CHAPTER 13: “CAN YOU SIT ON YOUR PHONE?”

  1. “COVID-19: Ontario Now under Provincewide ‘Shutdown’ to Control Spread of Virus,” Global News, April 3, 2021, https://globalnews.ca/news/7736868/covidontario-provincewide-shutdown/ (archive: perma.cc/5VQ6-WW3X).

  2. Laurent Richard and Sandrine Rigaud, Pegasus: How a Spy in Your Pocket Threatens the End of Privacy, Dignity, and Democracy (New York: Henry Holt, 2023).

  3. “Pegasus Project,” Forbidden Stories, accessed May 6, 2024, https://forbiddenstories.org/case/the-pegasus-project/.

  4. “The Pegasus Project,” Guardian, accessed May 20, 2024, https://www.theguardian.com/news/series/pegasus-project; “Takeaways from the Pegasus Project,” Washington Post, August 2, 2021, https://www.washingtonpost.com/investigations/202107/18/takeaways-nso-pegasus-project/.

  5. Bill Marczak, John Scott-Railton, Siena Anstis, and Ron Deibert, “Independent Peer Review of Amnesty International’s Forensic Methods for Identifying PegasusSpyware,” Citizen Lab, University of Toronto, July 18, 2021, https://citizenlab.ca2021/07/amnesty-peer-review/; Forensic Methodology Report: How to Catch NSO Group’s Pegasus, Amnesty International, July 18, 2021, https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/ (archive: perma.cc/VA4J-DVJG).

  6. David Pegg and Sam Cutler, “What Is Pegasus Spyware and How Does It Hack Phones?,” Guardian, July 18, 2021, https://www.theguardian.com/news/2021/jul/18/what-is-pegasus-spyware-and-how-does-it-hack-phones (archive: perma.cc/9UZD-V68D).

  7. Joseph Cox, “Here’s the FBI’s Internal Guide for Getting Data from AT&T, T- Mobile, Verizon,” Vice, October 25, 2021, https://www.vice.com/en/article/m7vqkv/how-fbi-gets-phone-data-att-tmobile-verizon (archive: perma.cc/3C3T-PB6C).

  8. Brigitte Bureau, Catherine Cullen, and Kristen Everson, “Hackers Only Needed a Phone Number to Track This MP’s Cellphone,” CBC News, November 22, 2017, https://www.cbc.ca/news/politics/hackers-cellphone-security-1.4406338 (archive: perma.cc/Z5W7-UG5E).

  9. Stephanie Kirchgaessner, “NSO Offered US Mobile Security Firm ‘Bags of Cash,’ Whistleblower Claims,” Guardian, February 1, 2022, https://www.theguardian.com/news/2022 /feb/01 /nso-offered-us-mobile-security-firm-bags-of-cashwhistleblower-claims.

  10. Gary Miller and Christopher Parsons, Finding You: The Network Effect of Telecommu- nications Vulnerabilities for Location Disclosure, Research Report No. 171, Citizen Lab, University of Toronto, October 26, 2023, https://citizenlab.ca/2023/10/finding-you-teleco-vulnerabilities-for-location-disclosure/ (archive: perma.cc/3ARG-FUPK); Ronald J. Deibert and Gary Miller, “When You Roam, You’re Not Alone,” Lawfare, December 28, 2023, https://www.lawfaremedia.org/article/when-you-roam-you-re-not-alone (archive: perma.cc/A2PZ-3KX6).

  11. Dana Priest, Craig Timberg, and Souad Mekhennet, “Private Israeli Spyware Used to Hack Cellphones of Journalists, Activists Worldwide,” Washington Post, July 18, 2021, https://www.washingtonpost.com/investigations/interactive/2021/nso-spyware-peg asus-cellphones/.

  12. Stephanie Kirchgaessner, Paul Lewis, David Pegg, Sam Cutler, Nina Lakhani, and Michael Safi, “Revealed: Leak Uncovers Global Abuse of Cyber-Surveillance Weapon,” Guardian, July 18, 2021, https://www.theguardian.com/world/2021/jul/18/revealed-leak-uncovers-global-abuse-of-cyber-surveillance-weapon-nso-group-pegasus (archive: perma.cc/Z3UC-MBUX); Nina Lakhani, “Fifty People Linked to Mexico’s President among Poten- tial Targets of NSO Clients,” Guardian, July 19, 2021, https://www.theguardian.com/news/2021/jul/19/fifty-people-close-mexico-president-amlo-among-potentialtargets-nso-clients; Craig Timberg, Michael Birnbaum, Drew Harwell, and Dan Sabbagh, “On the List: Ten Prime Ministers, Three Presidents and a King,” Washington Post, July 20, 2021, https://www.washingtonpost.com/world/2021/0720/heads-of-state-pegasus-spyware/; Diana Moukalled, “UAE: Israel’s (Pegasus) Spyware in the Service of Autocracy,” Daraj, July 18, 2021, https://daraj.media/en/76524/ (archive: perma.cc/FT29-Q84X).

