Takeaways from the Pegasus Project

Takeaways from the Pegasus Project

(The Washington Post)

Military-grade spyware leased by the Israeli firm NSO Group to governments for tracking terrorists and criminals was used in attempted and successful hacks of 37 smartphones belonging to journalists, human rights activists, business executives and the two women closest to murdered Saudi journalist Jamal Khashoggi, according to an investigation by The Washington Post and 16 media partners led by the Paris-based journalism nonprofit Forbidden Stories.

Forbidden Stories and Amnesty International, a human rights group, had access to a list of more than 50,000 numbers and shared it with the news organizations, which did further research and analysis. Amnesty’s Security Lab did forensic examination of the phones.

Story continues below advertisement

Here are key takeaways from the investigation:

Phones identified from a sprawling list: Thirty-seven targeted smartphones appeared on a list of more than 50,000 numbers that are concentrated in countries known to engage in surveillance of their citizens and also known to have been clients of NSO Group, a worldwide leader in the growing and largely unregulated private spyware industry, the investigation found. The list does not identify who put the numbers on it, or why, and it is unknown how many of the phones were targeted or surveilled. But forensic analysis of the 37 phones shows that many display a tight correlation between time stamps associated with a number on the list and the initiation of surveillance attempts, in some cases as brief as a few seconds.

Politicians, journalists, activists found on list: The numbers on the list are unattributed, but reporters were able to identify more than 1,000 people spanning more than 50 countries through research and interviews on four continents: several Arab royal family members, at least 65 business executives, 85 human rights activists, 189 journalists, and more than 600 politicians and government officials — including cabinet ministers, diplomats and military and security officers, as well as several heads of state and prime ministers. The purpose of the list could not be conclusively determined.

Company says it polices its clients for abuses: The targeting of the 37 smartphones would appear to conflict with the stated purpose of NSO’s licensing of the Pegasus spyware, which the company says is intended only for use in surveilling terrorists and major criminals. The evidence extracted from these smartphones, revealed here for the first time, calls into question pledges by the Israeli company to police its clients for human rights abuses. NSO Chief Executive Shalev Hulio said Sunday that he was “very concerned” by The Post’s reports. “We are checking every allegation, and if some of the allegations are true, we will take stern action, and we will terminate contracts like we did in the past.” He added, “If anybody did any kind of surveillance on journalists, even if it’s not by Pegasus, it’s disturbing.”

Your support is essential

Without subscribers, we wouldn’t be able to uncover the facts and bring you groundbreaking reporting like this.

Reporting from The Washington Post

Private Israeli spyware used to hack cellphones of journalists, activists worldwide

NSO Group’s Pegasus spyware, licensed to governments around the globe, can infect phones without a click. Beyond the personal intrusions made possible by smartphone surveillance, the widespread use of spyware has emerged as a leading threat to democracies worldwide, critics say. Read the full story.

Letter from the editor

Why The Washington Post joined news organizations across the globe to bring you this investigation. Read the full story.

Story continues below advertisement

Jamal Khashoggi’s wife targeted with spyware before his death

NSO Group’s Pegasus spyware was used to secretly target the smartphones of the two women closest to murdered Saudi columnist Jamal Khashoggi, according to digital forensic analysis. Read the full story.

FAQ: A guide to ‘spyware’

How Pegasus works, who is most vulnerable and why it’s hard to protect yourself from hacks. Read the full story.

Invisible surveillance

Video: How spyware is secretly hacking smartphones. Watch the video.

In Orban’s Hungary, spyware was used to monitor journalists and others who might challenge the government

The deployment of the tool, confirmed with forensics, shows a willingness to use tactics previously deemed out-of-bounds. Read the full story.

Story continues below advertisement

About this project

Forbidden Stories, a Paris-based journalism nonprofit, and Amnesty International had access to a list of phone numbers concentrated in countries known to surveil their citizens and also known to have been clients of NSO Group. The two nonprofits shared the information with The Washington Post and 15 other news organizations worldwide that have worked collaboratively to conduct further analysis and reporting over several months. Forbidden Stories oversaw the Pegasus Project, and Amnesty International provided forensic analysis but had no editorial input.

More than 80 journalists from Forbidden Stories, The Washington Post, Le Monde, Süddeutsche Zeitung, Die Zeit, the Guardian, Daraj, Direkt36, Le Soir, Knack, Radio France, the Wire, Proceso, Aristegui Noticias, the Organized Crime and Corruption Reporting Project, Haaretz and PBS Frontline joined the effort.

Reporting by Reed Albergotti, Michael Birnbaum, Shane Harris, Drew Harwell, Niha Masih, Souad Mekhennet, Dana Priest, Mary Beth Sheridan, Joanna Slater, Julie Tate and Craig Timberg.

Design and development by Junne Alcantara, Betty Chavarria, Garland Potts and Irfan Uraizee. Video by Jon Gerberg. Video graphics by Brian Monroe. Photo research and editing by Chloe Coleman and Olivier Laurent. Graphics by Hannah Dormido, Courtney Kan, Tim Meko and Danielle Rindler. “Post Reports” production by Maggie Penman and Emma Talkoff.

Editing by Jennifer Amur, Marisa Bellack, Matthew Brown, Andrew deGrandpre, David Bruns, Peter Finn, Courtney Kan, Jeff Leen, Mark Seibel, Gregory Manifold, Liz McGehee, Jorge Ribas and Stu Werner.

Additional production by Courtney Beesch, Steven Bohner, Amy Cavenaile, Sarah Dunton, Tom Johnson, Travis Lyles, Kenisha Malcolm, Angel Mendoza, Tessa Muggeridge, Lucy Naland, Coleen O’Lear, Mark W. Smith and Emily Tsao.