing Olympics, held February 4 to 20. Perhaps never in history have the rules of the road for covering the games been so murky and the potential dangers so great for journalists who step over an as-yet-undefined red line that could provoke retaliation by the touchy, highly nationalistic, Chinese hosts.

    Will reporters follow well-honed instincts, report the news, and face possible punishment from Chinese officials, even expulsion from China? Or will they stick to feel-good coverage, curb their tongues, compromise professional integrity, and potentially lose credibility among viewers and readers?

    Traditionally, sports journalists are some of the best reporters and storytellers in the business. They delve into the personal stories behind the amazing performances of elite athletes. They make them into real people we can relate to — at a distance, of course. But those real people have feelings and views. Out of the nearly 3,000 athletes expected to compete in the games, it’s fanciful to imagine that all of them will stay silent about the human rights tragedy taking place all around China. Or that journalists will fail to report it. Or that journalists will all, unanimously, ignore the widely reported human rights abuses in China as an essential backdrop to the games. What if athletes complain about the venues, management of the games, or even the food or accommodations?

    The Beijing Organizing Committee cast a shadow over the games on January 18, when Yang Shu, deputy director general of international relations for the Committee, said in a news conference that “Any behavior or speech that is against the Olympic spirit, especially against the Chinese laws and regulations, are also subject to certain punishment.”

    The remark was aimed at the athletes, but it has implications for journalists too, who were previously warned by a foreign ministry spokesperson that they must comply with Chinese “laws and regulations,” which are vague and flexible, according to Reuters.

    In theory, total press freedom is guaranteed for the international press in the “bubble” of the Olympic village. According to the IOC contract with Beijing: “There shall be no restrictions or limitations on (a) the freedom of the media to provide independent news coverage of the Games and Paralympic Games as well as related events, and (b) the editorial independence of the material broadcasted or published by the media.” Yet, how difficult would it be for Chinese authorities to declare that a journalist’s report violated Chinese law? And what would the International Olympic Committee, not known for a strong backbone, do about it?

    China has not been shy, or especially secretive, about its treatment of critical journalists. CPJ counted at least 50 journalists in jail last year in its annual census of imprisoned journalists, making China the biggest jailer of journalists in the world for the third year running. It has forced the closure of independent news outlets in Hong Kong, in blatant violation of earlier commitments. It has continued to harass and restrict international journalists who are stationed in the country, arrested local staff or forced others to be fired, and chased many reporters out of the country. As the Foreign Correspondents Club of China put it in its annual report on working conditions, released on January 31: “The Chinese state continues to find new ways to intimidate foreign correspondents, their Chinese colleagues, and those whom the foreign press seeks to interview, via online trolling, physical assaults, cyber hacking, and visa denials.”

    In an earlier era, China might have been shy about beating up on athletes or the press—literally and figuratively—while under a global spotlight, such as the Olympics. But by some accounts, China is not aiming to show compliance with international standards of human rights and press freedom. Rather it wants to show the world who is in charge. And it has a host of measures it could take against journalists ranging from blocking access to competition venues or press conferences, to blocking communication, to expulsion from the country. Nothing could be easier, or less transparent, than conveniently finding that a troublesome journalist has tested positive in the required daily COVID test, or forcing quarantine for alleged exposure to the virus, as journalists stationed in China suspect is already happening, according to the FCCC report.  

    The Chinese Ministry of Foreign affairs did not immediately reply to a request for comment.

    With the country’s sweeping digital and human surveillance apparatus, authorities are positioned to monitor journalists. University of Toronto-based Citizen Lab rang alarm bells about the required app aimed at tracking COVID-19, MY2022, pointing out a “devastating flaw” in which voice audio and encrypted files shared via the app can be compromised; according to tech news site Protocol, the flaw has been fixed but Citizen Lab also lost access to its MY2022 account for further research.

    Yet China’s abysmal human rights record is part of the story, whether athletes talk about it or not. A recent feature in Bloomberg Businessweek, for example, found it noteworthy that Chinese-American superstar freestyle skier Eileen Gu, who grew up in the U.S. and is competing for China, has maintained studious silence about China’s human rights abuses, including its alleged genocide inflicted on millions of Uyghur Muslims.

    We can expect more such coverage, no matter what the athletes do. And the Chinese hosts of the games won’t like it. Who will first test the limits? How much risk is it worth taking to get the story? Personally I hope journalists won’t be intimidated and will fully report the story. But that’s a tough choice that they must make for themselves. And it’s a key part of the Olympics drama that will play out away from the ski slopes or skating rinks.


    This content originally appeared on Committee to Protect Journalists and was authored by Steven Butler/CPJ Asia Program Coordinator.

    This post was originally published on Radio Free.

  • ‘The infections were constant:’ Julia Gavarrete among dozens of Salvadoran journalists targeted with Pegasus spyware

    The day El Faro reporter Julia Gavarrete’s father passed away, her phone was infected with Pegasus spyware that could activate the microphone and camera, and read all her messages – one of multiple occasions her privacy was invaded with the tool over the course of several months. Gavarrete made this disturbing discovery while cooperating with a new investigation into the phone hacking of more than 30 journalists in El Salvador, she told CPJ. 

    CPJ joined civil society and media groups yesterday in a statement calling on Salvadoran authorities to respond to the findings by experts at Citizen Lab and Access Now, among others. It’s not clear who was operating the spyware, but Pegasus creator NSO Group, an Israeli company, has repeatedly said it sells Pegasus only to vetted government clients and investigates allegations of abuse. More than 180 journalists around the world were identified as possible Pegasus targets last July in investigative reports that the company said were false.

    The incidents in El Salvador were first publicized in November, when several journalists with iPhones reported Apple had notified them about possible spyware; Apple subsequently filed a lawsuit against NSO in a U.S. court for facilitating surveillance.

    Gavarrete covers politics, health, environment, and gender for El Faro and previously worked at Gato Encerrado. Investigators found that staff at both independent digital outlets faced repeated Pegasus attacks in 2020 and 2021, especially El Faro, which reported 22 phones owned by its journalists were infected 226 times in total. The incidents coincided with some of their most hard-hitting investigations, Gavarrete told CPJ. 

    President Nayib Bukele and other Salvadoran officials have also singled out the sites and other independent outlets, disparaging staff, barring entry to press conferences, and denying work permits since Bukele’s election in 2019. 

    CPJ emailed Bukele’s office for comment but did not receive a response.

    In a recent phone interview, Gavarrete told CPJ’s Dánae Vílchez about how knowledge of the spyware has affected her reporting. The interview has been edited for length and clarity.

    Let’s talk about context: What is happening in El Salvador right now regarding press freedom?

    In 2021 we saw setbacks – [fewer options] for citizens requesting information from institutions to understand what the government is doing with public funds, and the government also took a more concrete position against media it considered “inconvenient,” those that are doing watchdog work and monitoring finances. I don’t believe the situation will improve.

    Were you afraid you were being spied on?

    Several of us already suspected that [our communications] were being intercepted. Information that we shared was later made public on social media through trolls and Twitter accounts, [or] on pages that share fake news. But it was just a hunch.

    Last year I was working on an investigative project, and it seemed like someone had read my conversations with a source. People stopped us at the entrance to a building like they knew we were going to be there. That confirmed to me that we were being monitored, but I never knew where the intervention came from.

    I don’t know, for example, if the theft of my computer was state surveillance. [Editor’s note: In 2020, Gavarrete’s laptop was stolen from her home though other valuables were untouched; she was working for Gato Encerrado at the time.] I could never confirm it because the investigation never went anywhere.

    How did you find out what was really going on?

    I was able to confirm that I was being monitored with Pegasus working directly with organizations that were looking into this matter here in El Salvador.

    My first impression was shock; suspecting you’ve been targeted isn’t the same as knowing. It hit me not only on a professional level, but also emotionally. To think about the amount of information that passes through a device, and the personal information they can access and what they can do with [it]…Processing that took me a bit of time, but in the end you have to turn the page and try to continue. That was my way of coping.

    From what you know, can you tell us a little about what was found on the phones?

    We found continuous interventions in which [someone] had access to and extracted information from our phones. Analysis allowed us to identify specific dates when the infections occurred.

    Many of my initial thoughts were about work: What kind of information was reaching my phone [on] those days? What sources was I seeing?

    Then I thought about difficult moments in my life, [like] my father’s illness. Not only are these people interested in knowing who you are as a journalist, but they want to know what happens in your personal life. Imagine the type of unscrupulous people behind this.

    There were dates when a number of [us] were subject to heavy surveillance. Some journalists endured [it for] at least a year. Even for the researchers [performing the analysis], the obsessive use of Pegasus in El Salvador was very strange. It is not just that devices were being infected, but that the infections were constant.

    Why do you think the government would be interested in monitoring your work?

    Those who are behind these interventions are undoubtedly interested in knowing what is being produced in our newsroom. The government will always be interested in knowing what journalists who are investigating them are doing, although we do not have evidence of specific contracts.

