Episode Info
- Season2
- Episode5
Hosted by Christina Ruffini and Sir Richard Dearlove
Guests
Laurent Richard
Laurent Richard is a journalist who vows to expose government spying via the NSO Group.
Danna Ingleton
Danna Ingleton is a journalist who vows to expose government spying via the NSO Group.
Episode Summary
Governments around the world can now slip into your DM’s—and everything else—unnoticed. A team of journalists vows to expose it all. Listen to Laurent Richard and Danna Ingleton on the NSO Group.
Listen & Subscribe
- Watch on YouTube
- Listen on Apple Podcasts
- Listen on Spotify
Transcript
COLD OPEN
Richard: Coming up on One Decision. It's like an arms race. I think that this spyware is a weapon. Nothing is safe. It's a it's a wild west.
Ingleton: I think that's the scariest thing about this project is that it is impossible to know. And what this exposes is that it could put all of us at risk. What we're looking at is likely the tip of the iceberg of the truth of the magnitude of this problem.
INTRODUCTION
Kosinski: Hi there. Welcome back to One Decision, where the big decisions that people grapple with can change the world. I'm Michelle Kosinski. Today, we are digging into, pardon my French, some serious spy shit. Actually, one of our subjects is French, but this is the sort of thing nightmares are made of. The kind of tool you only hope is far fetched outside the bounds of a James Bond movie. Only it's real. All too real. Let's take you back to a scene in the UK in June. A terribly somber one. A young woman laid dead at her viewing in London, killed in a bad two car accident. Alaa Al-Siddiq at 33 years old was an activist, director of a nonprofit, outspoken on human rights in the Middle East and in her native UAE, where her father has been a political prisoner for nearly a decade. She had been granted asylum in the UK after spending some time in Qatar. But despite her position, her public profile, what was missing from this final goodbye were her close friends. Many were afraid because of what Alaa had found out a year earlier.
Al-Sadiq: Actually, this makes me feel that I'm punished. I'm being in an exile just for asking for my basic rights.
Kosinski: She worried she was being watched, her communications tracked. Five years earlier, the UAE reportedly tried to get Qatar to send her back to the UAE against her will. Now she was concerned enough to contact a Canadian group that investigates cyber espionage. Her fears, they discovered, were well founded. There were persistent hacking attempts on her phones and a successful hack, a big one, by a spyware called Pegasus created by former Israeli intelligence operatives and marketed to governments around the world through their company, NSO Group, a technology so insidious it can get into and control every part of your phone with no phishing emails, no links to click on, no trace except through forensic analysis by somebody who knows what to look for. And what they found pointed back to her home country, the UAE, as the culprit, as the client that bought and used this spyware to target her. On a list of 50,000 phone numbers leaked from the NSO Group, including journalists, activists, even heads of state, two of Alaa's numbers appeared.
Al-Sadiq: I really love my country, so I want to represent it. I want to see it change, to see it improve, to see the development.
Kosinski: Now she felt invaded, hunted. She changed her life and her habits up until her death in that crash. It's believed she was surveilled this way, all of her communications and contacts vulnerable for six years. Let's bring in Britain's former head of MI6, Sir Richard Dearlove, a man who certainly knows surveillance. Hi, Richard. Very nice to see you again. So the Pegasus spyware was jaw dropping when it came to light. The capabilities, the stealth. However, to someone like you, I would suspect that maybe this was not so shocking at all.
ANALYSIS WITH SIR RICHARD DEARLOVE
Dearlove: Well, let's put it like this. I'm not surprised by the technology and the capability. I guess what I'm surprised by is its use and its deployment. And I'm not surprised it emanated from Israel either.
Kosinski: Right.
Dearlove: Given the number of extraordinary little startups, many of them staffed by former Israeli intelligence officials.
Kosinski: Yes. Yes.
Dearlove: They have a brilliant capability for producing this stuff, which in the wrong hands is highly controversial and pretty, well, very much open to abuse.
Kosinski: Yeah. How long would you say this kind of capability has existed if only for governments?
Dearlove: Quite a long time. I I I'm gonna I'm gonna be, yes, a little careful. What did I say?
