United Nations alarmed by use of flagship Pegasus Malware to spy on journalists, activists

The United Nations on Sunday issued an official response to the global media consortium’s report on the Israeli-based 'hacker-for-hire' outfit NSO Group’s military-grade hacking malware, Pegasus, that it alleged was being used to spy on the journalists, human rights activists, and political dissidents in some countries. The Paris-based journalism nonprofit Forbidden Stories and the human rights group Amnesty International obtained more than 50,000 cellphone numbers that they shared with 16 news organizations, of which they identified 1,000 individuals in 50 countries whom they alleged were under potential surveillance by NSO clients. 

Amnesty stated that its forensic researchers have found that the NSO Group's flagship Pegasus spyware has been installed on phones of more than 189 journalists, 600 politicians and government officials, at least 65 business executives, 85 human rights activists, and several heads of state. India is among the list of countries and other nations such as  France, Hungary, Azerbaijan, Kazakhstan, and Pakistan. French nonprofit claimed that the spyware was fitted in The Post journalist Jamal Khashoggi's fiancée, Hatice Cengiz’s phone 4 days after he was killed in Saudi Consulate in Istanbul. 

While the Israeli based NSO Group in an email to AP denied what it called the “uncorroborated theories” about the military spyware that it said was sold to “vetted government agencies" for national security purposes against terrorists and major criminals, UN on Sunday expressed “shock and alarm” on how the use of such a surveillance technology undermines human rights.

“Revelations regarding the apparent widespread use of the Pegasus software to spy on journalists, human rights defenders, politicians, and others in a variety of countries are extremely alarming and seem to confirm some of the worst fears about the potential misuse of surveillance technology to illegally undermine people’s human rights,” UN High Commissioner for Human Rights Michelle Bachelet said in a statement on July 18. 

Furthermore, she said, “Use of surveillance software has been linked to arrest, intimidation and even killings of journalists and human rights defenders. Reports of surveillance also have the invidious effect of making people censor themselves through fear.  Journalists and human rights defenders play an indispensable role in our societies, and when they are silenced, we all suffer.”

“I would like to remind all States that surveillance measures can only be justified in narrowly defined circumstances, with a legitimate goal. And they must be both necessary and proportionate to that goal.”

UN High Commissioner for Human Rights Bachelet expressed concern about how extremely deep the spyware software such as Pegasus or Candiru can intrude into devices, surveilling all aspects of the person’s life. However, she did approve saying that “their use can only ever be justified in the context of investigations into serious crimes and grave security threats.” Further, she highlighted the state's role in preventing the abuse of surveillance technologies to avoid harm to human rights. She urged the state to take immediate steps to mitigate disastrous consequences by enacting laws to make products meet their human rights responsibilities. 

“Governments should immediately cease their own use of surveillance technologies in ways that violate human rights, and should take concrete actions to protect against such invasions of privacy by regulating the distribution, use, and export of surveillance technology created by others,” Bachelet stressed. 

The Israeli company NSO has been previously sued in Israel and Cyprus and the plaintiffs included Al-Jazeera journalists, as well as other Qatari, Mexican, and Saudi journalists who alleged they were being spied with the help of the spyware. "Pegasus" was first discovered as being used against a human rights activist in the United Arab Emirate (UAE) Ahmed Mansoor. Since then, many others journalists alleged spying with several lawsuits filed including by the Abdullah Al-Athbah, editor of the Qatari newspaper Al-Arab, one of the alleged victims. 

Apple claimed it patched zero-day vulnerabilities on iOS in 2016

On August 24, 2016, the cybersecurity firm Lookout released a report announcing that it was able to identify a major security flaw that exploits iOS and may give a third party complete control on the iPhones. They called the zero-day vulnerability “Trident”. “Pegasus" may have been something similar to one of the earliest digital weapons “Stuxnet” that caused zero-days attacks and disrupted Iranian nuclear plants” by altering the speed of centrifuges, causing them to shut down.

On September 1, 2016, although, Apple released an update [iOS 9.3.5] to patch the Trident vulnerabilities and asked its customers to update the software. “This blocks the Trident exploit chain by closing the vulnerabilities that NSO Group appears to have exploited and sold to remotely compromise iPhones,” Apple stated in a report. 

Citizen lab in a separate report stated that it was able to identify that the Israel-based “cyberwar” exploit infrastructure that sells government-exclusive “lawful intercept” spyware Pegasus was owned by American venture capital firm, Francisco Partners Management. Amnesty International also filed a petition to strip NSO of export license last year, but a Tel Aviv District Court ruled against its request. District Court Judge Rachel Lavi Barkai argued that the petition from the NGO and 30 human rights activists “failed to provide” evidence to prove that NSO’s technology “was used to spy on Amnesty activists.”Court cited post-issuance monitoring by the Defense Export Control Agency “which is particularly sensitive to human rights violations” as it said if evidence were found the permit would have been suspended.