    What has become very clear to us is that during the periods when we have been surveilled, El Faro was working on hard-hitting reports into corruption or irregular purchases. There isn’t a single day that the reports showed we had been infected that wasn’t related to something that El Faro published or an ongoing investigation.

    At a global level, state surveillance shows that governments are interested in controlling what is said about them, and not fighting organized crime.

    Has the government acknowledged what happened or taken any responsibility?

    The government distanced itself from the messages from Apple. Some officials said that what Apple was saying was not about El Salvador. It was just a matter of denying and trying to shift attention elsewhere.

    We hope the government can provide answers, clarify whether it is using this type of software, [and] investigate who is behind all this – and that the international community gets more involved in demanding that we get these answers. We are talking about an excessive amount of money that someone is spending on this.

    How has this situation affected your work as a journalist? How does it make you feel?

    It is a stressful burden. Now it’s confirmed, it is not only about protecting our integrity and that of our sources, but also our families, trying to explain what is going on and why they can’t communicate with us “normally.” [Our devices] may still be infected. Anything sensitive that they want to say to me, they can only say in person. This is one of the most significant pressures that I have had to deal with.

    I was cautious before, but [now] I am even more extreme to avoid putting sources in danger. But it wears you out day-to-day, and you have to make an even greater effort to be able to produce journalism.

    See CPJ’s safety advisory, “Journalist targets of Pegasus spyware”


    This content originally appeared on Committee to Protect Journalists and was authored by Dánae Vílchez/CPJ Central America Correspondent.

    This post was originally published on Radio Free.

  • CPJ joins statement condemning use of Pegasus spyware to target journalists in El Salvador

    The Committee to Protect Journalists today called on Salvadoran authorities to respond to the discovery of Pegasus spyware on cellphones belonging to at least 30 journalists in El Salvador, joining 14 organizations, media outlets, and individuals in a public statement available in English and Spanish.

    The statement identified “one of the most persistent and intensive known uses of Pegasus to surveil journalists in the world” based on forensic analysis of dozens of phones by rights and research groupsAccess Now, Front Line Defenders, The Citizen Lab, Amnesty International, Fundación Acceso, and SocialTIC.

    Devices belonging to 35 people, mostly journalists along with a few members of civil society, were infected with Pegasus between July 2020 and November 2021, according to the findings; more than half worked for independent digital media outlet El Faro. Pegasus can control phones and extract content without the owners’ knowledge, and some of the devices were infiltrated more than 40 times, the statement said.  

    Since his election in 2019, Salvadoran President Nayib Bukele and other government officials have consistently used anti-press rhetoric and harassed independent media outlets, individual journalists, and others critical of his administration.

    According to the statement, it is not clear who was responsible for the surveillance, but the Israel-based NSO Group says it only licenses its Pegasus spyware to government agencies investigating crime and terrorism. CPJ emailed the company to ask about clients in El Salvador but did not receive a response before publication.

    CPJ has documented how spyware is used to target journalists and those close to them around the world and called for a moratorium on its trade pending better safeguards.


    This content originally appeared on Committee to Protect Journalists and was authored by Committee to Protect Journalists.

    This post was originally published on Radio Free.

  • Marcela Turati on the chilling implications of Mexico’s probe into her reporting

    For more than a decade, Marcela Turati has painstakingly documented disappearances and mass graves in Mexico, cementing her reputation as one of the country’s foremost investigative reporters. But even with her knowledge of human rights abuses and corruption, she was shocked to learn that she has been under investigation by Mexican federal authorities for years.

    On November 23, the Fundación para la Justicia y el Estado Democrático de Derecho, a Mexico City-based legal nonprofit, revealed in the Washington Post that the Mexican federal attorney general’s office (FGR) had in 2016 opened an “organized crime” and “kidnapping” investigation into Turati, the nonprofit’s director Ana Lorena Delgadillo, and Argentine forensic anthropologist Mercedes Doretti.

    The investigation into the three women was part of a broader probe into the 2011 mass disappearance of almost 200 people in San Fernando, in the northern Mexican state of Tamaulipas, which Turati reported on for Mexico City weekly Proceso. Mexican federal authorities alleged that Los Zetas, one of the country’s most notorious and violent criminal gangs, was behind the disappearances.

    If being investigated wasn’t shocking enough, Turati also learned that authorities had surveilled her as part of the probe. According to the foundation, the federal attorney general’s office obtained phone and geolocation data on the women without a court order. It was able to do that because Mexican law compels mobile phone operators – in Turati’s case, Movistar – to cooperate with federal authorities in organized crime probes.

    The revelation came shortly after Turati learned that she was one of at least 25 journalists in Mexico who had been selected for potential surveillance with Pegasus phone hacking technology, according to a report by investigative journalism nonprofit Forbidden Stories. NSO Group, the Israeli company that makes Pegasus and sells it to government clients, disputes the report.

    FGR has not commented publicly on the case. CPJ sent a request for comment to the assistant of Raúl Tovar, the chief spokesperson for the FGR and attorney general Alejandro Gertz Manero via messaging app, but did not receive a reply.

    CPJ spoke with Turati about how the discovery of the investigation has impacted her and what it means for investigative reporting in Mexico, which is, according to CPJ research, the deadliest country for journalists in the Western Hemisphere. The interview has been edited for length and clarity.

    What was your initial response to learning you were investigated by federal authorities?

    It came as a huge shock to me, because I saw my photo, my digital fingerprint, contact I had with my family, my address, everything. First I felt very angry, then I felt scared and, exposed, especially after I was told earlier this year that I was also targeted with the Pegasus spyware. If that was successful, then they have also had access to my messages, email, and photos.

    I’m also angry for what this means for investigative journalism in Mexico. It’s as if they have exposed my professional secrets as a journalist. Ultimately what they did was send an analysis to the Federal Police to see how many times I met my sources. They also looked into calls I made to the lawyer of the families, that I had covered Ayotzinapa [the abduction of 43 students of a rural teachers’ college in the southern Mexican state of Guerrero in 2014, which authorities said was possibly a mass murder]. We haven’t seen a lot of the documents yet, but we’re talking about some 500 pages about my life. I’m really worried about what else may turn up.

    FGR specifically labeled the investigation as one into “organized crime” and “kidnapping” in the case file —how does this ease its ability to surveil you?  

    They did it to trick the system. When a person disappears in Mexico and they urgently request mobile phone data to track calls, it can take months to obtain the information. In our case they got the data in just 24 hours. They can skip the judge [by tagging an investigation as “organized crime”]. They didn’t create a separate case file about us, but they included us in a case as if we were suspects.

    What does the inclusion of your name in this federal organized crime probe mean for Mexican journalists who cover human rights abuses?

    This happened in 2015 and 2016, under a different government than that of President Andrés Manuel López Obrador, but the investigator who requested the data is the same who handed the case file to the foundation in May [in compliance with a Mexican Supreme Court ruling, according to the Washington Post]. He still works at the attorney general’s office, and there are the others who have a copy, who signed off. They’re all still there.

    There are a lot of things that go through my mind. As happened with the Pegasus spyware case, the people who did this are still working there. We haven’t been shown that the FGR has been purged. This is very serious. It can still happen; we really only found out about this case by accident. How many others are there?

    Another thing is that, if a journalist can’t keep her sources secret, it’s like taking us out of the water we swim in. You take away the right of people to report abuses. I felt that this is not just something they did to me. They abuse the state apparatus; the FGR was involved, federal police, forensic investigators, and the highest officials were informed, because they received copies of the case file.

    Do you have any faith that the López Obrador administration will take steps to prevent this from happening again?

    I’m not sure. Alejandro Encinas, the undersecretary for Human Rights, condemned it and promised that it would be investigated, but he’s not the one with the authority to do something about this. The FGR hasn’t said anything. They can change the story. They can end impunity in this case by sanctioning the officials who were responsible if they want to. But we don’t know what’s going on.

    Will this change the way you work as a reporter?

    I do everything by myself, but since Pegasus I ask myself how it’s possible to defend yourself against this. Would I have to stop using smartphones and do things like they did with Watergate, leaving a ribbon on my balcony so sources know that I want to talk with them? Even if you use different phones and take courses in cybersecurity, how much can one really do? How can you do journalism without speaking with a source of the telephone, if you can’t be sure that they’re not spying on you?


    This content originally appeared on Committee to Protect Journalists and was authored by Jan-Albert Hootsen/CPJ Mexico Representative.

    This post was originally published on Radio Free.

  • Hungary’s Szabolcs Panyi on how Pegasus surveillance has hindered his reporting

    It took five months for Hungary to acknowledge publicly that it had bought the Pegasus spyware allegedly used to hack the phones of hundreds around the world. In November, Lajos Kósa, a top official from Hungary’s ruling Fidesz party, acknowledged the purchase in a media interview after a parliamentary meeting; Minister of the Interior Sándor Pintér confirmed it in front of a visiting delegation from the European Parliament it later in the month.

    The confirmation was the government’s first real engagement with allegations involving global surveillance of journalists and activists, including many Hungarians, described by an international consortium of journalists for the Pegasus Project in July, according to Szabolcs Panyi, the investigative reporter who broke the story for Hungarian news outlet Direkt 36.  