  13. Kirchgaessner et al., “Revealed: Leak Uncovers Global Abuse.”

  14. Kirchgaessner et al., “Revealed: Leak Uncovers Global Abuse.”

  15. Stephanie Kirchgaessner, “Saudis behind NSO Spyware Attack on Jamal Khashog- gi’s Family, Leak Suggests,” Guardian, July 18, 2021, https://www.theguardian.com/world/2021/jul/18/nso-spyware-used-to-target-family-of-jamal-khashoggi-leaked-data-shows-saudis-pegasus (archive: perma.cc/3FSG-W7SU).

  16. Dana Priest, “A UAE Agency Put Pegasus Spyware on Phone of Jamal Khashog- gi’s Wife Months before His Murder, New Forensics Show,” Washington Post, December 21, 2021, https://www.washingtonpost.com/nation/interactive/2021/ hanan-elatr-phone-pegasus/.

  17. Shaun Walker, “Viktor Orbán Using NSO Spyware in Assault on Media, Data Suggests,” Guardian, July 18, 2021, https://www.theguardian.com/news/2021/jul/18/viktor-orban-using-nso-spyware-in-assault-on-media-data-suggests (archive: perma.cc/C4FB-UYJM).

  18. “Szabolcs Panyi,” Forbidden Stories, accessed May 20, 2024, https://web.archive.org/web/20240225030323/https://forbiddenstories.org/journaliste/szabolcs-panyi/.

  19. Szabolcs Panyi and András Pethö, “Hungarian Journalists and Critics of Orbán Were Targeted with Pegasus, a Powerful Israeli Cyberweapon,” Direkt36, July 19, 2021, https://www.direkt36.hu/en/leleplezodott-egy-durva-izraeli-kemfegyver-az-orban-kormany-kritikusait-es-magyar-ujsagirokat-is-celba-vettek-vele/ (archive: perma.cc/D6SH-CQVU).

  20. Forensic Methodology Report: Pegasus Forensic Traces per Target, Amnesty Interna- tional, July 18, 2021, https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-appendix-d/ (archive: perma.cc/62PY-AF3R).

  21. Shaun Walker, “Classes Move to Vienna as Hungary Makes Rare Decision to Oust University,” Guardian, November 16, 2019, https://www.theguardian.com/world/2019/nov/16/ceu-classes-move-to-vienna-orban-hungary-ousts-university (archive: perma.cc/P7QS-YNSD).

  22. Michael Birnbaum, Andras Petho, and Jean-Baptiste Chastand, “In Orban’s Hungary, Spyware Was Used to Monitor Journalists and Others Who Might Challenge the Government,” Washington Post, July 19, 2021, https://www.washingtonpost.com/world/2021/07/18/hungary-orban-spyware/.

  23. Walker, “Viktor Orbán Using NSO Spyware.”

  24. Anuj Srivas and Kabir Agarwal, “Snoop List Has 40 Indian Journalists, Forensic Tests Confirm Presence of Pegasus Spyware on Some,” Wire, July 18, 2021, https://thewire.in/media/pegasus-project-spyware-indian-journalists (archive: perma.cc/7SVR-XGTJ).

  25. Ajoy Ashirwad Mahaprashasta, Sukayna Shantha, and Kabir Agarwal, “Days after Accusing CJI Gogoi of Sexual Harassment, Staffer Put on List of Potential Snoop Targets,” Wire, July 19, 2021, https://thewire.in/rights/ranjan-gogoi-sexualharassment-pegasus-spyware (archive: perma.cc/42S4-MJMS).

  26. Michael Safi, “Key Modi Rival Rahul Gandhi among Potential Indian Targets of NSO Client,” Guardian, July 19, 2021, https://www.theguardian.com/news/2021/jul/19/key-modi-rival-rahul-gandhi-among-indian-targets-of-nso-client (archive: perma.cc/NPC9-LU3U).

  27. Siddharth (@svaradarajan), “Not just another day at the office for @thewire_in after #PegasusProject Policeman arrived today with inane inquiries. ‘Who’s Vinod Dua?’ ‘Who’s Swara Bhaskar?’ ‘Can I see your rent agreement?’ ‘Can I speak to Arfa?’ Asked why he’d come: ‘Routine check for Aug 15’ Strange,” X, July 23, 2021, https://x.com/svaradarajan/status/1418513671764865024 (archive: perma.cc/3MDL-ZWWH).