Kosinski: Well, when you talk about things leaking out of the lab, now this technology has leaked out of the government lab. In a sense, if you wanna play the devil's advocate here, could you say that something like this, because it is now accessible, it is somewhat equalizing that governments can equally be spied upon as they will spy?
Dearlove: Yes. I suppose so. I mean, where I start from, bearing in mind that my training was more as a poacher than a gamekeeper. You know, I would regard any sort of technical communication as inherently insecure unless you take all sorts of massive precautions. I mean, I was brought up in a world where, you know, you didn't have consequential conversations about any security issue, let's say, if there was any risk of interception, and the risk is is very, very high. I mean, bear in mind, I lived and worked behind the Iron Curtain, and you assumed your house, your car was stuffed with microphones, and it was probably.
Kosinski: Yeah. What about your reaction to who was on that list? Reams of phone numbers of journalists in Mexico to heads of state in Europe. I mean, everybody.
Dearlove: I mean, Mexico is a good example. I mean, you know, the degree of abuse of the law is extensive. And, I mean, the countries that I've seen listed, none of them are particularly surprising. They're the ones where, you know, you you have a tendency towards absolutist government or, you know, a weak legal framework.
Kosinski: What really bothers me is that when you have heads of state on that list, how would their own country's counterintelligence not be able to detect or would not be constantly checking for something like that?
Dearlove: Any sophisticated country has, you know, technical means of making sure that their leadership can't be listened to. I mean, you know, they're using special cipher phones and special lines of communication. And, you know, if you live in that world, it can be massively inconvenient. But, I mean, the problem is that many politicians are so ill disciplined. We've built communications much, much faster than we've built the security to protect us in our use of it. And it's only now that the sort of security side is catching up, but it's catching up rather slowly. It's like an arms race. And there's an awful lot of law breaking and illegal use of these technologies.
Kosinski: How many advanced countries in the world would you say are regularly using tools like this? If not the Pegasus software, then something just like it that they've produced. Is it everybody?
Dearlove: It's not everybody. But I think part of the problem now is that the technology is getting more sophisticated and cheaper, and therefore, government are not gonna have much restraint when it comes to the power that this stuff puts in their hands.
Kosinski: Chilling. And, of course, that is part of the goal of some of these government clients of NSO, to keep opposition groups from communicating and organizing against them. Or far worse goals, NSO spyware reportedly targeted people close to journalist Jamal Khashoggi before and after his grisly murder inside the Saudi consulate in Istanbul. The leak of those 50,000 phone numbers was earth shattering and in some cases vindicating for those targeted around the world. We spoke to two people who made the momentous decisions to expose NSO, including longtime French investigative journalist Laurent Richard. Welcome, Laurent. Tell us about the kind of work you normally do.
INTERVIEW
Richard: For twenty years, for the past twenty years, I'm producing documentaries, investigative documentaries, for the French period TV. Most of the stories were all about environmental crimes, human rights violations.
Kosinski: And of course the type of stories that you do, those are exactly the stories where you are most in danger.
Richard: Yeah. Actually, when you look at for what kind of reasons, what kind of stories journalists being killed today. It's always the same kind of stories, corruption, human rights violation, money laundering.
Kosinski: Laurent himself has been arrested during investigations. Then in 2015, he was working right next door to the newsroom of Charlie Hebdo, where 12 people were gunned down by terrorists.
Richard: That was extremely, yes, traumatized. It took time to recover from that, to think about, okay, what we can do as a journalist to continue the work of assassinated reporters.
Kosinski: He started a collaborative group of journalists called Forbidden Stories.
Richard: To make sure that even if you try to silence the messenger somewhere, you will never kill the message. So we start investigating basically some Mexican drug cartels who were continuing the work of Mexican journalists who were assassinated. And then we discovered that a lot of Mexican journalists were targeted by that software called Pegasus. Amnesty International and Forbidden Stories, the two organizations were at the same time given granted access to a leak containing 50,000 phone numbers entered by customers of NSO. And this is how it's thought.
Kosinski: What was your reaction to it? You must have just been, like, flabbergasted by this.