    Kósa’s statement came the day after the United States Department of Commerce imposed trade limits on Israel’s NSO Group for supplying foreign governments that used Pegasus to target journalists and others. The powerful spyware can secretly manipulate a target’s phone to extract information or activate the camera or microphone, and CPJ is among many calling for a moratorium on the use of such technology pending stronger regulation. NSO told CPJ it was dismayed by the U.S. restriction, and says it investigates allegations of abuse by its vetted government and law enforcement clients. The company has said the allegations in the Pegasus Project are false. CPJ sent questions to NSO’s press email in December but received no response.

    Panyi, who covers national security, high-level diplomacy, and corruption, was himself on the consortium’s list of Hungarian targets along with colleague András Szabó, and Amnesty International reported forensic traces linked to Pegasus on Panyi’s phone.

    It’s not clear whether anyone will be held to account for the intrusion. The parliamentary committee deliberates behind closed doors, and while the Prosecutor’s Office started a preliminary investigation to find out whether a crime has been committed in relation to Pegasus, no results had been announced by mid-December.

    CPJ emailed questions to the Hungarian government’s international spokesperson, Zoltán Kovács, but received no response.

    CPJ’s Attila Mong spoke with Panyi by phone this month about the latest developments. The interview has been edited for length and clarity.

    How did you feel when your first learned about your own surveillance?

    I had very mixed feelings. Partly, of course, I felt indignation and humiliation to see myself and other prominent journalists on a list of targets together with convicted criminals and known mob figures. I also felt pride that [the government thought it was worth spending thousands of dollars] on my surveillance – more than my yearly income! Finally, it sounds paradoxical, but it was a relief to learn that when I had felt a bit paranoid – when I had thought [I saw] signs [of possible surveillance] from time to time – it was for a reason, and not because I was actually going crazy.

    In a way, this is the best answer to all the smears [on my character] from pro-government media, which regularly accuse me of being a CIA agent. If I had done anything legally or ethically questionable as a journalist, it would be already in the public domain. I passed through the purgatory [of surveillance by someone linked to the government], [but] they couldn’t find anything wrong.

    To what extent has the Hungarian government acknowledged what happened and taken responsibility? 

    The government [has] finally acknowledged that they had acquired the spyware and used it to surveil Hungarian [phone numbers] – but they maintain that its use was legal.

    Is this true? Can it be legal to wiretap journalists in an EU member state?

    Since 2010, the government has had a two-thirds supermajority in parliament and used its powers to introduce sweeping [constitutional] changes. The laws regulating national security including surveillance are so broadly formulated that it is legal to wiretap and surveil anyone. So “legal” in this case means that these very broad rules have been formally respected, everything has been properly documented, and the necessary stamps are where they should be.

    Were there legitimate national security threats to justify surveillance?

    Since all the documents are classified, we cannot properly judge whether there were real reasons behind the requests to wiretap journalists, which were then approved by the justice minister in most cases. [Editor’s note: In a July media interview, Justice Minister Judit Varga said that her ministry is responsible for signing off these requests but refused to comment on specific cases.]

    The government says that journalists might have been wiretapped not because they were direct targets of the investigations, but because some of their sources – criminals, people with terrorist links or links to foreign intelligence – were under surveillance. However, we cannot [confirm] the legitimacy of these requests, as there is no independent oversight.

    Are there cases where journalists were involved that do not seem to involve national security?

    Here are a couple of examples. [We reported that] a former journalist turned professional pilot was [on the target list] because – using publicly available data – he gave journalists tips [about] Prime Minister Viktor Orbán’s use of private jets. Similarly, a photojournalist who documented the lavish lifestyle and use of private yachts in Orbán circles was also targeted. These examples demonstrate how broadly the government defined “national security threat.”

    What about accountability? Has the government acknowledged political responsibility in any way?

    Political accountability is tricky, since several ministers were involved in the decision-making process around Pegasus, most prominently Orbán himself, whose 2017 meeting with then-Israeli Prime Minister Benjamin Netanyahu opened the way for the acquisition of the spyware and [its] later use on Hungarian targets. If any element of the use of Pegasus is illegitimate, it [will be] very difficult to control the damage and save Orbán from political responsibility. Moreover, several members of the government, including a top counter-terrorism official, were also targeted – evidently to check their loyalty to the government.

    In what way do you work differently now as a journalist?

    The way I communicate has become much slower and more complicated. I use various secure tools [and] applications; I have to be very mindful [as] to what Wi-Fi or other networks I connect [to on] my computer or mobile phone; I regularly go to meetings now without my phone. I continue to take physical notes.

    Of course, I have much more difficulty meeting and communicating with sources, who are increasingly afraid of the trouble I might bring into their life. Among Hungarian journalists, the biggest fear now is that this affair will have a chilling effect on sources, and paradoxically this enormous scoop will hinder our work in the long run.


    This content originally appeared on Committee to Protect Journalists and was authored by Attila Mong/CPJ Europe Correspondent.

    This post was originally published on Radio Free.

  • ‘A high-profile action’: Lawyer Douglas Jacobson on what U.S. export restrictions could mean for Israel’s NSO Group

    On November 3, the U.S. Department of Commerce announced it had imposed export controls on the Israeli NSO Group, saying the company “developed and supplied spyware to foreign governments that used these tools to maliciously target” journalists and others.

    The move represented a relatively new use for the Entity List for Malicious Cyber Activities, a tool used by the department’s Bureau of Industry and Security to limit a designee’s access to U.S. exports,lawyer Douglas Jacobson, who specializes in export control and sanctions, told CPJ in a recent phone call. Economic sanctions, a stricter control, are more common in response to human rights concerns, but export restrictions could have limited impact on the company, he said.

    Commerce listed three other companies in its November 3 press release. NSO, however, is the best known of the group for its development of advanced Pegasus spyware which can infiltrate individual cellphones for surveillance purposes. The company says it sells to vetted government clients for law enforcement purposes and investigates reports of abuse – but forensic experts say dozens of journalists are among the targets. In July, reporting by 17 global media outlets found that at least 180 journalists were possible targets of surveillance by government clients of NSO. CPJ has found that some of those, such as the jailed Moroccan journalist Omar Radi, face severe reprisals for their work.

    NSO told CPJ it was dismayed by the U.S. listing, and that its “rigorous compliance and human rights programs” have led to “multiple terminations of contacts with government agencies that misused our products.” The company has previously told CPJ that it investigated allegations that Pegasus was used to surveil Omar Radi, without elaborating on its findings.  

    The Commerce Department linked one of the other three newly-listed companies, Israel-based Candiru, to spyware used to target journalists. The University of Toronto-based Citizen Lab reported in July that Candiru appeared to be responsible for malware attacks Microsoft described as targeting “more than 100 victims around the world,” including unnamed journalists and human rights activists. CPJ attempted to reach Candiru for comment, but the company does not have a website and Eitan Achlow, who was identified as the CEO in news reports, does not allow messaging on his LinkedIn profile. 

    CPJ spoke to Jacobson about what the export restriction could mean for NSO Group. The interview has been edited for length and clarity.

    What are the practical implications of being on the entity list?

    [It] imposes a license requirement, but the U.S. is not penalizing NSO or Candiru or any of these other companies. They are just restricting their access to certain goods that are known to be subject to the Export Administration Regulations [everything that’s in the US or manufactured in the US, including software]. U.S. companies can [still] import goods from these companies if they want to.

    The license requirement [could apply] to something as mundane as [the] desk chair you’re sitting on. A furniture company would need a license to export office furniture to the NSO Group. The license review policy is one of presumption of denial – if I wanted to submit a license on behalf of the client to NSO Group for office furniture, then I would have to convince the [Bureau of Industry and Security] to overcome this presumption of denial. It is intended to prevent them from getting certain technologies.  

    I would imagine this would have a negative impact on NSO, because this will limit their ability to acquire even a new Windows laptop computer, for example.

    Will it be crippling? Doubtful. There are certainly many workarounds that companies could use in order to acquire what they need. The U.S. is no longer the only producer of high-tech knowledge, and many U.S. [goods] may not even be subject to [these export regulations] because they’re manufactured [abroad]. But I think that this is a high-profile action.

    Somebody asked me yesterday, is this really something that would make a [supplier] think twice? If I was advising a German company [on whether to] sell to NSO, I [would] say that’s a business decision. Your goods are not subject to [U.S. export regulation], so you wouldn’t be violating US law by doing that.

    But for certain suppliers, it’s a PR risk?

    Correct. [In case] the Wall Street Journal or whomever did an exposé and said, “This company in Germany or this company in Japan continues to sell to NSO.”

    Is there a penalty from Commerce if they catch a U.S. company supplying someone on the entity list without a license?

    Absolutely. The maximum civil penalty for violations of the [export regulations] is the greater of $308,901 per violation or twice the value of the transaction that is the basis of the violation.

    Does this export restriction include services such as web hosting, training, service maintenance?

