The Pegasus Project is an international investigative journalism initiative that revealed governments' espionage on journalists, opposition politicians, activists, business people and others using the private Pegasus spyware developed by the Israeli technology and cyber-arms company NSO Group. Pegasus is ostensibly marketed for surveillance of "serious crimes and terrorism". In 2020, a target list of 50,000 phone numbers leaked to Forbidden Stories, and an analysis revealed the list contained the numbers of leading opposition politicians, human rights activists, journalists, lawyers and other political dissidents.
A small number of phones that were inspected by Amnesty International's cybersecurity team revealed forensic evidence of the Pegasus spyware, a zero-click Trojan virus developed by NSO Group. This malware provides the attacker full access to the targeted smartphone, its data, images, photographs and conversations as well as camera, microphone and geolocation. This information was passed along to 17 media organisations under "The Pegasus Project" umbrella name. Reports started to be published by member organisations on 18 July 2021, revealing notable non-criminal targets and analysing the practice as a threat to freedom of the press, freedom of speech, dissidents and democratic opposition. On 20 July, 14 heads of state were revealed as former targets of Pegasus malware. Various parties called for further investigation of the abuses and a limitation on trading such repressive malware, among them the newsrooms involved, the Committee to Protect Journalists, the International Press Institute, and Edward Snowden.
Software
The Pegasus spyware was developed by the Israeli cyberarms company NSO Group. It can be covertly installed on mobile phones (and other devices) running most versions of iOS and Android. The spyware is named after the mythical winged horse Pegasus—it is a Trojan horse that can be sent "flying through the air" to infect phones. Usages of the Pegasus spyware have been monitored for years. Amnesty has argued that the digital invasion is correlated with real-life consequences for spied targets, via psychological or physical damages.
The NSO Group exports are overseen by the Israeli Ministry of Defense's Defense Exports Control Agency (DECA).
Investigation
Origins and members In 2020, a list of over 50,000 phone numbers believed to belong to individuals identified as "people of interest" by clients of the Israeli cyberarms firm NSO Group was leaked to Amnesty International and Forbidden Stories, a media nonprofit organisation based in Paris, France.
This information was passed along to 17 media organisations under the umbrella name "The Pegasus Project". Over several months, over 80 journalists from The Guardian (United Kingdom), Le Monde and Radio France (France), Die Zeit, Süddeutsche Zeitung, WDR and NDR (Germany), The Washington Post and Frontline (United States), Haaretz (Israel), Aristegui Noticias and Proceso (Mexico), Knack and Le Soir (Belgium), The Wire (India), Daraj (Syria), Direkt36 (Hungary), and OCCRP investigated the spying abuses.
Investigative methodology The leaked list of targeted phone numbers provides an indication of being a "person of interest" and a first indication of possible hacking, to be confirmed via direct forensic examination of the phone. According to Amnesty, "The Citizen Lab at the University of Toronto independently peer-reviewed a draft of their forensic methodology outlined in Forensic Methodology Report: How to catch NSO Group's Pegasus. Amnesty also published various tools or data from this investigation, including a Mobile Verification Toolkit (MVT) and a GitHub repository listing indicators of NSO/Pegasus compromised devices. Some emerging unverified online services claim to be able to assess an infection by Pegasus, but their usage is discouraged as possible scams themselves. Amnesty and Forbidden Stories received numerous queries for checking devices but were not able to satisfy the demand for assistance.
Findings The investigation suggested that Pegasus continued to be widely used by authoritarian governments to spy on human rights activists, journalists and lawyers worldwide, although NSO claims that it is only intended for use against criminals and terrorists.
A French journalist noted that "in a matter of cyber-surveillance, we observe that abuse is de facto the rule". Forbidden Stories argues the Pegasus software and its usages de facto constitute a global weapon to silence journalists.
Forensic Architecture and the Pegasus Project lead a data analysis and built a data visualisation plotting attempt hacking of dissidents together with real-life intimidations, threats or violence. They have argued that Pegasus has become a key tool for states to repress their own people.
Regions and targets Targets include known criminals as well as human rights defenders, political opponents, lawyers, diplomats, heads of state and nearly 200 journalists from 24 countries. The Guardian mentioned 38 journalists in Morocco, 48 journalists in Azerbaijan, 12 journalists in the United Arab Emirates and 38 journalists in India as having been targeted. Some of the targets whose names have been revealed are listed below; the list is non-exhaustive.
Heads of state and government According to an analysis by the German newspaper Die Zeit and others, the following incumbent and former heads of state and government have been targeted, implying possible full access to their mobile phones' data:
Abdelaziz Bouteflika, former President of Algeria Noureddine Bedoui, former Prime Minister of Algeria Mostafa Madbouly, Prime Minister of Egypt Charles Michel, former Prime Minister of Belgium and former President of the European Council Emmanuel Macron, President of France Édouard Philippe, former Prime Minister of France Édith Chabre, wife of Édouard Philippe Most French ministers Numerous French diplomats Barham Salih, former President of Iraq Bakhytzhan Sagintayev, former Prime Minister of Kazakhstan Saad Hariri, former Prime Minister of Lebanon Mohammed VI, King of Morocco Saadeddine Othmani, former Prime Minister of Morocco Imran Khan, former Prime Minister of Pakistan Cyril Ramaphosa, President of South Africa Ruhakana Rugunda, former Prime Minister of Uganda Ahmed Obeid bin Daghr, former Prime Minister of Yemen
Azerbaijan Fatima Movlamli, an Azerbaijani civil society activist and journalist opposed to local authoritarian government. Intimate photographs of her were leaked on Facebook in 2019 when she was only 18.