Richard: Yeah. One of the first things we did was to cross check the data list with our own phone numbers we know from colleagues, from contacts, from sources to see if there were some matches. And we found some matches of people. Immediately.
Kosinski: Immediately. Were any of your personal phone numbers on there?
Richard: No, no. We didn't find our phone numbers. We find phone numbers of colleagues of ours, and we had to tell them that we found them on the list of civilians. But that is extremely difficult, how to communicate with someone that is under surveillance. So we had to be very creative. And so we have to find friends of the people. We have to go physically to meet the person, which was extremely difficult.
Kosinski: So to make that decision to say, I'm going to expose this.
Richard: First, we need to fact check, run some forensic investigation into some device. And we were able to find some traces of infection of the Pegasus at the very same time.
Kosinski: You start realizing how serious it is, how dangerous that spyware is. Okay, so when you go through these channels to notify people, hey, guess what's happening to you right now? What was their reaction?
Richard: What I can do. Did I endanger some people? What is safe and what is not safe? There is no answer to that because there is nothing that is really sure, nothing that is really safe. And even people thought like me that using Signal because it's encrypted was safe, but actually it's not. Pegasus software is like one person behind your shoulder. It's like if you read your message, the Pegasus spyware can read it. And you told the world about this. For the very first time, we were able to show the face of the victims of cyber surveillance that so far governments were telling us, if you have nothing to hide, you have nothing to be worried about. Actually it's not true. We see that if you talk to one journalist you can be worried because you could be the next one on the list. If you a young Mexican person, you want to go to join a protest in the street, you might be on the list. If you are a human rights defenders in Rwanda, in Africa, you might be on the list. So it's basically almost all of us who can be the next one on the list. So this is why it's pretty scary.
Kosinski: Meanwhile, Dana Ingleton in Canada with Amnesty Tech was also trying to get her head around this leak. Their organizations both made the decision to team up, investigate, and expose it, also enlisting dozens of reporters around the world. Project Pegasus.
Ingleton: This is by far the biggest expose on targeted surveillance, unlawful targeted surveillance of civil society and others that I have ever seen. And Amnesty had already been looking at Pegasus for five years as well as other types of spyware. So in the past, you had to sort of click on a link if you received one to be able to be infected. Then we saw with the WhatsApp attack a couple of years ago that you didn't have to do anything if you were a target. You know, there'd be maybe be a missed call on your phone and you would be targeted. Amnesty International also exposed in the Moroccan context something called a man on the side attack where the Pegasus would basically have control of a network that your phone would communicate with. And then so it could basically go in and sell itself, take whatever data it wants off your phone and then uninstall itself making it really hard to find. What we're looking at is likely the tip of the iceberg of the truth of the magnitude of this problem. It's an industry that lacks regulation, that lacks transparency and accountability. You know, a very good example of course related to NSO Group is that their export licenses are actually managed out of the Israeli Ministry of Defense. Meaning, we can't even see the export licenses or the rules around them to hold people to account when human rights violations and abuses do come out of the use of that spyware.
Kosinski: Now the world was beginning to realize what had been happening for years. The volume.
Ingleton: That was really what hit me. It was that this fear of civil society, this paranoia that's been growing and prolific is very real. I mean, the adversaries are trying to know what human rights defenders are talking about, are trying to scare them into stopping that work, are doing network mapping, are doing all of these things that human rights is under attack globally. And it's being proliferated by a private company selling their technology to governments around the world, a number of which have very troubling human rights records and that there is no way to get accountability for it.
Kosinski: At this point, how many governments do you know have been clients of this software?
Ingleton: There are many, many, many, you know, over over 40. Azerbaijan, Bahrain, Hungary, India, Indonesia, Kazakhstan, Mexico, Morocco, Rwanda, Saudi Arabia, Togo, and the UAE. And certainly there are others.
Kosinski: Who is the biggest culprit among the clients that you've seen? Mexico.
Richard: NSO Pegasus was widely used and misused against civilians, against journalists.
Kosinski: Do you know of anyone who was killed who was under this very surveillance? Like, did this Pegasus spyware lead to anyone's murder that you know of?
