The fallout from an investigation into the use of an Israeli firm’s Pegasus spyware deepened on July 20 as it emerged that more than a dozen current or former world leaders appear to be among thousands of potential targets.
Pakistani Prime Minister Imran Khan, Kazakh President Qasym-Zhomart Toqaev, and French President Emmanuel Macron were among 14 current or former world leaders who may have been targeted for hacking by clients of the Israeli spyware firm NSO Group, according to Amnesty International and a consortium of 17 global media organizations investigating the scandal.
Presidents Cyril Ramaphosa of South Africa, Barham Salih of Iraq, and the king of Morocco, Mohammed VI, are also on the list, consortium members including The Washington Post reported.
The world leaders’ phone numbers were found on a list of 50,000 phone numbers believed to have been identified as people of interest by clients of the NSO Group since 2016.
The files were leaked to Amnesty and the Paris-based journalism nonprofit Forbidden Stories, which shared the information with the global media consortium that began publishing their investigative reports on July 18.
The list of identified names includes 189 journalists, more than 600 politicians and government officials, at least 65 business executives, 85 human rights activists, and several heads of state, according to The Washington Post. The journalists work for organizations including Radio Free Europe/Radio Liberty, The Associated Press, Reuters, CNN, The Wall Street Journal, Le Monde, and the Financial Times.
"We have long known that activists and journalists are the targets of this surreptitious phone hack -- but even those at the highest levels of power cannot escape the grim spread of NSO spyware," Amnesty head Agnes Callamard wrote on Twitter.
"Pegasus is a weapon that threatens rights and freedoms, justice, and the rule of law. It is also a weapon used by governments to target individuals in the territory of another state," she added.
A number of autocratic regimes but also democratic governments used NSO’s Pegasus to hack the smartphones of journalists, officials, and rights activists worldwide.
NSO Group clients included the governments of Azerbaijan, Bahrain, Hungary, India, Indonesia, Kazakhstan, Mexico, Morocco, Rwanda, Saudi Arabia, Togo, and the United Arab Emirates, according to reports by the consortium.
As blistering reports emerge, NSO has denied any wrongdoing.
The private firm says that its software is intended for use against criminals and terrorists and is made available only to military, law enforcement, and intelligence agencies from countries with good human rights records.
While a phone number’s presence in the data does not mean an attempt was made to hack a device, the consortium said it believed the data indicated potential targets of NSO’s government clients.
Most political leaders appeared to have been selected for being potentially hacked by rival states, although in some cases, such as in Kazakhstan, they may have been selected by a source within their own countries.
Among the top officials on the list in Kazakhstan were Toqaev, the country’s current president, and Prime Minister Asqar Mamin. Bakytzhan Sagintayev, the prime minister until February 2019, was also selected. It is unclear whether their phones were actually hacked using the spyware or if they were just identified as targets.
Toqaev wasn't president at the time in question, which took place in 2017 and 2018. But he was the No. 2 to the country’s longtime ruler, Nursultan Nazarbaev, who handpicked him as his successor in March 2019.
Evidence from the phone records also indicates that Pakistan’s prime minister was selected by rival India, the consortium reported. It was unclear if the potential spying on Khan continued after he became prime minister in 2018.
In India, the scandal has also touched nerves as the opposition calls for an investigation into reports of snooping on politicians with the Israeli-made software.
Shaktisinh Gohil, a spokesman of the main opposition Congress party, said Prime Minister Narendra Modi's government should clearly say whether it used Pegasus to spy on dozens of politicians, journalists, activists, and critics.
The identities behind around 300 numbers were verified by the international consortium and included Modi's main political rival, Rahul Gandhi of Congress. The Indian government denied the allegations.
In France, prosecutors opened an investigation into allegations that journalists of a local investigative news website had been spied on using the Pegasus program.
The French probe will examine 10 different charges, including whether there was a breach of personal privacy, fraudulent access to personal electronic devices, and criminal association, the Paris prosecutor's office said on July 20.
The probe took on ever greater urgency after the newspaper Le Monde reported on July 20 that Macron and several other senior government officials were targeted for potential surveillance on behalf of Morocco.
The announcement of the investigation comes a day after the website Mediapart filed a legal complaint, accusing Morocco's secret services of having used the spyware to tap into the mobile phones of two of its reporters.
Morocco rejected what it called "unfounded and false allegations."
Paris-based Reporters Without Borders (RSF) and two journalists with French and Moroccan dual nationality also filed a joint complaint with prosecutors on July 20, calling on them to “identify those responsible and their accomplices” for the targeted harassment of the journalists.
RSF said in a statement that it intends to file similar complaints in other countries together with targeted journalists.
“We will do everything to ensure that NSO Group is convicted for the crimes it has committed and for the tragedies it has made possible,” RSF Secretary-General Christophe Deloire said.
Hungarian opposition lawmakers have also called for an inquiry into reports that Prime Minister Viktor Orban's right-wing government may have used the powerful malware to spy on critical journalists, politicians, and business figures.
Direkt36, a Hungarian investigative-journalism outlet, revealed that the phones of more than 300 Hungarian nationals were identified as possible targets for infection. Amnesty said its experts had confirmed several cases where the spyware was successfully installed.
“The Hungarian government should immediately provide a meaningful response to this latest revelation by the Pegasus Project and clarify whether it knew about or approved the covert surveillance of journalists, businessmen, and others,” David Vig, director of Amnesty Hungary, said in a statement. “Hungary’s surveillance practices have long been a matter of concern.”
Orban has been accused by the EU of flouting democracy with a series of laws seen as curtailing a free press and human rights. His government, however, has denied any use of the Pegasus software "in any way."
Pegasus infects iPhones and Android devices to enable operators to secretly record phone calls, access text messages, photos, e-mails, and passwords, track GPS data, and activate microphones and cameras.
