IN FRENCH:
REPORTER: The biggest spying scandal in cyber history.
This investigation, which was actually done by Forbidden Stories,
which is kind of an investigative group based in Paris,
and shared with a number of different news outlets.
FRENCH REPORTER:
A joint investigation by 17 news outlets...
SPANISH REPORTER:
A massive data leak contained over 50,000 phone numbers.
A leak of 50,000 phone numbers
belonging to some big name politicians.
IN MANDARIN:
Pegasus.
Pegasus. Pegasus.
Pegasus spyware.
Pegasus is like someone over your shoulder.
It can read everything you're reading,
it can watch everything you're watching.
And once the spyware
is taking the control of your device, basically you're trapped.
REPORTER: This software has the potential to use the microphone
and camera to listen to and even look at
the owners of iPhone and Android devices.
Hello, can you hear me?
I can hear you. I don't see you.
Hello. Hello, Paul. Hello?
Hi, Donna.
Hi, how are you? Hi, Donna.
Good, and you?
At that time, we quickly called the Washington Post,
the Suddeutsche Zeitung, and all the partners to tell them
that we were having access to a list.
We wanted to tell you about some information we have
and about a new project we are starting.
There is a lot that concerns India. Ah.
Some names in Mexico.
Information about Hungary.
Azerbaijan and Kazakhstan.
What we needed at that moment was to put together
the best possible team. We needed tech specialists.
We needed people with good knowledge of the spyware,
and journalists with contacts in the intelligence world.
TANNOY: Elephant and Castle. Change here...
Paul Lewis is the head of the investigative unit of the Guardian.
The Guardian has been working for years on Pegasus.
The moment they mentioned the numbers of phone numbers
that they had, the quantity of phone numbers,
tens of thousands,
I mean, my jaw just hit the floor.
Now, we had small pieces of the jigsaw of wrongdoing by NSO.
Never before had anyone been able to stitch that together
and tell the whole story, so if Forbidden Stories have got data
that can identify not just who the customers of NSO are,
but potentially point in the direction
of who the targets are as well, this is a game-changer.
Israel has become the world leader in this industry
and exports these tools all over the world
and, if you like, NSO Group was in many ways,
you know, the jewel in the crown.
Here was a company founded by three guys in 2010,
a tech start-up become a unicorn that was incredibly successful,
that claimed to have over 40 countries around the world
buying its technology.
We only sell it to government or to entities that we know
or we want to believe that they will not misuse the tools.
And this is how we check the customer,
this is how we diligence them.
We have all the mechanism to make sure
that they are not misusing the systems.
All of us suspected that if NSO Group was giving
authoritarian and repressive regimes
such a powerful instrument of surveillance -
you know, you can get into the phone of anyone in the world
and no-one's looking over your shoulder because NSO Group says,
"You have to sign this piece of paper to agree
"that this is just for criminal investigations
"and terrorist investigations,
"but we're not going to check how you use this technology."
So you have a carte blanche.
We had a kaleidoscope of potential victims.
But how do we prove that Pegasus was on the phones?
It's a piece of code that looks very similar to all the others
that you are running on your phone.
It's just designed to do something that it shouldn't.
An investigation on a spyware like this begins with a first case,
begins with a patient zero, so to speak,
and that opens up everything.
The very first cases, they left their infrastructure
that was connected to NSO.Group.com -
that was the first mistake.
And then from there you start saying,
"OK, I've seen this infrastructure.
"It's connected to the company, quite evidently."
These technologies just evolve continuously,
so it's a cat and mouse game by nature, meaning that,
but the unfortunate reality is that against capabilities like those
that Pegasus customers have, there's not much you can do
from a digital security perspective. You can't really stop them.
One of the very first things that we did after getting access
to the list was to cross-check the list with our own contact list,
and I did that with my personal contact list.
Immediately a phone number popping up.
That was the phone number of a friend of mine,
someone I know well for years.
