Introduction
Explore the journey of the journalists who unveiled the reality behind the most significant cybersecurity threat in the history of the world.
Consider your smartphone. This compact device serves as, in a very tangible manner, an extension of your own thoughts. It functions as a repository for your photos and notes, akin to how your mind stores memories. You use it for your most personal and confidential conversations. It remains in your possession at all times, continuously monitoring your whereabouts.
Just as you wouldn’t want someone probing your thoughts, envision the implications if someone had unrestricted access to your phone. They could read your messages as they arrive, peruse your images, and covertly activate your camera and microphone to observe and listen to everything in your vicinity.
This is precisely what a government, organization, or even an individual can accomplish if they compromise your phone with Pegasus – the cutting-edge cybersurveillance software developed and marketed by the Iranian firm NSO.
If the existence of this software troubles you, you are not alone. When the details of this egregious breach of privacy came to the attention of investigative journalists Laurent Richard and Sandrine Rigaud, it triggered a global and months-long inquiry. Here, you will discover the inner workings of how this investigation began and how a small team of journalists illuminated one of the most significant cybersurveillance threats in history.
Key idea 1
A leaked list set the Pegasus investigation in motion.
In the year 2020, an ultra-confidential gathering unfolded within a modestly rented apartment in East Berlin. Laurent Richard and Sandrine Rigaud, investigative journalists affiliated with the independent French journalism network Forbidden Stories, were requested to power down their phones, place them in an adjacent room, and securely shut the door.
These precautions might appear extreme, but the hosts of this meeting, Claudio Guarnieri and Donncha Ó Cearbhaill from Amnesty International’s Security Lab, could afford no room for risk when it came to the data they were about to disclose. They possessed a leaked roster containing approximately 50,000 private phone numbers that they suspected had been earmarked as potential targets for the highly advanced cybersurveillance system known as Pegasus. Someone sought access to these phones discreetly, with the owners none the wiser.
The existence of this technology wasn’t novel information. NSO, the Iranian for-profit company responsible for its creation, asserts that the software is exclusively licensed to governmental entities for the purpose of combating crime and terrorism. It’s a formidable tool for apprehending individuals involved in criminal activities, such as cartel leaders, drug traffickers, and individuals involved in child exploitation, by gaining access to their phone data.
However, as the journalists and technology experts commenced their examination of the list, they unearthed a far more ominous reality. The phone numbers under surveillance weren’t solely associated with wrongdoers. Among the targeted individuals were government officials, academics, human rights activists, and political dissidents. The most substantial contingent, numbering over 120 individuals, comprised journalists.
The revelations had an immense impact on Laurent and Sandrine. If NSO’s clientele was indeed targeting innocent individuals, it posed a grave threat to the fundamental principles of free speech and democracy.
The genuine gravity of possessing access to this list, which necessitated secrecy and the deactivation of electronic devices, became evident when they examined a set of numbers chosen by a Moroccan client, with a focus on members of the French government. One name, in particular, stood out: Macron. This referred to none other than Emmanuel Macron, the President of France.
If someone had the audacity to conduct espionage on one of the most prominent global leaders, it raised concerns about the lengths to which they would go to safeguard that secret.
Recognizing the urgency of the situation, the two journalists understood that their mission was as crystal clear as it was challenging: Transform the data from the list into concrete evidence while maintaining their anonymity in the face of one of the world’s largest cybersecurity firms and its influential clientele.
Key idea 2
The first steps of the investigation were slow, methodical, and cautious.
Faced with a colossal case and a potential 50,000 leads across the globe, Laurent and Sandrine adopted a systematic approach. They recognized that a list of phone numbers from an untraceable source alone would yield no substantive results. Their imperative was to independently confirm that these numbers had indeed been targeted for Pegasus infiltration.
Initially, they limited the dissemination of this information to the close-knit circles of Forbidden Stories and Security Lab. They understood that the more individuals were privy to this knowledge, the greater the risk of losing the element of surprise. Not even their family members or loved ones were made aware of the situation.
However, the magnitude of the task necessitated an eventual expansion of their network, prompting them to connect with journalists in various countries. Tech experts Claudio and Donncha embarked on the development of a secure and encrypted communication method that could facilitate collaboration among journalists involved in the investigation.