    This does not apply to services at all. [The export regulations] only govern the export of tangible goods, software, or technology information. If you’re just going to repair something that is broken, for example, and a repairman goes to Israel [to repair] a server and they’re not having to provide the company with any information or replacement parts, then that would not be prohibited. And “technology” is broad – there’s a definition of technology in the Export Administration Regulations, but it doesn’t cover everything.

    Senator Ron Wyden told The New York Times that sanctions should be applied to NSO Group under the Global Magnitsky Act. Is that possible?

    The Global Magnitsky sanctionsare administered by the U.S. Department of Treasury’s Office of Foreign Assets Control, or OFAC, and can be applied to companies. That’s human rights related, and that would have a much bigger impact on NSO.

    [Economic sanctions like these] prohibit financial transactions by U.S. persons, company, or citizen. They are broad; they prohibit the export of U.S. goods, they prohibit payments to those individuals, and they also prohibit services [provided to them].

    The Commerce Department announcement lists a number of subsidiaries for Candiru, but none of the known subsidiaries for NSO Group are listed. Does that mean those subsidiary companies would not be considered during implementation?

    [It] doesn’t apply to any of their affiliates unless they are named. However, a company [supplying exported goods] has to be very careful because that affiliate may be a conduit by which the main prohibited company is acquiring goods that they shouldn’t be acquiring.

    Something else that struck me about this listing was the reasoning that it was a consequence for human rights violations, particularly about journalists being maliciously targeted. Is that a normal reasoning to get a company on this list?

    The criteria [include] reasonable cause to believe that the entity has been involved in activities that are contrary to the national security or foreign policy interest of the U.S.

    Foreign policy is a broader, more amorphous term, of course. That is what is being used as the basis for these human rights designations, which is, relatively, a broader interpretation of foreign policy [in the context of the entity list].  

    How often is this list reviewed? What is the process?

    The process is not an easy one, particularly when it comes to human rights issues. [China’s] Huawei has been on it for [almost] three years. There doesn’t appear to be much of an off-ramp for Huawei because of the national security issues – but there is an off-ramp. It does take time, [but] parties are removed from the entity list periodically. A company does have a chance to appeal their listing.

    The problem is, [the group that would remove them is] the same group that added them. This is called the End-User Review Committee, which is an interagency group chaired by the Department of Commerce. There has to be some change in behavior or [proof] that they didn’t do what they were alleged to have done.


    This content originally appeared on Committee to Protect Journalists and was authored by Alicia Ceccanese.

    This post was originally published on Radio Free.

  • ‘A high-profile action’: Lawyer Douglas Jacobson on what U.S. export restrictions could mean for Israel’s NSO Group

    On November 3, the U.S. Department of Commerce announced it had imposed export controls on the Israeli NSO Group, saying the company “developed and supplied spyware to foreign governments that used these tools to maliciously target” journalists and others.

    The move represented a relatively new use for the Entity List for Malicious Cyber Activities, a tool used by the department’s Bureau of Industry and Security to limit a designee’s access to U.S. exports,lawyer Douglas Jacobson, who specializes in export control and sanctions, told CPJ in a recent phone call. Economic sanctions, a stricter control, are more common in response to human rights concerns, but export restrictions could have limited impact on the company, he said.

    Commerce listed three other companies in its November 3 press release. NSO, however, is the best known of the group for its development of advanced Pegasus spyware which can infiltrate individual cellphones for surveillance purposes. The company says it sells to vetted government clients for law enforcement purposes and investigates reports of abuse – but forensic experts say dozens of journalists are among the targets. In July, reporting by 17 global media outlets found that at least 180 journalists were possible targets of surveillance by government clients of NSO. CPJ has found that some of those, such as the jailed Moroccan journalist Omar Radi, face severe reprisals for their work.

    NSO told CPJ it was dismayed by the U.S. listing, and that its “rigorous compliance and human rights programs” have led to “multiple terminations of contacts with government agencies that misused our products.” The company has previously told CPJ that it investigated allegations that Pegasus was used to surveil Omar Radi, without elaborating on its findings.  

    The Commerce Department linked one of the other three newly-listed companies, Israel-based Candiru, to spyware used to target journalists. The University of Toronto-based Citizen Lab reported in July that Candiru appeared to be responsible for malware attacks Microsoft described as targeting “more than 100 victims around the world,” including unnamed journalists and human rights activists. CPJ attempted to reach Candiru for comment, but the company does not have a website and Eitan Achlow, who was identified as the CEO in news reports, does not allow messaging on his LinkedIn profile. 

    CPJ spoke to Jacobson about what the export restriction could mean for NSO Group. The interview has been edited for length and clarity.

    What are the practical implications of being on the entity list?

    [It] imposes a license requirement, but the U.S. is not penalizing NSO or Candiru or any of these other companies. They are just restricting their access to certain goods that are known to be subject to the Export Administration Regulations [everything that’s in the US or manufactured in the US, including software]. U.S. companies can [still] import goods from these companies if they want to.

    The license requirement [could apply] to something as mundane as [the] desk chair you’re sitting on. A furniture company would need a license to export office furniture to the NSO Group. The license review policy is one of presumption of denial – if I wanted to submit a license on behalf of the client to NSO Group for office furniture, then I would have to convince the [Bureau of Industry and Security] to overcome this presumption of denial. It is intended to prevent them from getting certain technologies.  

    I would imagine this would have a negative impact on NSO, because this will limit their ability to acquire even a new Windows laptop computer, for example.

    Will it be crippling? Doubtful. There are certainly many workarounds that companies could use in order to acquire what they need. The U.S. is no longer the only producer of high-tech knowledge, and many U.S. [goods] may not even be subject to [these export regulations] because they’re manufactured [abroad]. But I think that this is a high-profile action.

    Somebody asked me yesterday, is this really something that would make a [supplier] think twice? If I was advising a German company [on whether to] sell to NSO, I [would] say that’s a business decision. Your goods are not subject to [U.S. export regulation], so you wouldn’t be violating US law by doing that.

    But for certain suppliers, it’s a PR risk?

    Correct. [In case] the Wall Street Journal or whomever did an exposé and said, “This company in Germany or this company in Japan continues to sell to NSO.”

    Is there a penalty from Commerce if they catch a U.S. company supplying someone on the entity list without a license?

    Absolutely. The maximum civil penalty for violations of the [export regulations] is the greater of $308,901 per violation or twice the value of the transaction that is the basis of the violation.

    Does this export restriction include services such as web hosting, training, service maintenance?

    This does not apply to services at all. [The export regulations] only govern the export of tangible goods, software, or technology information. If you’re just going to repair something that is broken, for example, and a repairman goes to Israel [to repair] a server and they’re not having to provide the company with any information or replacement parts, then that would not be prohibited. And “technology” is broad – there’s a definition of technology in the Export Administration Regulations, but it doesn’t cover everything.

    Senator Ron Wyden told The New York Times that sanctions should be applied to NSO Group under the Global Magnitsky Act. Is that possible?

    The Global Magnitsky sanctionsare administered by the U.S. Department of Treasury’s Office of Foreign Assets Control, or OFAC, and can be applied to companies. That’s human rights related, and that would have a much bigger impact on NSO.

    [Economic sanctions like these] prohibit financial transactions by U.S. persons, company, or citizen. They are broad; they prohibit the export of U.S. goods, they prohibit payments to those individuals, and they also prohibit services [provided to them].

    The Commerce Department announcement lists a number of subsidiaries for Candiru, but none of the known subsidiaries for NSO Group are listed. Does that mean those subsidiary companies would not be considered during implementation?

    [It] doesn’t apply to any of their affiliates unless they are named. However, a company [supplying exported goods] has to be very careful because that affiliate may be a conduit by which the main prohibited company is acquiring goods that they shouldn’t be acquiring.

    Something else that struck me about this listing was the reasoning that it was a consequence for human rights violations, particularly about journalists being maliciously targeted. Is that a normal reasoning to get a company on this list?

    The criteria [include] reasonable cause to believe that the entity has been involved in activities that are contrary to the national security or foreign policy interest of the U.S.

    Foreign policy is a broader, more amorphous term, of course. That is what is being used as the basis for these human rights designations, which is, relatively, a broader interpretation of foreign policy [in the context of the entity list].  

    How often is this list reviewed? What is the process?

    The process is not an easy one, particularly when it comes to human rights issues. [China’s] Huawei has been on it for [almost] three years. There doesn’t appear to be much of an off-ramp for Huawei because of the national security issues – but there is an off-ramp. It does take time, [but] parties are removed from the entity list periodically. A company does have a chance to appeal their listing.

    The problem is, [the group that would remove them is] the same group that added them. This is called the End-User Review Committee, which is an interagency group chaired by the Department of Commerce. There has to be some change in behavior or [proof] that they didn’t do what they were alleged to have done.


    This content originally appeared on Committee to Protect Journalists and was authored by Alicia Ceccanese.

    This post was originally published on Radio Free.