She's a journalist in Azerbaijan and her name is Khadija Ismayilova.
REPORTER: Her name is Khadija Ismayilova.
She's an award-winning investigative reporter
and an outspoken critic of the government,
renowned for her exposes of corruption at the hands
of the country's president.
Khadija Ismayilova relentlessly kept on exposing the wrongdoing
and the corruption of the Aliyev regime.
The regime of Azerbaijan is basically controlling everything,
censoring everything. Human rights activists, press freedom,
everything is under the control of that ruling party.
And as soon as you start criticising them, you will end up in jail.
She showed how they were having their hands
into a big chunk of the Azerbaijani economy.
She was showing how they were taking money in a covert way,
how they were stealing money, basically, from the people.
IN AZERBAIJANI:
SHOUTING
MAN SHOUTS: Journalist! Journalist!
After all this investigative reporting,
Khadija became a prime target for the government in Baku
and for the Aliyevs.
In Azerbaijan, there is a culture of blackmailing people,
blackmailing political opponents,
blackmailing human rights activists and journalists.
They can take your personal pictures,
your personal video to blackmail you,
and in 2012, Khadija Ismayilova really paid the price for that.
I remember the day when Khadija called me and said,
"Paul, something terrible happened.
"I received this envelope with photos
"that are taken in my bedroom illegally.
"They probably had a hidden camera.
"And they're blackmailing me with these photos."
Right next to the picture, there was a small message saying to Khadija,
"You should stop your investigation,
"otherwise we will publish those videos."
But Khadija refused that deal
and she decided to continue her investigation.
CLAMOURING
REPORTER: She was sentenced to seven-and-a-half years in prison
for embezzlement and tax evasion,
but her supporters say the trial was politically motivated
and accused the president of cracking down on press freedoms.
I don't know how to proceed with Khadija
because I don't want to put Khadija in danger.
But we wanted to...
..to do some forensic of her device.
The thing that is quite difficult is how to get in touch with Khadija
without communicating on electronic device.
According to what we see, we see that Khadija is really
one of the top persons of interest for Azeri intelligence services,
which is not a surprise, of course.
This is very sensitive, right? Yeah.
This is very, very sensitive, especially for her,
because she's basically on probation.
So that's going to be a risk anyway.
One day we learned that Khadija was about to travel to Turkey
for medical reasons. So clearly, first, that was a kind of opening.
So what we did after that is that we decided to send one team
over there first to tell Khadija that we were having reasons
to believe that she was surveilled,
but as well that we found a phone number in the list.
Now I'm nervous.
LAUGHTER
I cannot stand still.
Khadija! Khadija!
How are you doing?
INDISTINCT CONVERSATION
Can we open the window?
We can take this off, right?
That's too long.
So, basically, what we have is list of
the phone numbers that were targeted in Azerbaijan.
That's so cool.
And...yeah, so we have about 1,000 numbers from Azerbaijan.
And you're among them.
Oh! And then we also have
some people who are your friends and your lawyers.
Mm-hm, OK.
And what does that program do?
So what the program does is,
it basically, without you knowing,
it installs things on your phone.
And then it allows...
Even if I didn't click on anything?
Yeah, so the secrecy of this, it's called Pegasus,
and the secrecy of it is that you don't actually see
or you don't do anything.
So before you had this, you had to click on something
to be infected. Yeah.
In this case, it all happens in the background and you have no
idea that you're infected.
And when you're infected, it's transmitting your messages,
your images, everything that's happened on your phone,
including the signal, because they have the phone itself.
And it's legal to sell it? Yes.
So what we know is that most likely
some time in 2018, the government got it.
OK. And we have a lot of data from 2019.
And, you know, that was a big year of protest,
you were on a hunger strike with other people. Yeah.
You guys had a woman march,
you were leading the march. Yeah.
Shoo...
SHE LAUGHS
It's kind of the most like you in the country.
