Pegasus project consortium awarded EU prize for spyware revelations – The Guardian

Pegasus project consortium awarded EU prize for spyware revelations – The Guardian

The European parliament has jointly awarded a major journalism prize to a consortium of 17 media outlets including the Guardian for the Pegasus spyware scandal revelations.

A series of stories over the summer revealed evidence that global clients of the Israeli surveillance company NSO Group had identified human rights activists, journalists, lawyers and leading political figures, including the French president, Emmanuel Macron, as potential targets for phone-hacking software.

The group of 17 media organisations, led by Paris-based non-profit journalism group Forbidden Stories, picked up the inaugural Daphne Caruana Galizia prize for journalism of €20,000 (£17,000) on the advice of an independent jury of members of the press and civil society from the 27 EU member states and representatives of the main European associations of journalism.

Caruana Galizia was one of Malta’s most prominent and dogged investigative journalists. She was assassinated in a car bombing close to her home on 16 October 2017.

David Sassoli, the president of the European parliament, said: “Daphne Caruana Galizia’s death has brought about a resurgence of investigative journalism by colleagues committed to continuing her work. Recent examples, such as the Pandora papers, have demonstrated the unique power of journalism that is daring and adamant, particularly when carried out in the context of an international consortium.

“By creating transparency, investigative journalism allows voters to make informed decisions. Protecting and supporting journalists is in the vital interest of democratic societies.”

The Pegasus project investigation, which received technical support from Amnesty International, found that the phone numbers of individuals across 50 countries appeared on a database believed to contain targets for potential surveillance.

Quick Guide

What is in the Pegasus project data?


What is in the data leak?

The data leak is a list of more than 50,000 phone numbers that, since 2016, are believed to have been selected as those of people of interest by government clients of NSO Group, which sells surveillance software. The data also contains the time and date that numbers were selected, or entered on to a system. Forbidden Stories, a Paris-based nonprofit journalism organisation, and Amnesty International initially had access to the list and shared access with 16 media organisations including the Guardian. More than 80 journalists have worked together over several months as part of the Pegasus project. Amnesty’s Security Lab, a technical partner on the project, did the forensic analyses.

What does the leak indicate?

The consortium believes the data indicates the potential targets NSO’s government clients identified in advance of possible surveillance. While the data is an indication of intent, the presence of a number in the data does not reveal whether there was an attempt to infect the phone with spyware such as Pegasus, the company’s signature surveillance tool, or whether any attempt succeeded. The presence in the data of a very small number of landlines and US numbers, which NSO says are “technically impossible” to access with its tools, reveals some targets were selected by NSO clients even though they could not be infected with Pegasus. However, forensic examinations of a small sample of mobile phones with numbers on the list found tight correlations between the time and date of a number in the data and the start of Pegasus activity – in some cases as little as a few seconds.

What did forensic analysis reveal?

Amnesty examined 67 smartphones where attacks were suspected. Of those, 23 were successfully infected and 14 showed signs of attempted penetration. For the remaining 30, the tests were inconclusive, in several cases because the handsets had been replaced. Fifteen of the phones were Android devices, none of which showed evidence of successful infection. However, unlike iPhones, phones that use Android do not log the kinds of information required for Amnesty’s detective work. Three Android phones showed signs of targeting, such as Pegasus-linked SMS messages.

Amnesty shared “backup copies” of four iPhones with Citizen Lab, a research group at the University of Toronto that specialises in studying Pegasus, which confirmed that they showed signs of Pegasus infection. Citizen Lab also conducted a peer review of Amnesty’s forensic methods, and found them to be sound.

Which NSO clients were selecting numbers?

While the data is organised into clusters, indicative of individual NSO clients, it does not say which NSO client was responsible for selecting any given number. NSO claims to sell its tools to 60 clients in 40 countries, but refuses to identify them. By closely examining the pattern of targeting by individual clients in the leaked data, media partners were able to identify 10 governments believed to be responsible for selecting the targets: Azerbaijan, Bahrain, Kazakhstan, Mexico, Morocco, Rwanda, Saudi Arabia, Hungary, India, and the United Arab Emirates. Citizen Lab has also found evidence of all 10 being clients of NSO.

What does NSO Group say?

You can read NSO Group’s full statement here. The company has always said it does not have access to the data of its customers’ targets. Through its lawyers, NSO said the consortium had made “incorrect assumptions” about which clients use the company’s technology. It said the 50,000 number was “exaggerated” and that the list could not be a list of numbers “targeted by governments using Pegasus”. The lawyers said NSO had reason to believe the list accessed by the consortium “is not a list of numbers targeted by governments using Pegasus, but instead, may be part of a larger list of numbers that might have been used by NSO Group customers for other purposes”. They said it was a list of numbers that anyone could search on an open source system. After further questions, the lawyers said the consortium was basing its findings “on misleading interpretation of leaked data from accessible and overt basic information, such as HLR Lookup services, which have no bearing on the list of the customers’ targets of Pegasus or any other NSO products … we still do not see any correlation of these lists to anything related to use of NSO Group technologies”. Following publication, they explained that they considered a “target” to be a phone that was the subject of a successful or attempted (but failed) infection by Pegasus, and reiterated that the list of 50,000 phones was too large for it to represent “targets” of Pegasus. They said that the fact that a number appeared on the list was in no way indicative of whether it had been selected for surveillance using Pegasus. 

What is HLR lookup data?

The term HLR, or home location register, refers to a database that is essential to operating mobile phone networks. Such registers keep records on the networks of phone users and their general locations, along with other identifying information that is used routinely in routing calls and texts. Telecoms and surveillance experts say HLR data can sometimes be used in the early phase of a surveillance attempt, when identifying whether it is possible to connect to a phone. The consortium understands NSO clients have the capability through an interface on the Pegasus system to conduct HLR lookup inquiries. It is unclear whether Pegasus operators are required to conduct HRL lookup inquiries via its interface to use its software; an NSO source stressed its clients may have different reasons – unrelated to Pegasus – for conducting HLR lookups via an NSO system.

Thank you for your feedback.

The investigation was based on forensic analysis of phones and analysis of a leaked database of 50,000 numbers, including numbers for Macron and the European Council president, Charles Michel, along with other heads of state and senior government, diplomatic and military officials in 34 countries.

Last month Hungary’s data protection authority said it had launched an official investigation into allegations concerning the Hungarian government’s use of the Pegasus software.

At least five Hungarian journalists appeared on a leaked list reviewed by the Pegasus project consortium. Also on the list was the number of the opposition politician György Gémesi, who is the mayor of the town of Gödöllő and the head of a nationwide association of mayors.

“An unprecedented leak of more than 50,000 phone numbers selected for surveillance by the customers of the Israeli company NSO Group shows how this technology has been systematically abused for years,” the EU parliament said in a statement.

NSO is an Israeli surveillance company regulated by the country’s ministry of defence, which approves the sale of its spyware technology to government clients around the world.

The company says it sells only to military, law enforcement and intelligence agencies in 40 unnamed countries for the purpose of terrorism and crime investigations. It further claims to rigorously vet its customers’ human rights records before allowing them to use its spy tools.

NSO says it “does not operate the systems that it sells to vetted government customers, and does not have access to the data of its customers’ targets.”

Eve Geddie, the director of Amnesty International’s European institutions office, said: “It is vital that EU countries address these abuses, protect journalists and rights defenders, and ensure robust and meaningful regulation over the cybersurveillance industry both at home and abroad.”