  • US blacklisting of NSO Group a welcome first step to curb spyware abuse

    Washington, D.C., November 3, 2021 ­­— The Committee to Protect Journalists welcomes the U.S. Department of Commerce’s addition of the Israel-based technology company NSO Group to the Entity List for Malicious Cyber Activities today.

    “CPJ welcomes the Department of Commerce’s decision to impose export controls on NSO Group for developing and supplying Pegasus spyware to foreign governments that maliciously used the technology to target journalists,” said CPJ Program Director Carlos Martinez de la Serna. “We hope this first step in export control is a move toward greater global oversight and transparency around the export and use of spyware by governments.”

    CPJ has reported extensively on the use of spyware to target journalists.

    Inclusion on the list limits U.S. entities from supplying the company, which makes it harder for U.S. researchers to deliver security vulnerabilities like those allegedly used to install Pegasus in the past, according to Reuters. NSO has said it sells only to vetted government and law enforcement agencies. In an email to CPJ received after publication and attributed to an NSO spokesperson, the company said: “NSO Group is dismayed by the decision given that our technologies support US national security interests and policies by preventing terrorism and crime, and thus we will advocate for this decision to be reversed. We look forward to presenting the full information regarding how we have the world’s most rigorous compliance and human rights programs that are based the American values we deeply share, which already resulted in multiple terminations of contacts with government agencies that misused our products.” 

    Editor’s note: The final paragraph has been updated with a comment from the NSO Group.


    This content originally appeared on Committee to Protect Journalists and was authored by Committee to Protect Journalists.

    This post was originally published on Radio Free.

  • Pegasus Project revelations show added layer of risk for corruption reporters

    Exposing those who abuse power for personal gain is a dangerous activity. Nearly 300 journalists killed for their work since CPJ started keeping records in 1992 covered corruption, either as their primary beat, or one of several.

    The risk was reaffirmed this month with the release of the Pegasus Project, collaborative reporting by 17 global media outlets on a list of thousands of leaked phone numbers allegedly selected for possible surveillance by government clients of Israeli firm NSO Group. According to the groups involved in the project, at least 180 journalists are implicated as targets.   

    NSO Group denied any connection with the list in a statement to CPJ; it says that only vetted government clients can purchase its Pegasus spyware to fight crime and terrorism.

    Among the outlets analyzing the data is the global journalism network Organized Crime and Corruption Reporting Project, which, as of July 29, had listed 122 of those journalists on its website.

    Not all of those focus on corruption, Drew Sullivan, OCCRP co-founder and publisher, told CPJ in a recent video call. But several of OCCRP’s own partners in corruption reporting featured, he said, listing people who have worked for Azerbaijan’s independent outlet Meydan TV and Hungary’s investigative outlet Direkt 36 as examples.

    “People who are looking at problems with these administrations — which tend to be somewhat autocratic — in a lot of countries they were perceived as enemies of the state because they were holding governments accountable,” he said.   

    At least four corruption reporters whose cases CPJ has been tracking for years — in Mexico, Morocco, Azerbaijan, and India — appeared in the Pegasus Project reporting as possible spyware victims. Their inclusion in the project adds a new dimension to their stories of persecution, suggesting governments are increasingly willing to explore controversial technology as yet another tool to silence corruption journalism.

    Here’s how the Pegasus Project revelations have shed new light on these four cases: 

    Freelance journalist Cecilio Pineda Birto, killed in Mexico

    (Forbidden Stories/Youtube)

    What we knew: Pineda endured death threats and a shooting attempt to continue posting on crime and corruption to a news-focused Facebook page he ran, but was gunned down at his local car wash in 2017. He was one of six journalists killed in retaliation for their reporting in Mexico that year.    

    New information: Pineda’s phone number was selected for possible surveillance a month before his death; he had recently told a federal protection mechanism for journalists that he believed he could evade threats because potential assailants would not know his location, according to The Guardian.  

    The government’s response: Mexican officials said this month that the two previous administrations had spent $300 million in government money on surveillance technology between 2006 and 2018, including contracts with NSO Group, according to The Associated Press. CPJ emailed Raúl Tovar, director of social communication at the office of Mexico’s federal prosecutor, and Jesús Ramírez Cuevas, spokesperson for President Andrés Manuel López Obrador, for comment on the use of spyware against journalists, but received no response.

    Le Desk reporter Omar Radi, imprisoned in Morocco

    (Reuters/Youssef Boudlal)

    What we knew: On July 19, 2021 – as many of the Pegasus Project stories were still breaking – a court sentenced Radi to six years in prison on charges widely considered to be retaliatory; he was jailed one year earlier, possibly to prevent completion of his investigation into abusive land seizures. Like fellow Moroccan journalists Taoufik Bouachrine and Soulaiman Raissouni, who are serving sentences of 15 years and 5 years, respectively, Radi was convicted of a sex crime, which journalists told CPJ was a tactic to dampen public support for the accused.  

    New information: Amnesty International had already performed forensic analysis of Radi’s phone in 2019 and 2020 and connected it to Pegasus spyware, as outlined in the Pegasus Project reporting. Now we know that Bouachrine and Raissouni were also selected as potential targets, according to Forbidden Stories.

    The government’s response: The Moroccan state has instructed a lawyer to file a defamation suit against groups involved in the Pegasus Project in a French court, according to Reuters.  CPJ requested comment from a Moroccan justice ministry email address in July but received no response; CPJ’s past attempts to reach someone to respond to questions about spyware at the ministries of communications and the interior were also unsuccessful.

    Investigative reporter Khadija Ismayilova, formerly imprisoned in Azerbaijan

    (AP Photo/Aziz Karimov)

    What we knew: Ismayilova, a prominent investigative journalist, is known for her exposés of high-level government corruption and alleged ties between President Ilham Aliyev’s family and businesses. She was sentenced to seven and a half years in prison on a raft of trumped up charges in December 2014 and served 538 days before her release.  

    New information: Amnesty International detected multiple traces of activity that it linked to Pegasus spyware, dating from 2019 to 2021, in a forensic analysis of Ismayilova’s phone after her number was identified on the list. Ismayilova subsequently reviewed other Azerbaijani phone numbers identified by the Pegasus Project and recognized some belonging to her niece, a friend, and her taxi driver, OCCRP reported.   

    The government’s response: CPJ requested comment from Azerbaijan state security services via a portal on its website on July 28 but received no response; CPJ’s request regarding the alleged surveillance of Meydan TV journalist Sevinj Vagifgizi last week was also unacknowledged.

    Paranjoy Guha Thakurta says SLAPPs are used to harass journalists. (Thakurta)

    Economic and Political Weekly journalist Paranjoy Guha Thakurta, subject to legal harassment in India

    (Photo: Paranjoy Guha Thakurta)

    What we knew: Guha Thakurta, a journalist and author, has faced a protracted criminal and civil defamation suit dating from 2017, along with three colleagues at the academic journal Economic and Political Weekly – and was recently threatened with arrest when he refused to attend a hearing across the country during the pandemic. That suit — brought by the Adani Group conglomerate following an article that described how the company had influenced government policies — was one of several legal actions he has faced, actions he characterized to CPJ as an intimidation tactic and way to harass reporters.

    New information: Amnesty International detected forensic indications connected to Pegasus spyware in an analysis of Guha Thakurta’s phone, dating from early 2018. In a personal account published by Mumbai daily The Free Press Journal, Guha Thakurta noted he had been writing about Prime Minister Narendra Modi and the governing Bharatiya Janata Party’s use of social media for political campaigning at the time, as well as investigating a wealthy Indian business family’s foreign assets – but he still didn’t know why his phone was apparently tapped.

    The government’s response: Ashwini Vaishnaw, the minister for information technology, has called the latest revelations about Pegasus “an attempt to malign Indian democracy,” and said illegal surveillance was not possible in India, according to The Hindu national daily. CPJ emailed Vaishnaw’s office for comment, but received no response. A former Indian government official has told CPJ that Pegasus is “available and used” in India and a committee was formed to investigate alleged Indian spyware targets in 2020, but CPJ was unable to reach someone to confirm the status of that committee in January this year.


    This content originally appeared on Committee to Protect Journalists and was authored by Madeline Earp/CPJ Consultant Technology Editor.

    This post was originally published on Radio Free.

  • CPJ joins call for moratorium on surveillance technology targeting journalists

    The Committee to Protect Journalists this week joined more than 150 human rights groups and independent experts in calling on states to implement an immediate moratorium on the sale, transfer, and use of surveillance technology following revelations that NSO Group’s Pegasus spyware has been used to spy on journalists around the world.

    The Pegasus Project, an investigation released July 18 by Forbidden Stories with the support of Amnesty International in collaboration with 16 media organizations around the world, identified at least 180 journalists in 20 countries as potential surveillance targets by clients of NSO Group. According to the letter, NSO says it sells only to government clients. NSO has repeatedly told CPJ in the past that it licenses Pegasus to fight crime and terrorism.

    CPJ has documented how spyware is being sold to governments with poor press freedom records and is used to target journalists and those close to them. The Pegasus Project reporting expands the known number of countries that may target journalists with spyware.