Well, why they are so idle, I mean, that's...
Oh.
Mm.
So one way for us to verify that what exactly was done
in your case would be to do forensic on your phone.
So the question is whether you would allow us to make a backup
of your phone and basically check it for the traces of Pegasus.
Yeah, yeah.
Is there any way to avoid this surveillance?
Yes, we will set you up with a new device
that you will be able to use... On a phone.
Is there a balcony?
There must be some way to do it.
There are other ways to communicate... Yeah.
..securely.
It's like...
..it makes you to want to live in the...
..bubble.
But then...
..like, so no-one can enter, like, in some sort of...
This is her phone.
You don't need any cables?
No. OK.
Do you know if she still has a backup?
Yes, she does. Yes, she does. OK.
Well, right now, I'm trying to jailbreak the phone.
PHONE BEEPS
Hopefully it works.
So right now, I am...
..navigating through the phone.
I'm looking for things that might have executed network activity
that is connectable to the company,
any leftovers of malicious executions,
accounts that we know of.
Anything essentially that tells me the history of this phone.
That's interesting. That's not something I've seen before.
We see processes that we know are connected to Pegasus.
We'll see some message accounts that are connected to the attacks,
because this might indicate what was the entry point.
Oh, it was Apple Music? What the fuck?
Oh, really?
That's weird.
So they might have started using Apple Music to exploit it.
Erm...
..I have to do some more digging on this, as I need to look at
what specifically these applications are.
It's definitely among the ones most targeted.
No, Khadija's coming!
Hi, Claudio.
Hi.
So now tell me how bad it is.
OK.
There are definitely some records
that indicate various points
where the phone seemed to have been compromised.
Mm-hm.
So I started feeling like I played doctor in the 1300s,
you know, like, I'm basically kind of just keeping the death count...
March of 2019...
..I'm contributing to creating a trauma here
and I can see it in many cases.
Like, I can see it that they are... Right now,
they're going to a dramatic moment.
And I'm like that person in the room that is breaking it.
There are also some more recent records from even as recent as early
May of this year, so until a couple of weeks ago.
But all in all, it seems like this probably extended
between 2019 and 2020.
2020, at the very least.
I've been told that you will not know
what exactly had been monitored or recorded.
With these kinds of monitoring technology,
the point where they have that level of access to the device,
virtually everything is possible, so...
Yeah, thank you. Have a good day, bye-bye.
Bye. Bye.
That's not great news. No.
All night I've been thinking about, what did I do with my phone?
And I feel guilty.
I feel guilty, too, for the messages I've sent.
I feel guilty for the information sources who send me...
..thinking that some encrypted messaging ways are secure.
They did it and they didn't know that my phone was infected.
I mean, my family members are also victimised.
The sources are victimised.
Everyone. I mean, people I've been working with.
People who told me they had private secrets.
I victimised everyone.
I mean, it's not just me, I...
..I put so many people in danger.
And...
..and I'm angry.
Again, I'm angry, I'm angry with the government,
I'm angry with the companies that produce all these tools
and sell it to the bad guys...
..like Aliyev regime.
It's...
It's really... It's despicable,
it's heinous, I don't know...
Israel has the advantage of not only developing new technologies
and weaponry, but testing it live.
And this is something Israel knows it can use to sell outside.
When you want to control a huge population,
like we do with Palestinians,
you have to have assets everywhere,
so everyone can be a target,
because we don't want only the - I don't know -
terrorists from the Hamas, but also maybe his neighbour or his cousin
or the person who sells milk in the corner of the street.
If you want to recruit human agents,
you need to collect their weaknesses,
things that you can use to blackmail.
And so part of what 8200 does is to collect this blackmail
potential information about everybody.
If you're gay or if you have medical...special medical condition
or you have financial problems
or someone from your family has one of those,
then that's something we can use against you to blackmail you
and get you to cooperate.
It's this kind of approach that you see again in other countries
used by the clients of NSO.
