OPINION: NSO Group Spyware is the must-have tool for repressive governments

by Agnes Callamard | @AgnesCallamard | Amnesty International
Friday, 23 July 2021 15:16 GMT

An unidentified man using a smart phone walks through London's Canary Wharf financial district in the evening light in London, Britain, September 28, 2018. REUTERS/Russell Boyce TPX IMAGES OF THE DA

Image Caption and Rights Information

* Any views expressed in this opinion piece are those of the author and not of Thomson Reuters Foundation.

Spyware used to spy on people, what’s the big deal? Look who NSO Group’s clients are spying on – academics, lawyers, and activists. Who knows maybe even you?

Agnes Callamard is the Secretary General of Amnesty International

The unprecedented investigation into the leak of more than 50,000 phone numbers of world leaders, journalists, and activists around the world potentially targeted with spyware by NSO Group’s clients, blows wide open NSO’s claim that their spyware is only used to fight crime.

Whilst the ground-breaking reveal by Amnesty International and Forbidden Stories – a group of more than 80 journalists from media organizations around the world – poses stark questions for NSO Group and its clients, the bigger question is how we rein in the wild west of the spyware industry?

Pegasus, a fairly anodyne name for the flagship computer software of Israeli security NSO Group, has long been touted as a highly sophisticated cyberweapon wreaking havoc on human rights. Continued denunciations have been met with ludicrous denials and pious proclamations that that NSO Group’s ‘sole purpose’ is to provide foreign governments with hacking software to help them fight terrorism and serious crime.

The truth is that NSO has been operating in the shadows without conscience or accountability. This week, its surreptitious dealings have been brought into the light for all to see as Emmanuel Macron, Princess Latifa, amongst activists, journalists and lawyers, either appear in the cache of phone numbers or were actually targeted by the spyware.

Amnesty International’s Security Lab, who has conducted forensic tests on mobile phones, found that friends and family of Saudi journalist Jamal Khashoggi were targeted before and after his assassination. Shockingly, we also now know the spyware was installed on the phone of Khashoggi’s fiancé Hatice Cengiz, just four days after his murder.

Mexican journalist Cecilio Pineda’s phone was also selected for targeting, just weeks before he was killed. So far at least 188 journalists in 21 countries around the world were selected for targeting - and this is just the tip of the iceberg.  

Some may understandably presume– spyware used to spy on people, what’s the big deal? But they would be wrong. Just because spyware exists, and is used in combatting crime and terrorism, does not mean it can be used to spy on anyone and everyone. Look who NSO Group’s clients are spying on – academics, lawyers, and activists. Who knows maybe even you? It would be a stretch to call anyone in this group a hardened criminal.

Digital surveillance of this nature has a bone chilling effect. An innocuous SMS with a link is sent. Nothing untoward. Except, once the link is clicked, NSO’s client is granted access to the device. They have even found a way to install spyware on iPhones without you clicking on anything.  They can get access to the microphone, camera, your emails, and private chats. They can listen to your calls. They can watch you up close and personal.

Such digital surveillance violates the right to privacy, freedom of expression and freedom of the press, and the right to access information.  It threatens the rule of law and undermines key democratic principles. It is also a weapon used by governments to target individuals in the territory of another state, in violation of international law.

NSO cannot claim it did not know.  It has been warned repeatedly about surveillance-related violations carried out by clients using its software. Countries with a proven track record of violating human rights and silencing critical voices.  Yet NSO actively chose to supply these governments with its surveillance technology. As such NSO is complicit in the human rights violations carried out by these states and enabled by NSO Spyware.

The proliferation of this spyware means Pegasus is one of many outlaws in the wild west of cybersurveillance facilitating human rights violations.

We must take this industry by the reins. This starts with NSO Group immediately terminating the sale of Pegasus spyware in states with a track record of putting human rights defenders and journalists under unlawful surveillance.

The Israeli government should also revoke NSO Group's export licenses for this spyware, so it can no longer get into the hands of those who would use it for abusive targeting.

The real change will come if states impose a moratorium on the export and transfer of spyware equipment until a robust human rights-compliant regulatory framework is put in place.

But meanwhile we must grab all possible avenues to end these abuses, including through strategic litigation. Human rights defenders, journalists, Media outlets, politicians, human rights organisations: let’s ally forces, file complaints, litigate and hold NSO and others in the industry like them to account. We must demand and obtain reparations and remedies, and non-repetition.

Our Standards: The Thomson Reuters Trust Principles.