The Pegasus spyware scandal

In the last month or so, there were four major heat waves in the western part of the United States with record triple-digit temperatures in Oregon and Washington that caused hundreds of heat-related deaths. This extreme temperature has also resulted in hundreds of thousands of acres of forest fires in California and Oregon in the United States, and British Columbia in Canada. The fires were so massive that smoke travelled all the way to the East Coast and turned the skies above New York City hazy and red. During this week, heat waves are expected to continue. Scientists have long predicted that higher temperatures would lead to more heat waves and droughts in some areas as well as bigger and more frequent wildfires.

In Germany, Belgium and the Netherlands, at least 180 people were killed when two months’ worth of rain fell in two days, causing floods and mudslides, while in  Chinese province of Henan, at least 33 people died when they were trapped on a subway during the floods. The United Nations has warned that the world needs to triple promised reductions in carbon emissions to limit global warming to two degrees Celsius to prevent dire consequences, including famine and widespread flooding. However, instead of cutting fossil fuel production, countries are planning to increase production. There is now no denying that the extraction and burning of fossil fuels are the main contributors for global warming and climate change.

Indonesia has become the new epicenter of the COVID-19 pandemic, surpassing India and Brazil to become the country with the world’s highest count of new infections. Thousands of people infected by the virus sleep in hallways, tents and cars, gasping for air as they wait for beds in overcrowded hospitals. The surge is part of a wave across Southeast Asia, where vaccination rates are low​. Vietnam, Malaysia, Myanmar and Thailand are also facing their largest outbreaks and have imposed new restrictions, including lockdowns and stay-at-home orders. Only about 15 percent of Indonesia’s 270 million people have received a dose of a coronavirus vaccine, and just six percent are fully inoculated.

Now for today’s article. An Israeli company has developed a spy software that is capable of extracting personal data from one’s computer or mobile phone, including recording live audio and video, without the knowledge and consent of the person. The company maintains that its technology is intended for use only against criminals and terrorists. However, there is evidence that the Pegasus spyware, as it is known, has been used by some governments to target journalists, activists and political opponents.

Spyware in general

Spyware is the shortened version for spying software which generally is an unwanted and malicious software designed to enter one’s computer device, gather data about the person, and forward it to a third-party without his/her consent. The data can include passwords, personal identification numbers (PINs), payment information and other sensitive data. It is a type of malware that infiltrates not only computer browsers but also mobile phones, and is the most serious threat to the internet. In recent years, mobile spyware attacks have become much more common, as people rely on their phones to conduct banking activities and all forms of communication.

Spyware can refer to legitimate software that monitors one’s data for commercial purposes, such as advertising. It can also be used by government and law enforcement agencies to gather information about an individual’s online behavior and activity. Spyware typically runs in the background of the operating system. It is difficult to detect and even harder to mitigate without advanced security tools and solutions.

The Pegasus spyware

The Pegasus spyware is made and licensed by Israeli company NSO, a cyber security firm. According to NSO, the spyware is intended only for use by vetted government intelligence and law enforcement agencies to fight terrorism and crime. Some 40 countries have been using Pegasus, including Hungary, Bahrain, Kazakhstan, Mexico, Morocco, Saudi Arabia and the United Arab Emirates (UAE).

Pegasus was developed some ten years ago by Israeli ex-cyberspies. The Israeli Defense Ministry must approve any license to a government that wants to buy it. The spyware is to be used for lawful purposes only, mainly for preventing and investigating crime and counterterrorism.

The Washington Post report on the Pegasus spyware

Last week, it was reported that a military-grade spyware leased by the Israeli firm NSO to governments for tracking terrorists and criminals, was used to access smartphones belonging to journalists, human rights activists, business executives and the two women closest to murdered Saudi journalist Jamal Khashoggi. The investigation was carried out by The Washington Post and 16 media partners led by the Paris-based journalism non-profit Forbidden Stories.

Forbidden Stories and Amnesty International had access to a list of more than 50,000 phone numbers of persons around the world which they shared with news organizations. Amnesty’s Security Lab did forensic examination of the phone numbers, and the results of the research and analysis showed that even important public figures such as French President Emmanuel Macron and European Council President Charles Michel were found to be on the list. The phone numbers are concentrated in countries that are known to engage in surveillance of their citizens and have been the clients of NSO. The greatest number was in Mexico where some 15,000 phones were listed. The list does not indicate who was responsible for putting the numbers together. NSO has denied any involvement in the compilation of the list.

The forensic analysis of 37 smartphones showed that time stamps associated with a number and the initiation of the surveillance were very close, sometimes as brief as a few seconds. Additionally, 23 of these were successfully infected while the remaining 14 showed signs of attempted penetration. The research and analysis also revealed that 1,000 persons from at least 50 countries were the targets. These include several Arab royal family members, at least 65 business executives, 85 human rights activists, 189 journalists, more than 600 politicians and government officials, and heads of state and prime ministers. Among the journalists whose numbers appear on the list are reporters working overseas for several leading news agencies, including CNN, the Associated Press, Voice of America, the New York Times, the Wall Street Journal, Bloomberg News, Le Monde in France, the Financial Times in London, and Al Jazeera in Qatar.

In response, NSO stated that it cares about journalists and activists and civil society in general; in some circumstances its customers might misuse the system; where such is the case, systems are shut down; and over the last 12 months, two contracts were terminated because of human rights abuses.  The investigation, however, found many of the phone numbers from at least ten countries that were the subject of deeper analysis, including Azerbaijan, Bahrain, Hungary, India, Kazakhstan, Mexico, Morocco, Rwanda, Saudi Arabia and UAE. All ten have been NSO’s clients. After the investigation began, several reporters learned that they or their families have been successfully attacked by Pegasus spyware.

A large share of the numbers was from the Middle East. In India, the phone numbers of hundreds of journalists, activists, opposition politicians, government officials and business executives were on the list. Also on the list were phone numbers from Azerbaijan, Kazakhstan and Pakistan. More than 1,000 numbers are from France.

Critics are of the view that the widespread use of spyware has emerged as a leading threat to democracies worldwide. They argue that journalists under surveillance cannot safely gather sensitive news without endangering themselves and their sources. Additionally, opposition politicians cannot plot their campaign strategies without those in power anticipating their moves. Human rights workers also cannot work with vulnerable people — some of whom are victims of their own governments — without exposing them to renewed abuse.

According to Timothy Summers, a former cybersecurity engineer at a U.S. intelligence agency and now director of IT at Arizona State University, Pegasus is a “nasty” software. With it, ‘one could spy on almost the entire world population. … But humanity is not in a place where we can have that much power just accessible to anybody’. Edward Snowden, former CIA agent who leaked critical information from the U.S. National Security Agency, considered the magnitude of Pegasus scandal shocking. He stated that the entire cybersecurity industry is based on the lie of claiming to protect people, but in reality it uses covert tools to spy on innocent people unjustifiably. 

Following the Washington Post report, Pakistan has called on the United Nations to investigate whether India used Pegasus to spy on public figures, including Prime Minister Imran Khan. Pakistan’s foreign office issued a statement accusing India of ‘state-sponsored, continuing and widespread surveillance and spying operations in clear breach of global norms of responsible state behaviour’. The Indian government has already been accused of spying on its own officials, including the Opposition Leader, Rahul Gandhi. Meanwhile, French President Emmanuel Macron is expected to hold a special Cabinet meeting to discuss the investigation into the Pegasus spyware.

We conclude our article by providing the latest statistics about COVID-related deaths rates in selected countries (in order from the most serious):