Richard: What we do know is that we saw the phone number of a Mexican journalist, Cecilio Pineda, who appeared on the list, and three weeks later was killed. So we don't have the proof that the tool was used to kill someone or to prepare the killing, but this can tell you about, okay, what kind of people have been targeted by that kind of spyware.
Kosinski: So as you're going through this mountain of data and trying to match phone numbers with human beings, what surprises or touches you the most about it?
Richard: The scale. All those countries that they are using that kind of spyware to massively target any people who can represent any form of danger to their authorities. So the second thing is that you see how useful that spyware can be for governments who want to track their dissidents. So you escape a country because you were jailed before, then you start living in London or in Paris or in New York, and you can be surveilled. What was really impactful, I think, is to discover how much this is violating your privacy. How do you live after that when you know that all your secrets is somewhere into the hands of the people who want to surveil you. So it's the damage on the human being, on the human person is really big.
Ingleton: The scary thing is, is that we don't know about the potential full size of the list. And with the list that we do have, the amount of potential for human rights violations is huge.
Kosinski: So there are potentially many, many more people out there who are targeted by NSO even today and have no idea?
Ingleton: I think that's the scariest thing about this project is that it is impossible to know. And what this exposes is that it could put all of us at risk.
Richard: There is no limitation. They can activate your videos. They can activate your microphone. And the worst thing is that it's invisible. No sign, no SMS, no strange things, no battery that is falling down. I think this spyware is a weapon. You have some governors in Mexico, you have some dictatorship, dictators in Central Asia or in Saudi Arabia. They want that tool because they want to silence the people.
Kosinski: And such a range of potential targets from activists all the way up.
Richard: What I didn't expect is to see so many political figures, so many head of state. We were expecting some reaction from governments like the French government have been massively targeted, and there is not yet a single strong reaction from Emmanuel Macron or from the French government. And I don't understand why. Maybe it's because they feel a bit ashamed that they learned that from journalists and not from secret services.
Kosinski: Is there any evidence NSO knew this was happening?
Ingleton: That's an interesting question. Amnesty International, before the Pegasus Project, has raised NSO Group a number of times examples of where their tools have been used against civil society. Omar Radi in Morocco and others. Rather than taking that information and acting seriously on it, often what we get in response is, you know, attacks on our research methodology or just claims that our research is completely fake.
Richard: There is a lot of hypocrisy as well because they officially say, that we have an ethics committee. We say no to a lot of states. Of course, you will find some authorities, some judge, some police authorities who can say yes, but we need that to catch the bad guys, to arrest the terrorists. And of course, we have to understand that there are some legitimate reasons to.
Kosinski: It's amazing that you yourself have seen both sides. You've had neighbors murdered by terrorists that could not be tracked and stopped by governments. And you've seen innocent people targeted by spyware that could have stopped such attacks. It's weird, right? Yes, it is. Have you met with NSO personally?
Richard: Have some informal talks. They send us some letters, even from some lawyers, but unfortunately, they were not able to give on the record interview on that.
Kosinski: Is there ever any evidence that they have denied this product to a potential client?
Ingleton: So they've claimed that they've denied the product to a client. We haven't seen any additional evidence of this.
Kosinski: It's strange that as technology advances, your methods to be safe have to regress, like, with sources.
Richard: Yes, it's true. During all that investigation, all the meetings we were having, we were far away from our phones. We put that in large suitcase far away from the room where we met. So we became a little bit paranoid as well because we needed to protect sources. And then if you are targeted, what can you do? So far, we, the citizens, we are not protected by any kind of regulation. So it's a wild west against who you can hack. Like, do you want to sue your government that is denying using that? Can you sue NSO, the company, or anybody else, or Apple or another company that is selling your iPhone and told you that it was safe. So yes, what we start seeing is a global effort to build a new regulation on that market.
Ingleton: People need to be connected. The benefits of our smartphones and what it brings to our personal lives, brings to the world of activism. And we've seen what the benefits are. And the solution certainly isn't not using them. The solution is creating an environment in which it's safe to use them. And I think we need to keep our eye on that prize.
Kosinski: How has it affected people who are on that list?