    As journalists rely on mobile devices to communicate with sources and publish news, spyware threatens their ability to do so privately and securely, and therefore threatens the public’s right to access information. CPJ has called on governments to bar the use of spyware against journalists and media outlets, and establish legal frameworks to regulate its sale, transfer, and use.

    The joint statement can be found here.


    This content originally appeared on Committee to Protect Journalists and was authored by Michael De Dora, CPJ Washington Advocacy Manager.

    This post was originally published on Radio Free.

  • Azerbaijani journalist Sevinj Vagifgizi was ‘astonished’ to learn of Pegasus spyware on phone

    Azerbaijani authorities have long had a firm grip on the media by imprisoning, harassing, and persecuting journalists both at home and abroad as well as blocking their websites. Now authorities are alleged to have used a new tool in their quest to muzzle independent reporting: spyware. Several Azerbaijani journalists have been named in the collaborative investigation Pegasus Project as possible targets of Pegasus spyware produced by the Israeli company NSO Group.

    Sevinj Vagifgizi, a correspondent for the Berlin-based, Azerbaijan-focused independent media outlet Meydan TV, was targeted by Pegasus from 2019 to 2021, according to the international network Organized Crime and Corruption Reporting Project (OCCRP), which analyzed Vagifgizi’s phone. Meydan TV is a member of the OCCRP.

    According to the OCCRP, the journalist was previously in Azerbaijani authorities’ crosshairs. She was banned from leaving the country from 2015 to 2019 after authorities told her Meydan TV was under investigation in a criminal case, and in 2019 she faced libel charges after she reported on people voting with government-issued prefilled ballots.

    Vagifgizi spoke to CPJ via phone about her experience of being hacked from Berlin, where she is currently based as part of Time Out and Research Scholarship program of Reporters Without Borders Germany.

    CPJ send an email request to NSO Group for comment for this piece but did not receive a reply. In a rebuttal published online, the company said the Pegasus Project’s allegations were false. The company has told CPJ that it will “investigate credible claims of misuse” and that it vets its clients. CPJ also requested comment from Azerbaijan’s state security service via its website, but it was not returned.

    Her answers were edited for length and clarity.     

    How did you find out you were surveilled?

    In June, my colleagues from the Organized Crime and Corruption Reporting Project contacted me and said that we should meet. They came to Berlin. During the meeting, they said: “We have bad news for you, we should take your phone because we have information that the government bugged your phone.” After they checked my phone, they told me that my phone had been targeted with the Pegasus program since 2019. They said with this program, [the Azerbaijani authorities] could listen and record all audio and video, including private videos and photos, get all the information about my contacts, and have access to all my text and voice messages. I was also told that they knew my location at any point in time.

    How did you feel at that moment? What were your main concerns?

    I was astonished, I felt awful. I was always aware that the [Azerbaijani] security service listens to our phone calls, but I never imagined that they could access anything through the internet and can record voices and take videos, and listen to and read everything I write or say.

    I was concerned about my sources who didn’t want the authorities to know that they were in touch with me. I was also concerned about my colleagues who didn’t want the authorities to know about them because if the authorities find out who they are, it may cause problems for them.

    You are currently in Berlin but are set to return to Baku in late August. Are you concerned about going back to Azerbaijan? 

    My main concern is that the authorities will bar me from traveling abroad again. I was under a travel ban for four years, from 2015 through 2019. I went through all appeal stages [in Azerbaijan] and then went to the European Court of Human Rights. The European Court ruled that the travel ban was unlawful, and the [Azerbaijani] government paid me a compensation and lifted the travel ban in 2019. I was able to come to Berlin this spring because I am not barred from leaving Azerbaijan anymore. I am concerned that the ban may return. I am also worried that now the authorities know who provided information to Meydan TV [because of the surveillance] and may bar them from leaving Azerbaijan too.

    Do you know what triggered the surveillance? Was it a specific investigation or your work in general?

    I’ve worked as a journalist since 2010. Before joining Meydan TV, I also worked with independent newspaper Azadliq. I have reported on social issues and human rights violations. I often covered political prisoners’ plights. I also did an investigation for OCCRP on [alleged] official corruption in Azerbaijan. But the time they bugged my phone coincided with the lifting of my travel ban.

    Do you know which government agency may have procured the Pegasus spyware to hack your phone?

    I don’t have any exact information on that but my colleagues and I assume it’s the state security service of Azerbaijan.

    How would authorities have gotten ahold of your number?

    It’s easy to find my number because as a journalist I contact a lot of people. Many people want to talk to me, tell me about their problems, so I can prepare reports on those issues as a journalist. Therefore they have or can easily find my number. Other journalists, including those who work for state media outlets, also have my contacts. So, it wasn’t hard.

    What is next for you? What do you want to do about the surveillance?

    We are going to take the case to an [Azerbaijani] court. We want to find out what explanation the Azerbaijani government can offer for targeting us. We are determined to go to the European Court [of Human Rights] too.

    As a journalist, I am determined to continue my work because people need us, because people don’t have [many] sources to get truthful information about the real situation in the country. My colleagues and I will keep working. I know that the government will continue surveilling us, but they won’t stop us. 


    This content originally appeared on Committee to Protect Journalists and was authored by Gulnoza Said/CPJ Europe and Central Asia Program Coordinator.

    This post was originally published on Radio Free.

  • Investigative reporter Bradley Hope: Pegasus spyware revelations a ‘wake-up call for journalists’

    Bradley Hope was in Abu Dhabi in 2009, the year the BlackBerry devices overheated. “If you put it next to your face it would almost burn,” he told CPJ in a phone interview. The BBC that year reported that a UAE telecom company had prompted local BlackBerry owners to install a rogue surveillance update disguised as a performance enhancement, accidentally sending phones into overdrive.  

    “I’ve had many experiences of these – sometimes clumsy – surveillance attempts,” Hope said.   

    More recently, Hope may have been singled out for more sophisticated surveillance. A veteran newspaper reporter specializing in complex international stories, Hope was identified by investigative collaboration the Pegasus Project as one of nearly 200 journalists potentially targeted by clients of the Israel-based technology company NSO Group, which manufactures Pegasus spyware to help governments and law enforcement secretly infiltrate cellphones.

    The Guardian, which contributed to the Pegasus Project, reported that a client believed to be the UAE began selecting Hope’s phone number for possible surveillance while he was working for The Wall Street Journal in London in early 2018.

    Hope has since left the Journal to launch his own investigative project with his reporting collaborator Tom Wright. It’s dubbed Project Brazen, he said, after the codename the pair used while uncovering a corruption scandal implicating former Malaysian Prime Minister Najib Razak in the embezzlement of funds from the 1Malaysia Development Berhad (1MDB) company. That investigation became the focus of their September 2018 book, “Billion Dollar Whale,” a story that led them to conspirators in the UAE.  

    Hope spoke to CPJ about the press freedom implications of the Pegasus Project’s list – which also includes some of slain Saudi journalist Jamal Khashoggi’s close associates. Khashoggi’s violent 2018 death features in Hope’s second book, “Blood and Oil,” on Saudi Crown Prince Mohammed bin Salman, whom the CIA has concluded ordered the journalist’s murder.

    This interview has been edited for length and clarity. CPJ asked NSO Group to comment on Hope’s remarks; in an emailed statement, a spokesperson said “any claim that a name on the list was necessarily related to a Pegasus target or Pegasus potential target is erroneous and false. NSO is a technology company. We do not operate the system, nor do we have access to the data of our customers, yet they are obligated to provide us with such information under investigations.” The company has told CPJ that it investigates credible claims of misuse made against its vetted clients.

    CPJ emailed requests for comment to the Saudi Center for International Communications under the media ministry; the UAE’s ministry of foreign affairs and international cooperation; and the Chinese ministry of foreign affairs but received no responses before publication.

    How did you learn you were on the list that is the focus of the Pegasus Project?  

    The Guardian contacted me and let me know that I was a target. We did some forensic analysis of my current phone which was considered clean. I was changing my phone frequently when I was a reporter at The Wall Street Journal – I was not particularly worried about the UAE, but more concerned about other characters in the 1MDB case who have a lot of money and a lot of reasons to try and sabotage our reporting. I used best practices to avoid this kind of risk, so if it’s true that they infiltrated a phone of mine, it would have been for a short period.

    I was disappointed on one level. I try and have a relationship with all parties that I’m covering, even people that hate my coverage. I always try and [let] them put their point of view. I don’t rush them at the last minute, I give them more time than you would think to respond to anything. I would hope that the UAE would continue to engage me at that level rather than resorting to black ops techniques.

    In a way I was surprised that it was NSO software that was allegedly used. They had been briefing many journalists – some that I know – saying that this software couldn’t be used on U.S. or U.K. numbers. I’ve seen in the press recently that they referred only to U.S. numbers, but I’ve heard that they disable its use against U.K. numbers [like the one Hope was using at the time]. I’ve never been a fan of this kind of software but [that idea] was some tiny bit of reassurance.

