Laurent Richard - Pegasus: How a Spy in Your Pocket Threatens the End of Privacy, Dignity, and Democracy

The author and publisher have provided this e-book to you for your personal use only. You may not make this e-book publicly available in any way. Copyright infringement is against the law. If you believe the copy of this e-book you are reading infringes on the authors copyright, please notify the publisher at: us.macmillanusa.com/piracy.

Rachel Maddow

T he call appeared urgent, in that it was coming at close to midnight Tel Aviv time, August 5, 2020, from somebody in senior management at the NSO Group. Cherie Blair, former First Lady of the United Kingdom, longtime barrister, noted advocate for women entrepreneurs in Africa, South Asia, and the Middle East, a prominent voice for human rights worldwide, was obliged to pick up the phone. Mrs. Blair had recently signed on as a paid consultant to the Israeli firm NSO to help incorporate human rights considerations into NSO activities, including interactions with customers and deployment of NSO products.

This was a delicate high-wire act, ethically speaking, because NSOs signature product, cybersurveillance software called Pegasus, was a remarkable and remarkably unregulated toolextraordinarily lucrative to the company (NSO grossed around $250 million that year) and dangerously seductive to its clients. Successfully deployed, Pegasus essentially owns a mobile phone; it can break down defenses built into a cell phone, including encryption, and gain something close to free rein on the device, without ever tipping off the owner to its presence. That includes all text and voice communications to and from the phone, location data, photos and videos, notes, browsing history, even turning on the camera and the microphone of the device while the user has no idea its happening. Complete remote personal surveillance, at the push of a button.

NSO insists its software and support services are licensed to sovereign states only, to be used for law enforcement and intelligence purposes. They insist thats true, becausemy Godimagine if it werent.

The cybersurveillance system the company created and continually updates and upgrades for its sixty-plus clients in more than forty different countries has made the world a much safer place, says NSO. Tens of thousands of lives have been saved, they say, because terrorists, criminals, and pedophiles (pedophiles is a big company talking point the last few years) can be spied on and stopped before they act. The numbers are impossible to verify, but the way NSO describes it, the upsides of Pegasus, used within legal and ethical boundaries, are pretty much inarguable. Who doesnt want to stop pedophiles? Or terrorists? Who could be against it?

Mission Control, we have a problem, was the message Cherie Blair got from the call that warm summer evening in August 2020.

It had come to the attention of NSO that their software may have been misused to monitor the mobile phone of Baroness Shackleton and her client, Her Royal Highness Princess Haya, Blair explained in a London court proceeding some months later. The NSO Senior Manager told me that NSO were very concerned about this.

NSOs concern appeared to be twofold, according to the evidence elicited in that London court. The first was a question of profile. Pegasus had been deployed against a woman who was a member of two powerful Middle Eastern royal families, as well as her very well-connected British attorney, Baroness Fiona Shackleton. Shackleton was not only a renowned divorce lawyer to the rich and famousincluding Paul McCartney, Madonna, Prince Andrew, and Prince Charlesshe was also herself a member of the House of Lords. Even more problematic for NSO, it was an outside cybersecurity researcher who had discovered the attacks on the baroness and the princess. If hed figured out this one piece of how Pegasus was being used, what else had he figured out? And how much of this was about to become public knowledge?

The caller from NSO asked Cherie Blair to contact Baroness Shackleton urgently so that she could notify Princess Haya, she explained in testimony. The NSO Senior Manager told me that they had taken steps to ensure that the phones could not be accessed again.

The details of the late-night call to Blair and the spying on the princess and her lawyer didnt really shake out into public view until more than a year later, and only then because it was part of the child custody proceedings between Princess Haya and her husband, Sheikh Mohammed bin Rashid Al Maktoum, prime minister of the United Arab Emirates and the emir of Dubai. The finding by the president of the High Court of Justice Family Division, released to the public in October 2021, held that the mobile phones of the princess, her lawyer, the baroness, and four other people in their intimate circle were attacked with cybersurveillance software, and that the software used was NSOs Pegasus. The judge determined it was more than probable that the surveillance was carried out by servants or agents of [the princesss husband, Sheikh Mohammed bin Rashid Al Maktoum], the Emirate of Dubai, or the UAE. The surveillance, according to the judge, occurred with [the Sheikhs] express or implied authority.

The story of the princess, the baroness, and Pegasus might have faded into gossip columns and then into oblivion after a few weeks. A rich and powerful man used a pricey bit of software to spy on his wife and her divorce lawyer? Well, if you marry a sheikh and then cross him, you damn well might expect things to get weird. NSO also did a fairly nice job of cleanup on Aisle Spyware. The court finding pretty much accepted the word of NSO that it had terminated the UAEs ability to use its Pegasus system altogether, at a cost to the company, the judge noted, measured in tens of millions of dollars. And maybe they did, but who can say.

A FUNNY THING happened on the way to that divorce court gossip column item, though. Because right around the time Cherie Blair got that call from Israel, a very brave source offered two journalists from Paris and two cybersecurity researchers from Berlin access to a remarkable piece of leaked data. The list included the phone numbers of not one or two or ten Emirati soon-to-be divorcees, or even twenty or fifty suspected pedophiles or drug traffickers. It was fifty thousand mobile phone numbers, all selected for possible Pegasus targeting by clients of that firm in Israel, NSO. Fifty thousand?

What exactly to make of that initial leaked listthat crucial first peek into the abyssis a question that took nearly a year to answer, with a lot of risk and a lot of serious legwork to get there. The answer to the question matters. Because either this is a scandal we understand and get ahold of and come up with solutions for, or this is the future, for all of us, with no holds barred.

THIS BOOK IS the behind-the-scenes story of the Pegasus Project, the investigation into the meaning of the leaked data, as told by Laurent Richard and Sandrine Rigaud of Forbidden Stories, the two journalists who got access to the list of fifty thousand phones. With the list in hand, they gathered and coordinated an international collaboration of more than eighty investigative journalists from seventeen media organizations across four continents, eleven time zones, and about eight separate languages. They held this thing together miraculously, says an editor from the Guardian, one of the partners in the Pegasus Project. Weve got, like, maybe six hundred journalists. The