Global targeting of journalists with state spyware revealed by international investigation

The targeting of almost 200 journalists, including the editor of the Financial Times, using a spyware surveillance tool has been condemned as the “21st century equivalent of smashing printing presses and storming TV stations”.

The Guardian and a consortium of media organisations have revealed at least 180 journalists including the FT’s Roula Khalaf (pictured) were selected as potential targets of the Israeli surveillance firm NSO Group under orders from clients including governments around the world.

The FT and Khalaf, who was apparently singled out for surveillance by the United Arab Emirates in 2018 when she was deputy editor, said in response: “Press freedoms are vital, and any unlawful state interference or surveillance of journalists is unacceptable.”

Other governments thought to have selected journalists as possible surveillance targets include Azerbaijan, Bahrain, Hungary, India, Kazakhstan, Mexico, Morocco, Rwanda and Saudi Arabia.

Reporters Without Borders is now hoping to coordinate legal action on behalf of the journalists and media who were affected. General secretary Christophe Deloire said: “We will do everything to ensure that NSO is punished for the crimes it has committed and the tragedies it has made possible.

“The justice systems in democratic countries must address this extremely serious matter, establish the facts and punish those responsible.”

The revelations came through the Pegasus Project, which has been organised by the Forbidden Stories consortium with support from Amnesty International. Some 80 reporters were involved in the investigation from media partners including The Guardian in the UK, The Washington Post and PBS Frontline in the US, European news titles including Le Monde, Süddeutsche Zeitung, Die Zeit, Radio France, Knack, Le Soir and Direkt36.

Also involved were Aristegui Noticias and Proceso in Mexico, The Wire in India, Arabic-speaking platform Daraj, and the Hebrew-language Haaretz/TheMarker, as well as the Organized Crime and Corruption Reporting Project.

The journalists analysed a leaked list of mobile phone numbers which had been selected for possible surveillance. The Pegasus spyware, once installed on a phone, can give an external operator total access to its data and microphone.

Journalists who appeared on the list included figures from the Wall Street Journal, CNN, the New York Times, Al Jazeera, France 24, Radio Free Europe, Mediapart, El País, Associated Press, Le Monde, Bloomberg, Agence France-Presse, the Economist, Reuters and Voice of America.

Tim Dawson, chair of the International Federation of Journalists’ expert group on surveillance, said: “Pegasus software is being used as an algorithm to undermine democracy.

“Confidential contacts provide the basis for all the best journalism – that which exposes waste, incompetence and corruption. The privacy of reporters’ communications, whether by email, messenger or phone should be sacrosanct.

“Allowing tyrants, despots and the enemies of freedom access to tools such as Pegasus is the 21st century equivalent of smashing printing presses and storming tv stations.”

IFJ general secretary Anthony Bellanger saluted the work of the Pegasus Project journalists but said he feared it showed access to the most private of information by rogue actors is inevitable.

“The duty of reporters to protect their sources is the foundation of the journalism upon which free societies depend,” he said. “That such a leak is possible, however, underlines the dangers inherent in such powerful software.

“If media organisations can obtain such a substantial and detailed cache of information, then clearly so can those whose intentions are less honourable. Without robust regulation, the access of rogue actors to our most intimate information is inevitable.”

The IFJ, echoed by the UK’s National Union of Journalists, highlighted three key takeaways for journalists and governments from the Pegasus leak.

It said journalists must redouble efforts to protect their data, with measures that could include using multiple phones including “burners”, while governments need to enshrine the inviolability of journalistic communications with legislation similar to laws on domestic surveillance.

The IFJ also called for a regulatory regime to be created for the international community to allow the inspection and regulation of any organisations doing work that could undermine such laws and freedoms.

‘Should be of concern to everyone’

At the New York Times the journalists thought to be affected were Azam Ahmed, a former Mexico City bureau chief who has reported on corruption, violence and surveillance in Latin America including on NSO, and Beirut bureau chief Ben Hubbard who has investigated rights abuses and corruption in Saudi Arabia and previously written about a hacking attempt against his phone.

Michael Slackman, the NYT’s assistant managing editor for international news, said: “Azam Ahmed and Ben Hubbard are talented journalists who have done important work uncovering information that governments did not want their citizens to know. Surveilling reporters is designed to intimidate not only those journalists but their sources, which should be of concern to everyone.”

In France, where France 24, Mediapart, Le Monde and Agence France-Presse were all thought to be affected, a government spokesperson described the reports as “extremely shocking”.

“We are extremely attached to freedom of the press, so it’s very serious if there were manipulations aiming to undermine the freedom of journalists, their freedom to investigate, to inform,” said Gabriel Attal according to France 24.

Reuters spokesperson Dave Moran said: “Journalists must be allowed to report the news in the public interest without fear of harassment or harm, wherever they are. We are aware of the report and are looking into the matter.”

Associated Press director of media relations Lauren Easton said: “We are deeply troubled to learn that two AP journalists, along with journalists from many news organizations, are among those who may have been targeted by Pegasus spyware.

“We have taken steps to ensure the security of our journalists’ devices and are investigating.”

A Bloomberg News spokesperson said: “The sort of surveillance being reported is an appalling violation of press freedoms and we strongly condemn it.”

Former Indian Express journalist Sushant Singh, whose number appeared in the list in mid-2018 when he was investigating a controversial deal for 36 fighter jets between the Indian government and a French aircraft manufacturer, said that, if true, it was a violation of his privacy.

He told The Wire: “Secondly, it compromises a journalist’s ability to report on matters of grave national importance in sensitive areas, particularly which require speaking truth to power,” he said.

“It creates an environment of fear and intimidation for both the journalist and her sources, placing them at grave risk. Moreover, it vitiates the reporting environment for the community of journalists if they fear being surveilled while discharging their bonafide duty.

“If the Fourth Estate can’t work in a healthy manner free of such extraneous pressure, institutions stand diminished and democracy eventually stands weakened.”

The UK’s Society of Editors said the allegations were “deeply concerning”.

“Governments with despicable records of press freedom have targeted media organisations, including many in the UK, with spyware that not only puts journalists at risk but also their confidential contacts and news sources,” it said.

“The Society of Editors will offer its support to investigative organisation, The Pegasus Project, to ensure unscrupulous regimes cannot curtail the activities of journalists, and to protect the freedom of the press worldwide.”

NSO: ‘Wrong assumptions’

NSO claimed the reporting was “full of wrong assumptions and uncorroborated theories”.

In particular it denied its technology being used to listen, monitor, track, or collect information about the murdered Saudi journalist Jamal Khashoggi or any of his family members.

“We would like to emphasize that NSO sells it technologies solely to law enforcement and intelligence agencies of vetted governments for the sole purpose of saving lives through preventing crime and terror acts,” it said.

Picture: FT