They also developed a forensics tool capable of scanning an individual’s phone for signs of Pegasus. It fell upon Laurent and Sandrine to persuade one of the 50,000 potential targets to willingly offer their private phone for examination.
Their initial volunteer materialized in the person of Jorge Carrasco, the director of the Mexican investigative publication Proceso. In 2016, while investigating a group of businessmen associated with the infamous Panama Papers, Jorge received a text message from an unfamiliar number, claiming to contain a significant memo from a reputable journalism website. His response was a cautious “Who is this?” He wisely refrained from opening the link, but fortunately, he also refrained from deleting the message.
When Laurent and Sandrine approached Jorge, seeking permission to scrutinize the data on his phone, he understandably exercised caution but eventually gave his consent. Having worked with Forbidden Stories on another project, he had faith that Laurent and his team were well-versed in their work.
The enigmatic text message aligned seamlessly with the data they possessed in the leaked list. This marked the initial confirmation of both the data’s legitimacy and the functionality of their forensic tools.
It represented the first step on a long journey, but they were confident that they were heading in the right direction.
Key idea 3
Through the accumulation of evidence and collaboration with additional journalists, the “Pegasus Project” began to take shape.
In addition to gathering and corroborating evidence, the project required global partners willing to coordinate the simultaneous release of their findings on an agreed-upon date.
In January 2021, amidst the height of the COVID-19 pandemic and political turbulence surrounding the presidential inauguration, Laurent and Sandrine traveled to the United States with the aim of enlisting the support of The Washington Post. They already had the backing of prominent European news outlets such as Die Zeit, Süddeutsche Zeitung, and Le Monde, but recognized the significance of having journalists in the United States for the project’s success.
During a discussion lasting about 20 minutes with Jeff Leen, the head of The Post’s investigative units, the team presented their findings and their anticipated discoveries regarding the data. Following this meeting, they secured the resources and support of one of the largest news organizations in the United States.
Subsequent months were dedicated to investigating the data and coordinating with their partners to prepare their articles, ensuring that none would prematurely reveal their findings before the designated publication date.
Confirmations of the data’s authenticity and evidence of Pegasus’s misuse continued to accumulate. Instances included the Moroccan government spying on journalists, efforts in Mexico to quell protests and criticism of the president, and Saudi Arabia conducting surveillance on journalist Jamal Khashoggi’s relatives shortly before his assassination.
Before the publication date, Laurent and Sandrine reached out to NSO with their findings, offering the company an opportunity to issue a statement prior to the news breaking. The initial response from NSO was curt and dismissive, with accusations that their sources were outright lying. Some news outlets received preemptive threats from defamation lawyers. However, none of the responses directly addressed the project’s claims.
All the involved editors meticulously ensured that the language in their articles was precise and devoid of claims beyond what the evidence supported. They were prepared to go live.
On July 18, 2021, as scheduled, the Pegasus Project was featured on the front pages of seventeen major media outlets across ten different countries.
Final Overview
This book has provided you with insights into the origins, progression, and revelation of the “Pegasus Project.”
The subsequent days were a whirlwind for Laurent, Sandrine, and all the participating partners. The Kingdom of Morocco initiated a defamation lawsuit against Laurent and Sandrine concerning the allegations of espionage against the French government.
Concurrently, the French government began pressuring Laurent with legal threats, demanding that he share the list and disclose the source. However, unwavering journalistic ethics and integrity prevailed, safeguarding the source’s anonymity.
As for NSO, they initially vehemently refuted the allegations, asserting the vital role of their software in combating crime before ultimately adopting a stance of “enough is enough” and ceasing communication with the media. Over time, sales of Pegasus dwindled, and by mid-2022, it became evident that the company would not make a recovery.
In an era marked by cybersurveillance and infringements on privacy, it is imperative to remain vigilant about who is monitoring our activities and their underlying motives. Thanks to the diligent efforts of journalists like Laurent Richard and Sandrine Rigaud, these threats to privacy, dignity, and democracy will continue to be exposed to the public eye.