  28. Srivas and Agarwal, “Snoop List Has 40 Indian Journalists.”

  29. See, for example, Bill Marczak, Adam Hulcoop, Etienne Maynier, Bahr Abdul Razzak, Masashi Crete-Nishihata, John Scott-Railton, and Ron Deibert, Missing Link: Tibetan Groups Targeted with 1-Click Mobile Exploits, Research Report No. 123,Citizen Lab, University of Toronto, September 24, 2019, https://citizenlab.ca/201909/poison-carp-tibetan-groups-targeted-with-1-click-mobile-exploits/ (archive: perma.cc/F62Q-UXN3).

  30. Michael Safi, “Dalai Lama’s Inner Circle Listed in Pegasus Project Data,” Guardian, July 22, 2021, https://www.theguardian.com/news/2021/jul/22/dalai-lama-inner-circle-listed-pegasus-project-data (archive: perma.cc/T3HP-6MKK).

  31. David Pegg, Paul Lewis, Michael Safi, and Nina Lakhani, “FT Editor among 180 Journalists Identified by Clients of Spyware Firm,” Guardian, July 20, 2021, https://www.theguardian.com/world/2021/jul/18/ft-editor-roula-khalaf-among-180-journalists-targeted-nso-spyware (archive: perma.cc/Q73T-GMNU); Miranda Patrucic and Kelly Bloss, “Life in Azerbaijan’s Digital Autocracy: ‘They Want to Be in Control of Everything,’” OCCRP, July 18, 2021, https://www.occrp.org/en/the-pegasus-project/life-in-azerbaijans-digital-autocracy-they-want-to-be-in-control-of-everything.

  32. “Spyware: Governments Can Hack into Your Phone while You Sleep,” Amnesty International, September 26, 2023, https://amnesty.ca/human-rights-news/spyware-governments-can-hack-into-your-phone-while-you-sleep/ (archive: perma.cc/4S5K-CZ3E).

  33. Giorgi Lomsadze, “Azerbaijan Reporter Wins Sex Tape Case,” Eurasianet, January 11, 2019, https://eurasianet.org/azerbaijan-reporter-wins-sex-tape-case.

  34. Kim Willsher, “Pegasus Spyware Found on Journalists’ Phones, French Intelligence Confirms,” Guardian, August 2, 2021, https://www.theguardian.com/news/2021/aug/02/pegasus-spyware-found-on-journalists-phones-french-intelligence-confirms (archive: perma.cc/M4BA-RAFL).

  35. “French Prosecutors Open Probe into Alleged Use of Pegasus Malware to Spy on Journalists,” France 24, July 20, 2021, https://www.france24.com/en/europe20210720-french-prosecutors-open-probe-into-alleged-use-of-pegasus-malwareto-spy-on-journalists.

  36. Lisa O’Carroll, “Draft EU Plans to Allow Spying on Journalists Are Dangerous, Warn Critics,” Guardian, June 22, 2023, https://www.theguardian.com/world/2023/jun/22/draft-eu-plans-to-allow-spying-on-journalists-are-dangerous-warn-critics (archive: perma.cc/S55N-JWZN).

  37. Nina Lakhani, “Revealed: Murdered Journalist’s Number Selected by Mexican NSO Client,” Guardian, July 18, 2021, https://www.theguardian.com/news/2021/jul/18/revealed-murdered-journalist-number-selected-mexico-nso-client-cecilio-pineda-birto (archive: perma.cc/MA48-RLBZ).

  38. Lakhani, “Fifty People Linked to Mexico’s President”; Timberg et al., “On the List.”

  39. Lakhani, “Fifty People Linked to Mexico’s President.”

  40. Natalie Kitroeff and Ronen Bergman, “Mexican President Said He Told Ally Not to Worry about Being Spied On,” New York Times, May 23, 2023, https://www.nytimes.com/2023/05/23/world/americas/mexico-president-spying-pegasus.html (archive: perma.cc/Y4A2-BK6Q); Daina Beth Solomon, “Pegasus Spyware Attacks in Mexico Continued under Lopez Obrador, Report Says,” Reuters, October 2, 2022, https://www.reuters.com/world/americas/pegasus-spyware-attacks-mexico-continued-under-lopez-obradorreport-2022-10-03/.

  41. Bill Marczak, John Scott-Railton, Sarah McKune, Bahr Abdul Razzak, and Ron Deibert, Hide and Seek: Tracking NSO Group’s Pegasus Spyware to Operations in 45 Countries, Research Report No. 113, Citizen Lab, University of Toronto, September 18, 2018, https://citizenlab.ca/2018/09/hide-and-seek-tracking-nso-groups-pegasus-spyware-to-operations-in-45-countries/ (archive: perma.cc/G4DD-YL6J); Joe Tidy, “‘I Was a Victim of the WhatsApp Hack,’” BBC, October 31, 2019, https://www.bbc.comnews/technology-50249859.

