WASHINGTON – An Israeli firm accused of supplying spyware to governments has been linked to a list of 50,000 smartphone numbers, including those of activists, journalists, business executives and politicians around the world, according to reports yesterday.
Israel’s NSO Group and its Pegasus malware has been in the headlines since at least 2016, when researchers accused it of helping spy on a dissident in the United Arab Emirates.
Yesterday’s revelations raise privacy and rights concerns, and reveal the far-reaching extent to which the private Israeli company’s software may be being used by its clients internationally.
The extent of Pegasus’ use was reported by The Washington Post, the Guardian, Le Monde and other news outlets who collaborated on an investigation into a data leak.
The leak was of a list of more than 50,000 smartphone numbers believed to have been identified as people of interest by NSO clients since 2016, said the media outlets.
The Post said the list was shared with the news organisations by Forbidden Stories, a Paris-based journalism non-profit, and Amnesty International.
The newspaper said the total number of phones on the list that were actually targeted or surveilled is unknown.
The Post said 15,000 of the numbers were in Mexico, and included those of politicians, union representatives, journalists and government critics.
The list reportedly included the number of a Mexican freelance journalist who was murdered at a carwash. His phone was never found and it was not clear if it had been hacked.
Indian investigative news website The Wire reported that 300 phone numbers used in India – including those of government ministers, opposition politicians, journalists, scientists and rights activists – were on the list.
It said the numbers included those of more than 40 Indian journalists from major publications, such as the Hindustan Times, The Hindu and Indian Express, as well as two founding editors of The Wire.
The Indian government had in 2019 denied that it used the malware to spy on its citizens, after WhatsApp filed a suit in the United States against NSO, accusing it of using the messaging platform to conduct cyber espionage.
The Post said a forensic analysis of 37 of the smartphones on the list showed there had been “attempted and successful” hacks of the devices, including those of two women close to Saudi journalist Jamal Khashoggi, who was murdered in 2018 by a Saudi hit squad.
Among the numbers on the list are those of journalists for Agence France-Presse, The Wall Street Journal, CNN, The New York Times, Al Jazeera, France 24, Radio Free Europe, Mediapart, El Pais, Associated Press, Le Monde, Bloomberg, Economist, Reuters and Voice of America, said the Guardian.
Pegasus is reportedly a highly invasive tool that can switch on a target’s phone camera and microphone, as well as access data on the device, effectively turning a phone into a pocket spy.
In some cases, it can be installed without the need to trick a user into initiating a download.
NSO yesterday issued a denial that focused on the report by Forbidden Stories, calling it “full of wrong assumptions and uncorroborated theories”, and threatened a defamation suit.
“We firmly deny the false allegations made in their report,” it said.
“As NSO has previously stated, our technology was not associated in any way with the heinous murder of Jamal Khashoggi.
“We would like to emphasise that NSO sells its technologies solely to law enforcement and intelligence agencies of vetted governments for the sole purpose of saving lives through preventing crime and terror acts.”
The use of the Pegasus software to hack the phones of Al-Jazeera reporters and a Moroccan journalist has been reported previously by Citizen Lab, a research centre at the University of Toronto, and Amnesty International. – AFP, July 19, 2021
