Wednesday July 21, 2021
A leak of phone data suggests human rights lawyers, activists and dissidents across the globe were selected as possible candidates for invasive surveillance through their phones.
Their mobile phone numbers appeared in leaked records, indicating they were selected prior to possible surveillance targeting by governmental clients of the Israeli company NSO Group, which developed the Pegasus spyware.
The records were obtained by the nonprofit organisation Forbidden Stories and shared with a consortium of media outlets including the Guardian.
NSO has repeatedly said Pegasus, which can access all data on a target’s device as well as turn it into an audio or video recorder, is meant for use only against terrorists and serious criminals.
The selection of activists, dissidents and journalists by NSO clients paints a very different picture, though one that campaigners will say was grimly predictable given the tool has been sold to some of the world’s most repressive regimes.
The activists at risk from surveillance
In Azerbaijan, where the longtime dictator Ilham Aliyev tolerates little dissent, numerous activists appear in the data. Some found their personal correspondence or intimate photographs published online or on television.
The phone numbers of six dissidents or activists in the country whose private correspondence was featured on a muckraking television programme in 2019 are listed in the leaked records.
Female activists are often targeted with sexual kompromat. In one particularly egregious case in 2019, intimate photographs of the civil society activist and journalist Fatima Movlamli, then 18, were leaked on to a fake Facebook page.
It is not clear how the photographs were obtained, and Movlamli believes her private data was accessed when police seized her phone during a violent interrogation and forced her to unlock it. Her number was also in the records obtained by the consortium.
“At an age when I didn’t fully realise I was a woman, I was ashamed that I had a female body and that people saw it naked,” said Movlamli. She described the experience as “hard to bear” and said it had led to suicidal thoughts. “In this country, women are doomed to live within the limits of what men want, and they can lynch a woman just because they see her body.”
Without forensic analysis of a device, it is not possible to confirm a successful Pegasus attempt or infection. Movlamli said she regularly resets her phone or changes device, so analysis was not possible.
In India, the numbers of a variety of activists were found in the data.
Umar Khalid, a student activist at Jawaharlal Nehru University in Delhi and the leader of the Democratic Students’ Union, was selected ahead of a possible targeting in late 2018, shortly before sedition charges were filed against him. He was arrested in September 2020 on charges of organising riots, and police claimed the evidence against him included more than 1m pages of information gleaned from his mobile phone, without making it clear how the information was obtained. He is in jail awaiting trial.
The mobile numbers of writers, lawyers and artists who advocated for the rights of indigenous communities and low-caste Indians were also in the data.
Members of the network have been arrested over the past three years and charged with terrorism offences, including plotting to assassinate the Indian prime minister, Narendra Modi. The network included an 84-year-old Jesuit priest, Stan Swamy, who died this month after contracting Covid-19 in prison.
The records show that several people accused of being Swamy’s accomplices, including Hany Babu, Shoma Sen and Rona Wilson, were selected for possible targeting in the months before and the years after their arrests.
Loujain al-Hathloul, the most prominent women’s rights activist in Saudi Arabia, was selected for possible targeting just weeks before her 2018 abduction in the United Arab Emirates and forced return to Saudi Arabia, where she was imprisoned for three years and allegedly tortured. It is believed Hathloul was selected by the UAE, a known client of NSO and close ally of Saudi Arabia.
Despite her release from jail in February 2021, the Saudi activist is not permitted to speak to journalists or move freely within Saudi Arabia and is still subject to a travel ban. Her mobile phone could not be obtained or tested for evidence that it had been infected or hacked.
Hathloul had previously revealed her emails had been hacked. “My assumption is that they were hacking her to know the networks of people she is organising with,” said Hala al-Dosari, a US-based Saudi activist who communicated with Hathloul before her 2018 arrest.
Dosari said Saudi authorities had gained non-public information about per diem payments of about €50 (£43) a day that had been made to Hathloul in connection to her advocacy, possibly via her mobile phone.
In Mexico, the data shows widespread selection of campaigners, lawyers and rights defenders for possible targeting, including Eduardo Ferrer Mac-Gregor Poisot, a judge who was the president of the Inter-American court of human rights and Alejandro Solalinde, a Catholic priest and champion of migrants’ rights.
Solalinde said he believed the previous Mexican government was “looking for something to damage my reputation and use as blackmail” due to his support for a political rival, and said he had been warned by a former national intelligence agency (Cisen) agent that he was under surveillance .
John Scott-Railton of Citizen Lab, which released a report on the targeting of the Emirati activist Ahmed Mansoor with Pegasus in 2016, said: “The targeting of dissidents [should] sit in the same mental box as the targeting of heads of state, the targeting of ambassadors, as the targeting of big corporations and defence contractors.”
The lawyers at risk from surveillance
Lawyers also feature heavily in the leaked data. Rodney Dixon, a prominent London-based lawyer, who has taken on numerous high-profile human rights cases, was selected for targeting in 2019. Forensic analysis of his device showed Pegasus-related activity but no successful infection.
His clients have included Matthew Hedges, a British doctoral student jailed in the UAE, and Hatice Cengiz, the fiancee of the murdered Saudi journalist Jamal Khashoggi. She was also targeted with Pegasus, with forensics showing evidence of a successful infection.
Dixon said: “No one should be targeted in this fashion. For lawyers it is particularly concerning as it violates the fundamental principles of lawyer-client privilege and confidentiality, which are central to fair and just legal proceedings.”
Forensic analysis on the phone of the French human rights lawyer Joseph Breham shows it was compromised multiple times with Pegasus in 2019, and the leaked records suggest he had previously been selected for potential targeting by Morocco.
“There is no possible justification for a foreign state to listen to a French lawyer. There is no justification on a legal, ethical or moral level,” he said.
Two lawyers who are bringing a lawsuit against NSO on behalf of Omar Abdulaziz, a Saudi living in exile in Canada, also had their numbers appear in the leaked data. Abdulaziz was a close collaborator and friend of Khashoggi.
Analysis of both lawyers’ mobile phones did not find evidence of any attempt to use the Pegasus software against them.
“Not only do they hack people because of their political activities, but if these [victims] are seeking any kind of accountability, they will go after the people helping them,” said one of the lawyers, who asked not to be named.
A spokesperson for the Indian government said: “The allegations regarding government surveillance on specific people has no concrete basis or truth associated with it whatsoever.” The governments of Morocco, Azerbaijan and Mexico did not respond to requests for comment by the time of publication.
NSO Group has claimed it will cut off clients if they misuse Pegasus. In a response to the consortium, it denied the leaked records were evidence of targeting with Pegasus and said it “will continue to investigate all credible claims of misuse and take appropriate action based on the result of these investigations”.
The use of spyware and hacking in a country such as Azerbaijan, where compromising activists appears to be government policy, can have a chilling effect not just on those targeted, but across civil society.
Samed Rahimli, an Azerbaijani human rights lawyer, whose own number was in the data, said the use of kompromat had made life difficult for the country’s activists, especially female activists. “Many people are afraid to live their personal lives in a normal way. Many also face psychological problems and they have sought professional support.”