Spyware crisis continues after failure to clamp down on surveillance industry

One year after the Pegasus Project revelations, the lack of a global moratorium on the sale of spyware is allowing the surveillance industry to continue unchecked, Amnesty International warned today.

The Pegasus Project uncovered how governments worldwide were using NSO Group’s invasive Pegasus spyware to put human rights activists, political leaders, journalists and lawyers around the world under unlawful surveillance.

Following repeated calls for the surveillance industry to be regulated, some steps have been taken in the right direction – but government action has not yet been enough.

“One year after the Pegasus spyware revelations shocked the world, it is alarming that surveillance companies are still profiting from human rights violations on a global scale,” said Danna Ingleton, Amnesty Tech’s Deputy Director.

“The Pegasus Project offered a wake-up call that action was urgently needed to regulate an industry that is out of control. Shamefully, governments worldwide are yet to step up and fully deal with this digital surveillance crisis.

“Everyone targeted with NSO Group’s spyware has a right to remedy. Global governments’ failure to take meaningful action is an insult to all those who have suffered, physically and psychologically, after being targeted with this invasive software.

“The unlawful targeted surveillance of human rights defenders and civil society is a tool of repression. It is time to clamp down on this industry that continues to operate in the shadows.”

The Pegasus Project was a collaboration by journalists from 17 media organizations in 10 countries, coordinated by Forbidden Stories. Amnesty International’s Security Lab used cutting-edge digital forensic tests and research methodologies to confirm evidence of targeting and infections on scores of phones around the world.

In the last year, the Security Lab uncovered new instances of targeting using Pegasus in Morocco-Western Sahara and Poland. In addition, the Security Lab independently confirmed numerous additional cases where Pegasus was still being used to unlawfully target people, including cases in El Salvador, Israel/Occupied Palestinian Territories, Poland, and Spain.

Unlawful surveillance violates the right to privacy, and can also violate the rights to freedom of expression, opinion, association, and peaceful assembly.

‘A very violent form of censorship’
Amnesty International has been investigating unlawful surveillance for many years. There is mounting evidence of human rights violations being committed by governments, and how companies profit from unlawful targeted surveillance.
Every month, there are new cases confirmed of people being targeted with Pegasus. Amnesty International interviewed several people who had been infected with Pegasus, who told of their distress at being targeted.
Julia Gavarrete, a journalist in El Salvador, said: “It’s a shame that a powerful tool to combat criminals is being used to attack independent journalists and human rights defenders. It’s a shame that we have no clue about who was behind the targeting. It’s impossible not to feel angry when our entire life is at someone else’s hands, and there’s no answers about the responsibility of this.
“Being targeted led me to change my way of communicating, the places I used to go, and also to think twice about the type of information I want to share with others – not only because of my own security, but to protect the integrity of those who communicate with me. I have to be aware of the places we visit and try to be very careful every time we have our devices near…  As a journalist, I have to guard my sources, but as a woman, I need to protect my family and friends. Surveillance entails an indignity to our professional life and our private life.”
Hicham Mansouri, a Moroccan journalist living in France, described being targeted as “a very violent form of censorship, because we deprive ourselves of expressing ourselves on many subjects both in a professional and personal context”. He added: “That’s their goal: to make you paranoid, isolate you from people and lock you in a prison.”
Ongoing investigations
There are currently open investigations and cases pending against NSO Group in France, India, Mexico and Poland. In March, the European Parliament established the PEGA Committee to investigate the use of Pegasus and other spyware in Europe.
In November 2021, the United States’ government placed NSO Group on its Entity List, for “engaging in activities that are contrary to the national security or foreign policy interests”. Later that month, Apple filed a lawsuit against NSO Group to hold it accountable for the surveillance and targeting of Apple users.
In recent weeks, there have been reports that US defence contractor company L3Harris is in talks to buy ownership of Pegasus software. NSO Group’s future remains uncertain.
“Any attempt by NSO Group to alter its business model in a bid to evade accountability must be resisted. The entire surveillance industry is broken and needs urgent reform,” said Danna Ingleton.
“We continue to call for a global moratorium on the sale, transfer and use of spyware until human rights regulatory safeguards that govern its use are in place.”
States have binding obligations under international law to not only respect human rights, but also to protect them from abuse by third parties, including private companies.