One of the very first things that we have been able to see
reading the list was the very high number of phone numbers
coming from Mexico.
But actually that was not so surprising,
because we knew for years
that Mexico was one of
the very first customers
of the NSO Group.
And we know as well since 2017
that 19 people from the civil society in Mexico
were targeted by Pegasus, including one very famous journalist
called Carmen Aristegui, a journalist who does work for CNN,
who is extremely popular in the country.
PHONE RINGS
Carmen Aristegui was already a known victim of the spyware.
So we asked her to join us to investigate
the Mexican part of the Pegasus Project,
and what we first asked her was to help us to identify
the thousands of Mexican numbers appearing on the list.
Right...
There's a lot of evidence to suggest that NSO Group
had the direct backing and support of Bibi Netanyahu's government.
In order to sell its product to governments around the world,
it required permits,
effectively licences from the Israeli Defence Ministry.
I decided several years ago to turn Israel
into one of the five cyber powers of the world.
In order for the companies to develop,
they need to make...
What do they need to make?
Money!
They need to make money.
Now, the easiest way to make sure that they don't make money is,
one, high taxes, right?
What's the other one?
Regulations.
Have you ever heard of regulations?
We have a problem with regulations.
So the policy we have is keep taxes low
and keep regulations low.
Minimise regulations.
There is no industry more susceptible
and more inviting of regulations than cybersecurity.
It's like weapons.
It is a weapon!
Around us is a sea of dictators and autocrats
and kings and sultans.
This is the neighbourhood we have. We didn't choose it.
But at the end of the day, Iran is the biggest threat
on Arabs and Israelis.
Netanyahu wanted to forge a camp,
a united front against Iran,
and he would use many, many tools in order to do that.
One of the tools is giving Israeli technology.
NSO has a very attractive tool.
AMITAI SIGHS
# Do-do, do-do-do-do-do-do. #
Jamal Khashoggi's murder, really,
in the history of the Post,
stands out.
Jamal Khashoggi was an opinion writer for the Washington Post.
Very gentle, soft-spoken man,
willing to share his opinions.
His voice became very important
because he was the single most important dissident
writing about the Saudi regime.
Jamal, let me start with you.
You've compared your Crown Prince to Putin,
to Iran's supreme leader.
You've said he's creating, quote,
"an interesting form of dictatorship".
How so?
I still see him as a reformer,
but he is gathering all power within his hand.
As we speak today, there are Saudi intellectuals
and journalists jailed.
His murder was so cold-blooded.
Jamal Khashoggi went to the consulate in Istanbul
and then he disappeared.
His close friends and family are still trying to figure out
what the situation is.
They're waiting on an official statement.
I spoke to his fiancee, who was also here
and told us that they came here to issue a number of documents
so they could marry.
Turkish officials believe he was killed by agents
of his own government inside the consulate.
They dispatched an assassination team
that landed in a plane in the airport
and came in cars with tools to hack him up,
hack his bones,
and carry him out in a suitcase, or suitcases.
Uh!
The word is that you sold Pegasus to them,
and then they turned it around to get Khashoggi.
Khashoggi murder is horrible - really horrible.
And therefore, when I first heard their accusations
that our technology been used on Jamal Khashoggi,
or on his relatives, I started an immediate check about it.
And I can tell you very clear.
We had nothing to do with this horrible murder.
When Forbidden Stories first contacted me,
the minute we found out about this list,
the first thing we all did was to check for any numbers
related to Jamal Khashoggi.
And right away, we found two numbers associated with the two women
closest to him in his life.
His fiancee Hatice,
who we'd all gotten to know on television,
because she was outside the consulate
when he didn't reappear.
I'm hoping that they will let us do forensics on her phone
to see for certain whether she was targeted.
And maybe, if we get lucky,
whether we can see what they took out of her phone.
They killed my future.
They killed my life.
I lost everything - just the one day.