    I wasn’t worried about NSO, I was worried about [actors] that are not well known that have similar software or employ hackers. When it turned out to be the most well-known company – that was surprising.      

    Jamal Khashoggi, whose associate Omar Abdulaziz was targeted with Pegasus spyware, features prominently in “Blood and Oil.” Were you surprised to learn that more of his connections, including his fiancée Hatice Cengiz, were also listed?

    From the perspective of people like myself, in America or Europe, he was a Saudi commentator writing opinion pieces. From the perspective of Saudi Arabia, he was a traitor for a variety of reasons. So knowing that, I’m not surprised that they would be trying to find [proof] that he was working for other countries.

    The classic technique to find out about someone is to go through family members. In this case they might have been targeted after he was killed. It would be partially because they’re trying to understand what countries are working with those family members to elevate that story or whether his family members were being paid or anything like that – evidence for what they believe to be true. 

    What were you working on yourself?

    I was doing some reporting that would have been viewed in Abu Dhabi by some parties as problematic. We wrote a series of stories [for the Journal] about the UAE’s main conspirator in the 1MDB scandal. That would likely be very annoying for different parties in the UAE.

    The fact-checking part of [“Billion Dollar Whale”] was the culmination of all that, where we really laid out all the damaging things we had found. That would have been reason for somebody in the UAE potentially to put my phone number on a list because they’d be wanting to know, “Who are the sources for this journalist?” They’d be wondering what other country was supplying this information – even though it was never the case, many people in the government would think that way.  

    After the prime minister of Malaysia was voted out of office, all these documents were released [including] talking points between China and the Malaysian government. Chinese officials offered to penetrate [“Billion Dollar Whale” co-author] Tom [Wright]’s devices and do physical surveillance of him in Hong Kong, where he lived at the time. Another time when Tom was reporting in Malaysia, a source close to the bad guy called us and said they were thinking about arresting him and he had to escape through Singapore very rapidly.

    I never once really worried about physical threats in my career particularly because I was an American journalist at a major international newspaper. But cybersecurity [threats] I was always afraid of, and things like [the Pegasus Project], they kind of highlight it.   

    [Editor’s note: In January 2019, Hope and Wright reported in the Journal that a Chinese domestic security official had established “full scale residence/office/device tapping, computer/phone/web data retrieval, and full operational surveillance,” in order to “establish all links that WSJ HK has with Malaysia-related individuals.” Neither that official nor the Chinese government information office responded to their requests for comment at the time.]

    Where were you at the time you could have been targeted, and how does that factor into the risk of surveillance?

    I would have been mostly located in the U.K. [with a U.K. number] at that time. I didn’t travel to the Middle East. If I was in the country, it would be a lot easier to insert something [on the device].

    In many countries in the world – Gulf countries, countries in Asia like China – there is no safe way to travel there with any of your technology. If you’re doing reporting in those places you have to leave everything behind and not log into anything while you’re there. I would bring a new phone. [When you leave] you have to assume that everything you’ve taken with you is no longer usable. You have to have a temporary set of equipment. 

    If you’re reporting on anything that relates to the leadership of those countries, I would argue it’s too dangerous to do any reporting on the ground [if] you’re not comfortable leaving a trail. It would be very hard to ask people in those countries [questions] about the leadership. It’s a funny situation. If you’re the Saudi bureau chief you’re actually restricted in what you could find out. The best place to report on the UAE, Saudi Arabia for example, would be London.  

    [Those] Middle Eastern countries [that] are not developing tools themselves are having to go and buy them which increases the risk to them of being exposed. In China we hear all the time about Chinese hacking initiatives, mostly through U.S. federal lawsuits that name and shame them, explaining what they did and who they hacked within America. We don’t hear about them buying the software because they develop it all within China.

    The Gulf states are essentially buying those things – everything from intelligence work to cyber intrusion, and that’s much easier to get exposed, whereas China is much better at keeping a tight lid on what’s going on in China.

    What does this mean for journalists?

    The arms race for intrusion is so profound, there’s no real stopping it. There’s always going to be someone out there with this kind of equipment. It’s a wake-up call for journalists. We love our phones, all this high-tech stuff, using Signal – but there’s no way to protect yourself enough.

    The toolbox for journalists has to change. I hope that Apple and others take up the challenge to make phones more secure, but ultimately if you’re dealing with any story where someone’s life is at risk, you have to go lo-fi and take really annoying, time-consuming steps to protect people – meeting people and leaving your phone behind. Giving your source an old-fashioned pay-as-you-go phone that you only use to plan the meeting. Tools like Signal have been such a boon for journalists, but if your phone itself is vulnerable it doesn’t help.  


    This content originally appeared on Committee to Protect Journalists and was authored by Madeline Earp/CPJ Consultant Technology Editor.

    This post was originally published on Radio Free.

  • US indicts 5 Iranian nationals over attempted kidnapping of US-based journalist Masih Alinejad

    Washington, D.C., July 14, 2021 — The Committee to Protect Journalists today strongly condemned the alleged plot by Iranian intelligence operatives to kidnap Iranian-American journalist Masih Alinejad in the United States.

    Yesterday, U.S. prosecutors announced charges against five Iranian nationals for allegedly surveilling and planning to kidnap Alinejad, a New York-based journalist and human rights, according to a Justice Department statement.

    The indictment did not specifically name Alinejad, but she posted on Twitter stating that she was the target of the plot. Alinejad is a contributor the U.S. government-funded broadcaster Voice of America’s Persian-language service, where she covers human rights in Iran. CPJ contacted Alinejad for comment but did not immediately receive any reply. 

    “U.S. officials’ indictment of five Iranian nationals suspected of plotting to kidnap journalist Masih Alinejad shows that Iranian intelligence agents will stop at nothing to silence independent members of the press, even those abroad,” said CPJ Middle East and North Africa Program Coordinator Sherif Mansour. “U.S. authorities must ensure that the perpetrators of this scheme are held to account, and Iran must cease its efforts to harass and harm journalists globally.”

    In a Voice of America broadcast she posted to Twitter, Alinejad said she had previously received threats over her coverage. She said the FBI first contacted her about the kidnapping plot eight months ago.

    The indictment states that authorities arrested one of the Iranian nationals, Niloufar Bahadorifar, on July 1 in California. The other four, identified as Alireza Shavaroghi Farahani, Mahmoud Khazein, Kiya Sadeghi, and Omid Noori, are based in Iran and have not been arrested, the indictment says.

    Authorities charged the five with conspiracy to violate sanctions, launder money, and commit bank and wire fraud, the indictment says. Farahani, Khazein, Sadeghi, and Noori were also charged with conspiracy to kidnap Alinejad.

    The statement alleges that the group was “backed by the Iranian government,” and identifies Farahani as an intelligence official, and Khazein, Sadeghi, and Noori as intelligence assets. It alleges that Bahadorifar illegally facilitated their surveillance but was not charged with being part of the kidnapping conspiracy.

    U.S. Attorney Audrey Strauss said in the indictment that the group “monitored and planned to kidnap a U.S. citizen of Iranian origin who has been critical of the regime’s autocracy, and to forcibly take their intended victim to Iran.”

    Intelligence agents of Iran’s Islamic Republic Revolutionary Guards Corps have previously lured overseas journalists and activists to third countries where they kidnapped them and returned them to Iran; In 2019, authorities abducted journalist Roohollah Zam from Iraq and executed him in 2020.

    Yesterday’s indictment alleged that the suspects had researched ways to bring Alinejad to Venezuela and then to Iran.

    CPJ emailed Alireza Miryousefi, the head of the media office of Iran’s mission to the United Nations, for comment, but did not receive any reply.

    State Department spokesperson Jennifer Viau responded to CPJ’s emailed request for comment by referring queries to the Justice Department.

    Wyn Hornbuckle, a deputy director at Justice Department’s Office of Public Affairs, referred CPJ to the indictment published yesterday.


    This content originally appeared on Committee to Protect Journalists and was authored by Committee to Protect Journalists.

    This post was originally published on Radio Free.

  • Israeli lawyer Eitay Mack on bringing transparency to surveillance exports that threaten press freedom

    “Many countries are using these technologies to put people in jail,” Israeli lawyer Eitay Mack told CPJ in a recent video interview. He was describing advanced surveillance capabilities, such as those that CPJ has documented being used to target journalists like Omar Radi and Maati Monjib, who were both jailed in Morocco in 2020. 

    Israeli companies like NSO Group and Cellebrite market equipment to government and law enforcement agencies to fight crime, yet as CPJ has noted, journalists are vulnerable to the same sophisticated tools if they fall into the hands of repressive governments. NSO’s Pegasus spyware can remotely control a cell phone and its contents, while police say they use Cellebrite’s forensics products to extract the contents of devices seized during interrogation, potentially exposing journalists’ colleagues, family members, and sources to monitoring or reprisals.   

    When Mack learns that such technology is being used to commit abuses — against journalists or others — he tries to stop its export by petitioning the Israeli Ministry of Defense. The ministry is essentially in control of the industry, he said, through its marketing and license export regime; Mack petitions the ministry to withdraw the relevant license. 