  42. Jennifer Hansler, Bethlehem Feleke, Mostafa Salem, and Jack Guy, “‘Hotel Rwanda’ Hero to Be Freed after 25-Year Terrorism Sentence Commuted,” CNN, March 24, 2023, https://www.cnn.com/2023/03/24/africa/paul-rusesabagina-released-rwanda-intl/index.html (archive: perma.cc/38E6-GTN7).

  43. Stephanie Kirchgaessner, “Hotel Rwanda Activist’s Daughter Placed under Pegasus Surveillance,” Guardian, July 19, 2021, https://www.theguardian.com/news/2021/jul/19/hotel-rwanda-activist-daughter-pegasus-surveillance (archive: perma.cc/2N79-LXB8).

  44. Michela Wrong, “Rwandans Have Long Been Used to Pegasus-Style Surveillance,” Guardian, July 23, 2021, https://www.theguardian.com/commentisfree/2021/jul/23/rwanda-pegasus-surveillance (archive: perma.cc/59VB-LJ2X).

  45. “Princess Latifa and Princess Haya Listed as Potential Targets by Clients of Spyware Company NSO Group,” Amnesty International, July 21, 2021, https://www.amnesty.org/en/latest/press-release/2021/07/pegasus-project-nso-spyware-princess-latifaprincess-haya/.

  46. Dan Sabbagh, “Data Leak Raises New Questions over Capture of Princess Latifa,”uardian, July 21, 2021, https://www.theguardian.com/world/2021/jul/21/data-leak-raises-new-questions-over-capture-of-princess-latifa (archive: perma.cc/HM6W-EK4U).

  47. Sabbagh, “Data Leak Raises New Questions.”

  48. Sabbagh, “Data Leak Raises New Questions.”

  49. Timberg et al., “On the List.”

  50. Pete Jones, Vyacheslav Abramov, and Miranda Patrucic, “World Leaders on Pegasus List Include France’s President Macron, Morocco’s King Mohammed, Kazakhstan’s President,” OCCRP, July 20, 2021, https://www.occrp.org/en/the-pegasus-project/world-leaders-on-pegasus-list-include-frances-president-macron-moroccos-king-mohammed-kazakhstans-president-tokayev (archive: perma.cc/Y46G-E38M).

  51. Craig Timberg, John Hudson, and Kristof Clerix, “Key Question for Amer- icans Overseas: Can Their Phones Be Hacked?,” Washington Post, July 19, 2021, https://www.washingtonpost.com/national-security/2021/07/19/us-phone-num bers-nso/.

  52. Kylie Atwood, Alex Marquardt, Jeremy Herb, and Zachary Cohen, “Biden’s Iran Envoy Placed on Leave after Security Clearance Suspended amid Investigation into Possible Mishandling of Classified Material, Sources Say,” CNN, June 29, 2023, https://www.cnn.com/2023/06/29/politics/rob-malley-leave-investigation-classified-material/index.html (archive: perma.cc/4SWK-M2WV).

  53. Steven Feldstein, “Biden Cracks Down on the Spyware Scourge,” Foreign Policy, July 31, 2023, https://foreignpolicy.com/2023/07/31/spyware-nso-cytrox-intellexa-pegasus-predator-biden-sanctions-entities-list-israel-europe/ (archive: perma.cc/YG7E-E3ZL).

  54. “Enough Is Enough!,” NSO Group, accessed May 10, 2024, https://www.nsogroup.com/Newses/enough-is-enough/.

  55. Omer Kabir and Hagar Ravet, “NSO CEO Exclusively Responds to Allegations: ‘The List of 50,000 Phone Numbers Has Nothing to Do with Us,’” CTech, July 20, 2021, https://www.calcalistech.com/ctech/articles/0,7340,L-3912882,00.html.56 (archive: perma.cc/P4XU-LZNX). Stephanie Kirchgaessner, “Officials Who Are US Allies among Targets of NSO Malware, Says WhatsApp Chief,” Guardian, July 24, 2021, https://www.theguardiancom/technology/2021/jul/24/officials-who-are-us-allies-among-targets-of-nsomalware-says-whatsapp-chief.

  56. “About the Project,” OCCRP, July 18, 2021, https://www.occrp.org/en/the-pegasusproject/about-the-project; “About the Pegasus Project,” Forbidden Stories, July 18, 2021, https://forbiddenstories.org/about-the-pegasus-project/ (archive: perma.cc/8MM5-5M52).

  57. Stephanie Kirchgaessner and Sam Jones, “Phone of Top Catalan Politician ‘Targeted by Government-Grade Spyware,’” Guardian, July 13, 2020, https://www.theguardian.com/world/2020/jul/13/phone-of-top-catalan-politician-targeted-bygovernment-grade-spyware (archive: perma.cc/9CRS-G349).