I felt inside me something changed and broke, you know?
I remember the first days after the murder.
A lot of times, they try to hack my email.
Hmm.
Do you feel like your phone is doing anything strange?
Do you think it could be hacked?
We can test it.
So we could do that if you wanted to do it.
We... OK, you can do that.
OK, that'd be great.
Well, we just need to plug your phone into our computer.
OK. So maybe we do that.
Great.
Hello?
Claudio?
Hi.
It's Dana.
Hi, how are you?
I don't know. You tell me.
So I checked both the uploads.
Er...
The new one seems clean to me.
The old one, however, has some traces
on 6th October 2018.
Seems to have been a first compromise,
which was followed by some additional traces
on the 9th and then on the 12th.
There's also an additional record in June of 2019,
but that seems to be probably a failed attempt.
And I don't see anything following that.
OK.
And then we find out the date,
which is four days after his murder...
..when she's still outside the embassy,
trying to figure out what's happening.
And it just seemed like such a ballsy move
on the Saudis' part,
to surveil the person who has become the public face
of his disappearance.
We learnt that Jamal had a complicated personal life.
The other phone number that we discovered
was a woman named Hanan El-Atr.
Hanan Atr is probably the least-known character
in Jamal Khashoggi's life.
She's actually his wife,
and most people have not heard of her.
He actually had secretly married in the United States
in an Islamic ceremony.
It took me a long time to find Hanan.
And what I discovered is Hanan is living in hiding
in the United States while she waits for her political asylum case.
She was a flight attendant for Emirates Airlines.
And so she flew all over the world
and she was communicating with him on foreign phones.
He was so happy, and they were so happy as well.
This is on his birthday in a restaurant in Washington,
and his friend Maggie behind us -
she made the birthday party.
There's all of his friends around us.
This last birthday in his life.
He was careful, but he didn't realise maybe, my device,
it is much dangerous.
And I didn't know as well.
He suspect but he's not sure - and I am not sure as well.
She allowed me to download her phone...
..to send a copy to Bill Marczak at Citizen Lab,
who also conducts forensic analysis of phones.
So we've set up a meeting with Hanan and her lawyer, Randa Fahmy,
and Bill's going to Zoom in from California, where he's working.
What I did is I analysed,
erm, all the available data on two Android phones
and one laptop belonging to Hanan.
On one of the phones,
it appears that there were two separate links
to the Pegasus spyware that were actually opened.
There are a number...
In fact, there are seven text messages
from a period of November 8th to November 26th 2017.
We have the smoking gun from Hanan's phone.
There was no other member of Jamal's family
that was spied on prior to the murder.
He was telling me what he's doing and what his connection,
what is his movement, what is his state of mind.
So you were communicating with him. A lot.
They tracked my husband through me a long time back
before they killed him.
Because he was telling me, only me, everything.
I didn't know this much - they track him through me all the time.
Mm-hm. Yeah.
Why is this all coming in my life?
They did track Jamal and kill him through me.
Long time back.
This is a very crucial information, because we know for years
that NSO Group has always say that if we learn one day
about any kind of misuse from our spyware,
used against dissidents, used against journalists,
used against the human rights activists,
we will then, of course, investigate the case.
But in that case we're talking about, that's extremely serious.
We're talking about someone who has been dismembered
within the consulate, who has been killed within the consulate
and we know that the relatives of that person
have been targeted by Pegasus.
It's important to rectify this story,
which is that these technologies are necessary
and exclusively used for good purposes
and for fighting evil and for fighting crime
and terrorism and all that.
This is a bunch of lies for the most part,
on the part of this industry who has a vested interest
in exploiting as much as possible out of this to make money.
When we started analysing the list,
we immediately saw a lot of French numbers,
more than 1,000 potentially targeted by Morocco.
There were journalists, lawyers, activists, but not only.
We also saw 15 members of the French government
and the President Macron himself.
At that moment, we immediately realised
that this was going to be a bomb.