    His work has had an impact, according to the Israeli daily Haaretz: following Mack’s petitions, Cellebrite said that it would stop sales to Russia and Belarus in March 2021, and in September 2020, said it would not supply the government of Venezuelan President Nicolás Maduro despite previous sales to defense and police clients in the country. An Israeli High Court ruling on Mack’s petition to halt the trade of arms to Myanmar in September 2017 was subject to a gag order and hasn’t been disclosed, according to Haaretz.

    CPJ spoke with Mack about his efforts to stop exports of the equipment and bring transparency to an otherwise secretive industry. His answers below have been edited for length and clarity. 

    CPJ sought response to Mack’s remarks from the Defense Ministry, NSO, Cellebrite, and other entities named in the interview. Their replies are detailed below. 

    How often do you come across journalists affected by surveillance technologies? 

    There’s a lot of public interest if it can be proved [that the equipment was used] against a journalist or an activist. But journalists [often] rely on people on the ground with a Twitter or Facebook account, and these kinds of technologies are enabling mass surveillance. If you’re talking about NSO, their system targets [a specific] person each time. According to the company, the list of targets is a few hundred. If you’re talking about Cellebrite, Alexander Bastrykin, the head of Russia’s Investigative Committee said in 2020 that in the previous year the system was used more than 26,000 times in Russia. You connect 26,000 phones, take the information – you control the population. 

    When you figure out where the technology is going, how do you try and stop it? 

    I file a petition to an Israeli court. My goal is to cancel the export license given by the Ministry of Defense. 

    The international media say a lot about the companies themselves, which is very comfortable for the Ministry of Defense. But companies are like subcontractors. The agreements are made between governments and the Ministry of Defense decides which company [gets] the deal. 

    Even if an Israeli surveillance company wants to cancel services because it got information that the system was being used against journalists or to violate human rights, it wouldn’t be able to, because it would cause a crisis [with a] foreign government. 

    The Ministry of Defense has an information security unit called MALMAB that terrorizes the companies to warn them against leaking, and there are very few people [internally] with security clearance to access the client list. If NSO or another company says, “We are like a normal international company, we have an ethics board with the greatest minds in human rights that can check our work,” [that board doesn’t] have information about what the company is doing. 

    How many companies in Israel export surveillance technology? 

    There’s no way to know, because we only know about the companies you see in the headlines. There is digital forensics, like the company Cellebrite; UAVs [unmanned aerial vehicles]; then the classic surveillance stories like the NSO Group’s Pegasus or PicSix in Bangladesh or the unknown Israeli company in Vietnam. 

    In 2013 I petitioned the Ministry of Defense to disclose the companies in the defense export register. They [only] gave a few numbers in 2014: there were about 80,000 export licenses and 320,000 marketing licenses. In Israel, there’s a unique marketing license [that companies need to negotiate with] potential clients, then a separate export license… [Through the] marketing license, you are exposing your potential client [to the ministry] which can choose to give this client to another company.

    I can identify rifles in pictures on social media, and depending on the model, I can estimate when it was exported, but surveillance systems aren’t physical. With NSO, we don’t know names of their clients, it’s hard to prove. Even with Cellebrite, [which] physically connects to the mobile phone, I only got to know that it [was being used] in Russia and Venezuela and Belarus because [local] authorities announced it. 

    How is the industry regulated in Israel? 

    They keep changing the bureaucracy to make people like me waste time. In the case of Cellebrite, the Ministry of Economy should approve [civilian clients]. But they told me [its sales to Hong Kong] came under the Ministry of Defense, according to the [Defense Export Control Law] of 2007 governing defense equipment. That law is very problematic, because the only limit is in case of a U.N. Security Council arms embargo, which is very rare. It’s why we are seeing Israeli defense exports around the world.  

    [In February 2021] the Ministry of Defense told me they had transferred approval from the unit for defense exports to the director of the Ministry of Defense, because digital forensics [systems like Cellebrite’s] fell under a 1974 order for encrypted items. That order is much worse than the 2007 law, because it allows the director to award licenses as he sees fit. 

    If two laws apply, why choose the older one? In my opinion, they wanted to widen the discretion [to approve] a company like Cellebrite for political and economic [reasons]. 

    This is what I’m trying to change, to introduce a consideration of human rights and democracy. I don’t think Israeli authorities will do it on their own, and they are used to foreign criticism in international forums. It will only happen with pressure from the Israeli public.

    Why are cases you’re involved in often subject to a gag order? 

    In all petitions on defense exports, the Ministry of Defense asks [the court] for a gag order so that only people who are part of the proceedings are able to know the ruling. [Their] representative is not even ashamed to argue that they want the gag order because they don’t have control of the media. 

    It’s annoying, in 2021, that they need to keep asking. But [a gag order] has no meaning, it’s like a child putting a blanket over its head and saying it’s night. Under defamation law in Israel you can publish information that is part of the legal process, so journalists [can report on the petitions even if they can’t report on the verdict]. And I’m allowed to say whatever I want, just not what happened inside the court. 

    What should be happening internationally to improve regulation of this industry?

    The global framework is already there. We should think about surveillance [the same way we] think about rifles and classic defense exports. Every time we’re talking about sanctions or an arms embargo, we should be talking about surveillance systems.

    There should be more demands about the technology and how it is being used, a lot of details are still unknown. Because of NSO Group’s contradictory responses to the media, we don’t know if they are technically able to dismantle [spyware] if they have knowledge of abuse. 

    With Cellebrite, the problem in a legal scenario – as far as I can tell – is that the system sucks up everything, you can’t [request one] WhatsApp message. Then are [law enforcement] violating a search order, and what do [they] do with all the information? 

    It seems that companies – and this is also problem with the Israeli government – they don’t see anything as a human rights crisis, but when they have a huge PR crisis, they are ready to be more transparent. 

    [Editor’s note: NSO Group has told CPJ that it has used a “kill switch” to shut down its systems in cases of serious misuse, but as CPJ and other groups noted in a public letter to the company in April 2021, the company has been vague about how it terminates relationships with clients. Cellebrite told CPJ that its platform “enables selective extraction of major types of digital sources, preservation, analysis and reporting of evidence to accelerate criminal cases” and that its tools are “designed to limit the analysis to only data that might be relevant to the case.”]

    Cellebrite has attracted scrutiny because it is preparing to go public on the New York stock exchange. Could that trigger a PR crisis?  

    It’s an interesting development [when that happens] because it can bring more normalization to the companies. That could push companies to be more transparent, but I don’t think investors outside Israel understand the risk of being 100% dependent on the Israeli government. If the company can’t get an export license, it’s finished. And investors won’t know what the company is doing. They will read [about] it in the newspaper.     

    Editor’s note: In response to CPJ’s questions about Mark’s remarks, Betty Ilovici, the foreign press advisor of the ministry of defense, said in a statement via email on behalf of the ministry that the Defense Export Controls Agency supervises exports of dual use cyber defense products in line with Israel’s Defense Export Control Law and international regulatory regimes, and with oversight from Israeli courts and the Knesset. “Human rights, policy and security issues are all taken into consideration,” she said, but declined to comment on specific licenses citing ministry policy. The statement did not explicitly address CPJ’s questions about MALMAB or Mack’s characterization of companies as ministry subcontractors.

    The statement also said that Israel “is one of the few countries in the world that require a two-stage licensing process by law. In accordance with the two-stage process, the exporter is required to hold a defense marketing license ahead of any marketing or promotional activity and a defense export license, for the export of any product.”

    NSO Group characterized Mack’s statements as “a complete misunderstanding of how NSO operates,” in a statement emailed to CPJ via the Mercury Public Affairs group, but refused to respond on specific points because CPJ declined to identify the interviewee in advance of publication, per CPJ’s editorial policy. The statement added that NSO investigates credible claims of misuse and shuts down a customer’s system if warranted; its Governance, Risk and Compliance Committee reviews human rights and compliance issues, and “takes every possible step to ensure NSO’s technology is sold only to those who use it as intended — to prevent and investigate terror and serious crime.”

    Cellebrite said its products “can only be used lawfully — either pursuant to a court order or warrant” and “we do not enter into business with customers whose positions or actions we consider inconsistent with our mission to support law enforcement acting in a legal manner,” noting several layers of oversight, including a board. The company could terminate license agreements and block software updates in cases where the technology is used in a manner that does not comply with the company’s values, it said in an emailed statement via the Fusion PR firm.    

    Al-Jazeera reported that in 2018 Bangladesh’s army secretly purchased equipment from the Israeli company PicSix to capture communications from mobile phones. Bangladesh’s foreign minister has denied purchasing interception equipment from Israel, according to that report. PicSix did not respond to CPJ’s request for comment submitted via its website. 

    Haaretz reported in 2018 that Vietnam had purchased an Israeli communications interception system. CPJ called Vietnam’s Ministry of Public Security for comment but the line rang unanswered.


    This content originally appeared on Committee to Protect Journalists and was authored by Madeline Earp/CPJ Consultant Technology Editor.

    This post was originally published on Radio Free.