Hungary Used against opposition journalists, opposition leaders and critics. Szabolcs Panyi, a Hungarian investigative journalist for , hacked in 2019. Panyi joined the Pegasus Project investigation. András Szabó, a Hungarian investigative journalist. Dávid Dercsényi, a Hungarian investigative journalist (HVG). György Gémesi, a right-wing opposition politician, mayor of Gödöllő and president of the Alliance of Hungarian Local-Governments. , president of the Hungarian Bar Association, and nine other lawyers. Zoltán Varga, a businessman and owner of Central Media Group, which publish opposition press products (24.hu). Attila Chikán, a former economy minister in the first cabinet of Viktor Orbán, currently a vocal critic of Orbán's politics.
India
Used against opposition leaders, union ministers, journalists, administrators such as Election Commissioner and heads of the Central Bureau of Investigation (CBI) and minority leaders. Rahul Gandhi, an Indian politician and main rival of Indian Prime Minister Narendra Modi, was targeted on two of his cellphones. He would go on to claim that "all [his] phones are tapped". Five close friends and other Indian National Congress party officials were in the leaked list of potential targets. Prashant Kishor, a political strategist and tactician, who is linked with several of Prime Minister Narendra Modi's rivals, was also targeted. Some opposition politicians such as Mamata Banerjee even claimed that Pegasus was used to keep track of the meetings between the two. Ashok Lavasa, an ex-Election Commissioner of India who flagged Prime Minister Narendra Modi's poll code violation in the 2019 Indian general election was targeted. Alok Verma, who was ousted as the head of the Central Bureau of Investigation (CBI) by Prime Minister Narendra Modi in 2018 was a target. Numerous Indian politicians including Deputy Chief Minister of Karnataka G. Parameshwara, as well as close aides of then Chief Minister H. D. Kumaraswamy and senior Congress leader Siddaramaiah. Abhishek Banerjee, a West Bengal politician of the All India Trinamool Congress, and the nephew of incumbent Chief Minister of West Bengal Mamata Banerjee. Siddharth Varadarajan, a New Delhi–based, American investigative journalist and founder of The Wire. Varadarajan joined the Pegasus Project investigation. Umar Khalid, a left-wing student activist and leader of the Democratic Students' Union, was added to the list in late 2018, then charged with sedition. He was arrested in September 2020 for organising the Delhi riots; the provided evidence was taken from his phone. He is currently in jail awaiting trial. Stan Swamy, an Indian Jesuit father and activist. Swamy died on 5 July 2021 at the age of 84 after contracting COVID-19 in prison. Collaborators Hany Babu, Shoma Sen and Rona Wilson were also in the project's list of alleged targets. Ashwini Vaishnaw, Minister of Electronics and Information Technology who assumed office less than 3 weeks before the investigation was revealed. The inner circle to the 14th Dalai Lama Tenzin Gyatso, the 17th Karmapa Ogyen Trinley Dorje and other Tibetan figures, including: Tempa Tsering, the Dalai Lama's envoy to Delhi Tenzin Taklha, the Dalai Lama's senior aide Chhimey Rigzen, the Dalai Lama's senior aide Lobsang Tenzin, the 5th Samdhong Rinpoche, who is responsible for the selection of the Dalai Lama's successor Lobsang Sangay, former president of the Tibetan government-in-exile Penpa Tsering, president of the Tibetan government-in-exile
Italy Romano Prodi, former Prime Minister of Italy and former President of the European Commission, was spied on while he was working as the UN Special Envoy to Sahel.
Mexico Used against anti-corruption journalists, opposition leaders and a judge. Cecilio Pineda Birto (died 2 March 2017), a Mexican investigative and anti-corruption journalist. His phone was added as a Pegasus target just weeks before his assassination. , a Mexican judge, former president of the Inter-American Court of Human Rights. Alejandro Solalinde, a Catholic priest and champion of migrants' rights. Believed to be targeted due to his support to opposition politicians.
Morocco Used against opposition, Western Sahara–friendly journalists in Morocco and France, and more than 6,000 Algerian politicians, high-ranking military officials, heads of intelligence, civil servants, diplomats and activists. Edwy Plenel, a French journalist, co-founder and publishing editor at opposition newsroom Mediapart, hacked in 2019 by Morocco. , a French journalist also at Mediapart, hacked in 2020 by Morocco. , a Spanish journalist specialising in the Maghreb. He reported that he was hacked by the Moroccan government after learning that in June a Moroccan newspaper "picked up two WhatsApp conversations he had had with senior officials of the Spanish administration". Ahmed Gaid Salah, former Chief of Staff of the Algerian People's National Armed Forces Ali Haddad, Algerian businessman and supporter of former President Abdelaziz Bouteflika Abdelkader Messahel, former Minister of Foreign Affairs of Algeria
Poland