Pegasus was the brainchild of the Israeli-based cyber surveillance firm NSO Group, which the Guardian report accused of purveying "weapons of mass surveillance." NSO Group denied the allegation, saying that only carefully vetted government intelligence and law enforcement agencies can use the program. It added that Pegasus is only used to surveil the phones of "legitimate criminal or terror group targets."
The Guardian partnered with Amnesty International's Security Lab to conduct forensic analysis on dozens of smartphones owned by potential targets. The lab's analysis found evidence of Pegasus activity in more than half of examined smartphones. According to a BBC report, Pegasus infected both iPhones and Android devices. Once installed, it allowed remote operators to extract messages, photos and emails, record calls and secretly activate microphones and cameras.
The smartphone of Mexican journalist Carmen Aristegui was among those that contained signs of Pegasus activity, with her number also included in the NSO Group data leak. Aristegui got into the crosshairs of the Mexican authorities after she exposed a corruption scandal involving former Mexican President Enrique Pena Nieto.
The data leak also suggested that Mexican authorities did not stop at monitoring Aristegui alone. The phone numbers of her assistant and at least four other fellow journalists also appeared in the leak. Her sister and 16-year-old son were also included in the surveillance effort.
Another Mexican journalist, Cecilio Pineda Birto, was included in the leak – with his number appearing twice. Birto, a freelance journalist, was murdered in March 2017 following his exposure of a corruption scandal.
The same report said that people close to murdered Saudi journalist Jamal Khashoggi were also targeted using Pegasus. Spyware was installed on the phone of Khashoggi's fiancee days after his October 2018 murder, and his wife's phone was targeted with spyware between September 2017 and April 2018.
The BBC added that the phones of Hungarian investigative Journalists Andras Szabo and Szabolcs Panyi had been successfully infected with the spyware. Panyi lamented that learning about his phone being hacked was "devastating." He said: "There are some people in this country who consider a regular journalist as dangerous as someone suspected of terrorism."
The spyware attacks were not limited to journalists alone. Lawyers, human rights defenders, religious and academic figures, businesspeople and senior government officials were also surveilled using spyware on their phones. In India, more than 40 journalists and two ministers in Prime Minister Narendra Modi's government were included in the list. Three opposition leaders were also part of the list – including key opposition figure Rahul Gandhi, whose two mobile numbers appeared in the leak.
Both the Hungarian and Indian governments denied using unauthorized surveillance. A Hungarian government spokesperson told the Guardian that Budapest was "not aware of any alleged data collection."
Back in June 2019, UN Special Rapporteur on Freedom of Expression David Kaye called for a moratorium on the sale of spyware such as Pegasus to governments until viable export controls could be put in place. "Surveillance tools can interfere with human rights – from the right to privacy and freedom of expression to rights of association and assembly, religious belief, non-discrimination and public participation. And yet they are not subject to any effective global or national control," he said that time.
Kaye also warned that the private surveillance industry was "out of control, unaccountable and unconstrained" in providing governments with low-cost spying tools previously only available to the most advanced state intelligence services. He also warned that surveillance technologies cause "immediate and regular harm to individuals and organizations that are essential to democratic life."
Unfortunately, Kaye's warnings were ignored and the sale of surveillance tools such as Pegasus continued unabated.
The Guardian report noted that many pro-surveillance advocates insisted that innocent people were safe from illegal surveillance. Some of these advocates argued that citizens who have done nothing wrong have nothing to fear. However, the article noted that the Pegasus project "is likely to put an end to any such wishful thinking."
The British newspaper's report ultimately remarked: "Law-abiding people … are not immune from unwarranted surveillance. [In addition,] western countries do not have a monopoly on the most invasive surveillance technologies. We're entering a new surveillance era, and unless protections are put in place – none of us are safe."
Surveillance.news has more stories about authorities illegally monitoring citizens using Pegasus and other surveillance tools.