Mm-hm.
The last phase was very, very intense.
This is precisely the moment where you knock on the door
of the NSO Group and you told them
we were investigating you for months.
We know about your businesses
and we have plenty of questions to ask you.
And so we were thinking that we should get some answers
in the next hours following the email, but nothing was happening.
PHONE RINGS OUT
Hello. This is Laurent Richard from Forbidden Stories.
How are you doing?
Yeah, I'm good.
Yeah. Thank you for taking the time to answer.
I was just wondering if you are planning to answer our question.
Well, you can see it in your email now.
EMAIL NOTIFICATION
OK. I see it.
Thank you. OK. Bye. Thank you. Bye. Bye.
So, at the end, what we got was a very, very short email,
very brief, where NSO Group were telling us that
all your questions, all your information, everything is wrong.
But what we can tell you that we are here just to save life,
just to fight terrorism, and that's it.
"Furthermore, as NSO has previously stated,
"our technology was not associated in any way
"with the heinous murder of Jamal Khashoggi.
"This includes listening, monitoring,
"tracking or collecting information..."
At that time, here, there was a kind of calm,
but the calm, you know, that is preceding the storm.
But we discovered the day after that, NSO sent letters,
letters from lawyers to most of the partners
at the same time on all continents,
to threaten them and to tell them that if you publish anything,
we will sue you.
Here was a company valued at over a billion dollars.
The NSO Group and its clients,
these governments, were not going to put their hands up
and confess to this activity.
They were fighting it as hard as they possibly could.
It's a bit tense here, if I'm honest. Yeah. Yeah.
Erm...
We've had a provisional response from NSO to the Washington Post,
and we will have the formal...
..another response from them to us in about...
..15, 20 minutes, so we're going to keep this call really quick.
Erm...
VOICEOVER: The stakes are really high
when you do this kind of reporting.
..discussions around the public interest and exactly what it is...
I mean, this was a story of global significance
and the repercussions were about to be ignited.
All going well, if we're proceeding with this project,
I think the crunch point, really, is going to be in the next 12 hours.
What do you mean, in the sense of IF we are proceeding, Paul?
Yeah.
Is that in doubt?
Well, it's always... It's never...
It's never confirmed until it's confirmed, right?
EMAIL NOTIFICATION
So, Paul, just to be 100% clear, you guys are ready to hit the button
on a version of the story in...42 minutes?
Of the heads of state story. Heads of state only.
We're not ready now, but in 42 minutes we will be ready.
LAUGHTER
Here we were, simultaneously publishing
17 different media outlets,
all over the world in several different languages,
all at the same time - on the same minute of the same day -
after months of investigating.
OK, so one other thing, I think I have made some...
That's OK. I'll just say...
We've done it.
So the story is now live.
REPORTERS: A joint investigation by 17 news outlets, including...
Activists, lawyers and journalists
are reportedly among those who've been targeted...
What can be done to protect our country from commercial spyware,
the kind of threat that is now being reported
at the top of the news across the nation?
Right, how are we doing, guys? One minute, one minute. Yeah?
The NSO Group is only one company of many,
and if one company smells this bad, what's happening with all the other?
They're not security products.
They're not providing any kind of protection,
any kind of prophylactic. They don't make vaccines.
The only thing they sell is the virus. And this is the problem.
You know, these companies are extremely predatory.
And their prey is us - collective, the global we.
It doesn't matter who you are, it doesn't matter what you do.
Your position isn't going to protect you.
If you're Minister, Prime Minister, guess what? You're on the list.
If you're a Supreme Court justice, you're on the list.
If you're an ordinary person, guess what? You're on the list too.
But we will not be safe until we change the game.
If you want to protect yourself, you have to change the game.
And the way we do that is by ending this trade, because it's a trade
that ultimately is paid for in lives.
There had been reporters who've been doing stories
on Pegasus for years.
This sort of tipped the scale, because it was in so many countries.
