Politicians and media rights groups across the world have voiced outrage after a new report alleged several governments, including EU-member Hungary, used an Israeli program to hack the smartphones of journalists, officials, and rights activists worldwide.
An investigation by 17 media organizations and the Organized Crime and Corruption Reporting Project (OCCRP), released late on July 18, has drawn links between the Israeli-based NSO Group, accused of supplying spyware to governments, and a leaked database of up to 50,000 phone numbers believed to have been identified as people of interest by clients of the company since 2016.
The NSO Group clients included the governments of Azerbaijan, Bahrain, Hungary, India, Indonesia, Kazakhstan, Mexico, Morocco, Rwanda, Saudi Arabia, Togo, and the United Arab Emirates, according to the report.
The report has sent a chill across the world by bolstering accusations that not just autocratic regimes but democratic governments, including India and Mexico, have used the NSO Group's Pegasus spyware for political ends.
"Revelations regarding the apparent widespread use of the Pegasus software to spy on journalists, human rights defenders, politicians, and others in a variety of countries are extremely alarming, and seem to confirm some of the worst fears about the potential misuse of surveillance technology to illegally undermine people's human rights," UN High Commissioner for Human Rights Michelle Bachelet said in a statement on July 19.
NSO denied any wrongdoing, saying in a statement that its Pegasus software was intended for use against criminals and terrorists and is made available only to military, law enforcement, and intelligence agencies from countries with good human rights records.
"After checking their claims, we firmly deny the false allegations made in their report," the statement said.
But the statement did little to quell recriminations and calls for investigations from capitals around the world.
European Commission President Ursula von der Leyen noted that while the information still had to be verified, "if it is the case, it is completely unacceptable. Against any kind of rules we have in the European Union," she said during a visit to Prague after Hungary, one of the bloc's 27 members, appeared on the client list.
"Freedom of media, free press is one of the core values of the EU. It is completely unacceptable if this (hacking) were to be the case," she added.
The list of names includes 189 journalists, more than 600 politicians and government officials, at least 65 business executives, 85 human rights activists, and several heads of state, according to The Washington Post, a consortium member.
The journalists work for organizations including Radio Free Europe/Radio Liberty, the Associated Press, Reuters, CNN, The Wall Street Journal, Le Monde, and the Financial Times.
The Israeli Defense Ministry echoed NSO's statement, saying that the export of cyberproducts, like spyware sold by NSO Group, was for lawful use and with the sole purpose of fighting crime and countering terrorism.
In the wake of the report, the U.S. government said it would no longer use the "compulsory legal process" including subpoenas or warrants to obtain records or identify sources from journalists involved in news-gathering activities.
The new policy comes following revelations that former President Donald Trump's Justice Department secretly obtained phone records of journalists investigating his administration, including from CNN, The Washington Post, and The New York Times.
In Europe, the report was a stinging blow to Hungarian Prime Minister Viktor Orban, who has been accused by the EU of flouting democracy with a series of laws seen as curtailing a free press and human rights.
Foreign Minister Peter Szijjarto rejected the allegations, telling a press conference on July 19 that Hungary's civilian intelligence agency did not use the Pegasus software "in any way."
"The government has no knowledge of this type of data collection," Szijjarto added.
Pegasus infects iPhones and Android devices to enable operators to record phone calls, access text messages, photos, e-mails, and passwords, track GPS data, and secretly activate microphones and cameras.
The report has sent a chill across the world by bolstering accusations that not just autocratic regimes but democratic governments, including India and Mexico, have used NSO Group's Pegasus spyware for political ends.
The investigation has identified more than 1,000 people spanning over 50 countries whose numbers were on the list, including more than 180 journalists from outlets such as CNN, The New York Times, and Al-Jazeera.
According to OCCRP, a consortium of investigative centers, media, and journalists operating in Eastern Europe, the Caucasus, Central Asia, and Central America, Azerbaijan appears to have acquired Pegasus to spy on hundreds of local activists and journalists, including RFE/RL reporters.
While there is "no definitive proof" that Baku is an NSO client or that the leaked numbers represent people selected for targeting, it said "a preponderance of evidence suggests that this is the case."
The OCCRP said that all but a few of the 245 Azerbaijani numbers identified belonged to journalists, activists, lawyers, and members of the country's opposition.
Among them were five current and former reporters for RFE/RL, including Khadija Ismayilova, the broadcaster's former Baku bureau chief and one of the country's most renowned investigative journalists.
Forensic analysis determined that Ismayilov's phone was ridden with traces of Pegasus software, OCCRP said.
"It is outrageous that in the 21st century, so many governments seek to block free expression and prevent journalists from providing objective news and information to their fellow citizens," RFE/RL President Jamie Fly said in a statement on July 19.
"RFE/RL strongly condemns this cowardly invasion of the privacy of working journalists. We have long highlighted the abusive practices of the Azerbaijani government against our Azerbaijani Service, Radio Azadliq. We call on the Azerbaijani government to stop blocking our website, halt its surveillance of our staff, and to cease its harassment of our former bureau chief Khadija Ismayilova," he added.
President Ilham Aliyev has turned Azerbaijan into one of the most repressive former Soviet states, cracking down hard on free media and the opposition during his nearly 20-year rule.
Critics have accused his authoritarian government of using a growing array of sophisticated surveillance technology to track members of the opposition and media.
Sevinc Vaqifqizi, an Azerbaijani journalist working for Meydan TV, an independent news organization based in Berlin, was one of those whose phone number was found to have been infected with the Pegasus software.
She told RFE/RL's Azerbaijani Service via Skype that a forensic analysis of her phone showed it had been tapped since 2019.
"We will file a complaint with the courts. We will demand an investigation from the prosecutor's office. And if this case is not investigated in Azerbaijan, and there is no decision on this issue, we will bring the case to European courts," she said.
Elsad Haciyev, head of the media and public relations department of Azerbaijan's Interior Ministry, told RFE/RL the report was "nonsense," calling it a "baseless fabrication of some individuals."
Agnes Callamard, secretary-general of London-based Amnesty International, which was also involved in the project, said the investigation "lays bare how NSO's spyware is a weapon of choice for repressive governments seeking to silence journalists, attack activists and crush dissent, placing countless lives in peril."
The secretary-general of Reporters Without Borders, Christophe Deloire, said the revelations about the use of the Pegasus spyware "inspire disgust and a feeling of revolt given the extent of the surveillance and the targeting of journalists."
