In 2016, Martin Ennals Human Rights Award winner Ahmed Mansoor of the UAE revealed how he was almost trapped by Pegasus, the spy software of NSO Group, which has a large presence in Luxembourg. Five years later, a new investigation reveals that nothing has changed in the surveillance of journalists. Photo: Martin Ennals Foundation

In 2016, Martin Ennals Human Rights Award winner Ahmed Mansoor of the UAE revealed how he was almost trapped by Pegasus, the spy software of NSO Group, which has a large presence in Luxembourg. Five years later, a new investigation reveals that nothing has changed in the surveillance of journalists. Photo: Martin Ennals Foundation

Five years after the University of Toronto’s Citizen Lab and Amnesty revealed that Israeli company NSO Group (operating in Luxembourg) was spying on Ahmed Mansoor, an investigation by Forbidden Stories and 17 media outlets shows how the Pegasus software was used to spy on dozens of journalists and politicians.

How many substantiated revelations will it take before governments and authorities meet this problem head on? Or do they, themselves, have an interest in the targeted surveillance of public figures, many of them journalists?

Five years after the first revelations of Amnesty International and the University of Toronto’s Citizen Lab, nothing has changed. On 10 and 11 August 2016, Ahmed Mansoor, an internationally recognised human rights defender based in the United Arab Emirates and winner of the  (sometimes referred to as the “Nobel Prize for Human Rights”), received text messages promising him new secrets about detainees being tortured in UAE prisons if he followed a link included in the text messages. Unfortunately for the NSO Group, which markets the Pegasus software, instead of clicking on the link Mr Mansoor transferred the text messages to the Citizen Lab at the University of Toronto, which published , without any ambiguity.

The Luxembourg government was alerted in 2019 to . Three of the founders of the investment company are still on the board of the latter, Stefan Kowski, Stephen Peel and Günter Schmid. The company has two “points of presence” in Luxembourg—Osy Technologies (2014) and the holding company that controls Q Cyber Technologies in Israel and Luxembourg (2016, 229 million turnover in 2019)—as well as presences in Cyprus (Iota Holdings) and the USA (Westbridge Technologies).

Five years later, on Monday 19 July, have been published. The project, entitled “Pegasus: the new global weapon for silencing journalists”, was coordinated by Forbidden Stories and done with a global consortium of more than 80 journalists from 17 media outlets in ten countries, with technical support from Amnesty International’s security lab.

A leak of 50,000 recordings

The investigation shows, based on a leak of 50,000 recordings, how at least 180 journalists in 20 countries were spied on by the Israeli company’s clients. “These government clients range from autocratic (Bahrain, Morocco and Saudi Arabia) to democratic (India and Mexico) and span the entire world, from Hungary and Azerbaijan in Europe to Togo and Rwanda in Africa,” explains the survey. “As the Pegasus Project will show, many of them have not been afraid to select journalists, human rights defenders, political opponents, businesspeople and even heads of state as targets of this invasive technology.”

“The figures clearly show that abuses are widespread, putting the lives of journalists, their families and associates at risk, undermining press freedom and shutting down critical media,” said Agnes Callamard, Amnesty International’s Secretary General. “It’s about controlling the public narrative, resisting scrutiny, suppressing any dissenting voice.”

As smartphones have evolved in recent years, texting has often been replaced by sending messages in WhatsApp, always with the same promise: juicy information for whoever clicks on the link in the same message. From the link, the organisers of this targeted surveillance could install their spying technology without the knowledge of the person who had clicked on it.

Thirty-eight cases of spyware identified

Since 2018, Amnesty International has been trying unsuccessfully to have the export licence for this technology cancelled. The Committee to Protect Journalists (CPJ) has documented 38 cases in which spyware—developed by software companies in four countries—has been used against journalists in nine countries since 2011.

When questioned as part of the investigation, the Israeli company denied any responsibility. Its words are even rather harsh with the findings. In a statement, it said: “NSO Group firmly denies false claims made in your report, many of which are uncorroborated theories that raise serious doubts about the reliability of your sources, as well as the basis of your story.”

Already in 2019, dei Lénk pointed out to Luxembourg’s Minister of Foreign Affairs, (LSAP), that it was not enough to claim to be a staunch defender of human rights, but that it was necessary to act. These new revelations put the pressure back on.

This article was originally published on . It has been translated and edited for Delano.