It was against so many people in civil society
who clearly were not terrorists or criminals.
I was infected on 3rd August 2020 with Pegasus
I believe at 3am in the morning.
The fact that you can be hacked
on British soil
and that they can do that,
it's frightening. It really is.
My name is David Haigh from Detained International.
And we founded the campaign to free the Dubai princess,
Princess Latifa, in 2018.
Hello, my name is Latifa al-Maktum, and I'm making this video
because it could be the last video I make.
Yeah.
This video can help me
because all my father cares about is his reputation.
He will kill people
to protect his own reputation.
He...
He only cares about himself
and his ego.
Here is an autocratic leader, massively powerful.
And, as it turned out, Pegasus was used to spy on his personal
family, his relatives.
His ex-wife, at a minimum, possibly more people.
But Princess Latifa has for a long time been, by her account,
unhappy about her life in Dubai.
She had been incarcerated, effectively, by her father's regime.
The day after Princess Latifa went missing from Dubai,
we saw her number emerge in the list.
And in the days after that, as she was travelling toward India
on this yacht, her friends, people she knew, people within her orbit,
their phone numbers also appeared on the list.
NSO's technology was, it seems, one of the tools
that was being used by the state in a desperate attempt to find
Princess Latifa, kidnap her and return her back to Dubai.
Now, however they found her, that's what happened.
Given how much David Haigh was working on the Latifa case,
it wasn't a surprise when we discovered that there was
Pegasus activity on his phone.
We had recorded a lot of videos and a lot of evidence Latifa had
that could be used to tell the world about her predicament -
the fact that she was being held hostage, what was happening to her.
It was effectively dynamite evidence on that phone.
The fact that they know your location.
Someone could be listening to us now and seeing what we're doing.
And it's that, sitting in the back of your head every day.
One day, NSO were attending the International Security Conference
in London, and then I had a slightly mad idea -
to think, "Well, actually I might go and visit them."
So I applied for a pass,
not thinking I'd get one because it is the
International Security Conference. So you would have imagined they
would check the name in the press, but they didn't. So I got a pass.
I was very excited.
So I got a camera on a pen and then went up to NSO.
Hi, I wonder if you could help.
My name's David Haigh, and that's the report from Amnesty
saying Pegasus is on my phone.
And I wondered if you could take it off for me?
Or tell me how to take it off? First, we cannot.
HE LAUGHS
The meeting was strange because people were laughing.
They weren't taking it seriously.
I mean, I think it was because I went there very politely
rather than shouting with banners.
I would be very happy to help check that...
Yeah. ..for you and be in touch.
Can you give me your details,
and someone from that...? Yeah, yeah.
I will make sure they contact you in the next few days.
Yeah, if you could, please.
With credit to them, they did contact me.
But then I think what I did see is they've effectively ghosted me now.
And still, now, nothing has been done.
No-one's been brought to justice.
And everybody just looks the other way.
This is a whole industry gone rogue
in a deadly alliance with the worst dictators of this world,
making human rights work impossible.
And, Mr Commissioner, you had many nice words and strategies.
First of all, it's about enforcement.
Second of all, this whole thing has a foreign policy and human rights
dimension you haven't even spoken about.
We need a global ban on the export of these kinds of spyware.
And we need to ask the tough questions to other governments,
including those in Israel and Saudi Arabia.
Thank you.
REPORTER: A US appeals court is allowing WhatsApp messaging service
to move forward with a lawsuit against NSO Group
over allegedly targeting some of its servers in California
to infect about 1,400 mobile devices with malware,
a violation of state and federal law.
All we've seen NSO Group is, deny, deny, deny,
and that's shown up entirely through the legal process as well.
There's an argument, and, at times, a lot of companies,
they fix a security vulnerability and they move on
because they don't want to draw attention
to what could be a negative story about their product.
