Hungary Using Pegasus Spyware to Track Journalists
Hungary is among governments around the world using Pegasus spyware developed by Israel-based NSO Group to keep tabs on journalists, activists and political dissidents, an investigation by a consortium of media groups has revealed.
Prime Minister Viktor Orban's hardline government, which has taken a range of repressive measures against independent media, has deployed the technological tool that can extract information about users from even the latest mobile phones.
More than 300 Hungarian phone numbers connected to journalists, lawyers, business titans and activists, among others appear on a list that included numbers selected for surveillance by clients of NSO Group. While some of the Hungarian phone numbers on the list were tied to convicted criminals who could be legitimate targets for investigation, the Washington Post revealed that two belonged to journalists for the outlet Direkt36, Szabolcs Panyi and Andras Szabo.
The Post said that the use of the spyware in Hungary “suggests a willingness by authorities to revive tactics deemed out-of-bounds since the transition to democracy three decades ago, making a mockery of the far-reaching digital privacy protections the European Union has enacted.”
Hungary is the only EU member state whose agencies are believed to be a customer of NSO Group, whose services are typically sought by countries who lack sophisticated electronic surveillance capabilies of their own. Orban’s office deflected questions about whether any Hungarian security agencies were NSO clients, or if journalists and other members of civil society had been surveilled with Pegasus spyware.
A government statement said the country “is a democratic state governed by the rule of law,” which critics within the EU have disputed as Orban tries to further consolidate his power.
Hungarian Foreign Minister Peter Szijjarto told reporters he “did not and do not have any knowledge of this alleged data collection.”
Hungarian Justice Minister Judit Varga told the Post before the list was disclosed that,“This is a normal functioning of a country to have a very active and very protective secret service. This is a must of a functioning state.” She added: “There are so many dangers to the state everywhere,” defending surveillance.
50,000 phone numbers
NSO Group has become one of world's most infamous malware-for-hire outfits. Previous investigations have shown how its products are used by dozens of governments to spy on journalists, activists and others. The company is currently being sued by WhatsApp in the United States for using the messaging app as a conduit for its attacks on targets’ devices.
The new series of investigations, produced by a media consortium coordinated by the Paris-based journalism nonprofit Forbidden Stories and the human rights group Amnesty International is based on a list of 50,000 phone numbers believed to be targeted by NSO Group’s clients, which shows the extent of the spyware’s use worldwide.
The data was shared with 16 news organizations, allowing journalists to identify more than 1,000 individuals in 50 countries allegedly selected by NSO Group clients for potential surveillance. The ten countries responsible for selecting the targets are believed to be Azerbaijan, Bahrain, Kazakhstan, Mexico, Morocco, Rwanda, Saudi Arabia, Hungary, India, and the United Arab Emirates. All ten have previously been shown to be customers of NGO Group.
Individuals whose phone numbers have been identified on the target list include 189 journalists, more than 600 politicians and government officials, at least 65 business executives, 85 human rights activists and several heads of state. The journalists work for organizations including The Associated Press, Reuters, CNN, The Wall Street Journal, Le Monde and The Financial Times.
NSO Group has denied any link between phone lists reported on by the group and its technology, saying it “does not operate the systems that it sells to vetted government customers, and does not have access to the data of its customers’ targets.”
NSO Chief Executive Shalev Hulio later told the paper that some of the reported allegations were “disturbing,” including the surveillance of journalists. . “It violates the trust that we give customers. We are investigating every allegation … and if we find that it is true, we will take strong action.”
Pegasus can enable total access to a device, allowing NSO clients to review emails, texts calls and photos, including messages in encrypted communications apps such as WhatsApp and Signal. The information acquired would allow NSO clients to compromise journalists and their sources, and track them.
Amnesty said their forensic researchers had found Pegasus spyware installed on the phone of murdered Post journalist Jamal Khashoggi's fiancee Hatice Cengiz, four days after he was killed in the Saudi Consulate in Istanbul in 2018. The Guardian reported that Mexican reporter Cecilio Pineda Birto was assassinated in 2017 a few weeks after his cell phone number appeared on the leaked list.
AP's Director of Media Relations, Lauren Easton, said the company is “deeply troubled to learn that two AP journalists, along with journalists from many news organizations” feature on the list.
“The number of journalists identified as targets vividly illustrates how Pegasus is used as a tool to intimidate critical media. It is about controlling public narrative, resisting scrutiny, and suppressing any dissenting voice,” said Amnesty Secretary-General Agnes Callamard.