But over the last three years, more companies invest more resources
in finding and fixing vulnerabilities,
take action against NSO Group, such as through lawsuits,
where we had a number of technology companies,
in addition to civil society, join our lawsuit with amicus briefs
in support of our position, which is very helpful.
The way I think about it
is tech companies can and should do everything they can
to make their software as secure as possible,
but at the end of the day, if there's no consequences
for people who try to break that software
to commit human rights abuses,
then there will always be people trying to do it.
In Europe, the NSO scandal bounced back in December 2021
because we were discovering new victims of the spyware
and because new countries were accused of using Pegasus
to spy on their opponents.
REPORTER: Pegasus spyware is once again back in the spotlight,
this time for targeting pro-independence supporters
in Spain's Catalonia.
In Spain, more than 60 victims of Pegasus were identified,
including the Prime Minister, Pedro Sanchez,
and Catalan European MPs,
and, in Poland, Pegasus was suspected of being used
by the ruling party
to spy on its political opponents during the 2019 election campaign.
REPORTER: Several members of Poland's opposition
have produced evidence they were hacked by Pegasus Software.
REPORTER: This scandal is being dubbed the Polish Watergate.
Thank you, Mr Chairman.
On behalf of NSO, I want to thank the members
of the committee of inquiry for having us here today.
Before we begin, we should note that there are limits
to the information we can share with the committee and others.
As you know, NSO is a private company
providing expert controlled cyber intelligence technologies
only in exclusive to government agencies
for the purpose of preventing and investigating terrorism
and other serious crimes.
As a result, we are unable to share details about our customers
as well as the crimes prevented and criminals tracked
and apprehended using our technologies
or trade secrets of the technology.
I would like now to dispel a number of misconceptions
that have surfaced in press and public debate
with respect to our company's activities and technologies.
It is not true that NSO Group operates Pegasus
and collects information about individuals.
It is not true that NSO Group sells its technology to private companies.
The issues that came up about Jamal Khashoggi,
about President Macron -
the system was not used on those numbers.
I will go immediately into the Q&A session of today's meeting.
We already have about 15 members who've asked for the floor.
Have United Arab Emirates and Saudi Arabia
ever gone through your due diligence check, and have they passed it?
As I said, I'm not going to respond to questions
regarding specific potential customers.
Given that UAE and Saudi Arabia have been using Pegasus software,
who are legitimate actors to issue warrants in these countries
according to your checks?
Again, I repeat it again,
I'm not going to respond to questions
regarding specific customers.
I cannot - and, again, I repeat,
I cannot, because of various confidentiality and secrecy issues,
I cannot get into specific questions
regarding specific customers or specific cases.
First of all, every customer that we sell to
goes through the due diligence review in advance,
and if...and very often if concerns are raised
regarding the rule of law,
because what we're looking at is also a rule of law,
and any country that we've decided to sell to
has been approved in this manner.
Please, stop - stop the storytelling.
I'm going to continue in Hungarian.
Good question.
Again, I said...
Not again, it was a new question.
So, please.
I have not said... We have not said that we have determined recently
that Hungary is or is not a secure country.
You did consider it secure,
because you sold the stuff to them.
Excuse me... I said now...
Let's keep a little bit of order in the meeting as well.
I understand there is frustration, but it doesn't help us
if we all start posing questions in a chaotic fashion.
So, you have the concrete question.
We have a concrete answer.
And, please. Can you, as the chair,
can you ask Mr Gelfand to either say
that he is refusing to answer the questions,
or answer the questions? Because you keep repeating the same thing,
and there seems to be a complete disconnect between reality
and between what you're saying.
This is like... You know, it's an insult to our intelligence. Sorry.
In some ways, we can talk about the impact on the company
and say it's been really profound.
A more pessimistic view would be to look at the entire industry,
which remains unreformed, pretty wild, unregulated.
NSO may vanish,
but I feel no more secure talking in front of my phone now
than I did when we first published.
I don't think these issues have gone away.