Ingleton: Yeah. This has been one of the hardest things about working on this project and absolutely devastating to see. You know, automatically, you start thinking, gosh, what have I said on my phone? What do I keep on my phone? What information is there? It's terrifying. And the psychological and the well-being impact of that targets is brutal. And to be frank, the impact on those doing the research can be brutal as well. There's another company Amesys that four executives from that company have recently been indicted with criminal charges related to export of their technologies to Libya and Egypt. So, you know, recognizing that those documents related to torture, you know, privacy violations are one thing. And then if it also leads to a government being able to abuse other human rights because of the information gotten through unlawful surveillance, you start seeing the snowball effect of the implications of this kind of stuff and the impact on humans everywhere.
Kosinski: What have you learned either about the data that you're still going through or the surrounding impact of it that the public doesn't know about yet?
Richard: We were only thinking that governments were targeting people just for the metadata, just to know who is talking to who, but without regarding the content. And now we learn that market, and even if it's NSO today, maybe that's going to be a new NSO tomorrow, new company or 10 other news companies, they can hack and steal your secrets a very fast way, and how your governments will hide this kind of information. And I have to say that we were able to find traces of infection that some specialised service were not able to find, and that's thanks to the work of Amnesty International Security Lab. And this methodology became public after our revelation, and now all the secret services of all countries are using that.
Kosinski: Oh my gosh. Laurent, that is an enormous impact.
Richard: Yeah. Yeah. And that's a fantastic impact actually, because an NGO who was able to create a tool that is extremely useful even for governments. And that's quite fantastic. In the meantime, I'm not sure it's a good signal because we understood that even inside the French authorities that they were not really prepared to face that kind of attack, that kind of cyber attack from governments using this software Pegasus. Now we are only talking about 50,000 phone numbers, but if we don't fix that, we will have millions of phone numbers in two or three years from now.
Kosinski: Yeah. Has this changed your life at all?
Richard: It was exhausting because we worked days and nights. Was a bit dangerous because we know that we were having access to a list that most of the intelligence services of the world want to have access to. So you became a little bit crazy at some point because you need to protect a thing against people who have a lot of means. Because we can speak a little bit about what are they doing with the data they get from you. And what we see is, like in Azerbaijan for instance, you can see many dissidents or the family or the relatives of the dissidents, and videos, private videos of them have been leaked on some Telegram channels. And so they are spying on you because they want to be able to blackmail you over the next five or ten years. If at some point you are a danger for them, they will use it. They will send the video to someone. What is most important that people know about this? Nothing is safe.
Ingleton: This has the implications to impact on us all, and nobody seemed to be very upset about it and nobody seemed to be really taking action on it. And so one of the things that I've been so pleased about since launch is seeing the impact, you know, seeing the parliament of the European parliament debate it for four hours, seeing legislators in lots of different countries taking this seriously. The Indian Supreme Court starting a, you know, a technical investigation into the allegations. Like, seeing movement that may actually help protect all of our human rights is an important outcome of this. It's a little late, however. I think there's so many industries that were regulated late. The Pegasus project was much more than a red flag. I mean, this was a total bombshell that should be exploding how all of us look at this, regular at this lack of regulatory system, and this needs to change. What do you want people to know? That there are laws and regulations that could and should prevent this kind of misuse and to not sort of lose hope. And that actually this company with Pegasus Project is engaging in surveillance that violates human rights. There are international human rights laws that apply to this kind of technology.
Kosinski: Is there other software that is like this out there? Are there other companies just like NSO, or is this clearly above and beyond anything else?
Ingleton: Is the company who's sort of above the parapet right now. Some governments have the capability to do this themselves and then there are companies sort of supporting it and they need to answer to that. They can no longer say that their tools are just used to fight crime and terrorism. People will continue to expose these.
Kosinski: Yeah. It seems like human rights are under assault absolutely everywhere today.
Ingleton: They absolutely are. And that is such an important contextual piece of this whole story. I mean, this isn't happening in a vacuum, particularly with human rights. We've seen over the last ten, fifteen, probably even more years, this increasing and very aggressive criminalization of human rights work.
Kosinski: The exposure of NSO, does it destroy their business, or is this the best marketing tool they could possibly have?
Ingleton: An interesting question. It will be really interesting watching what happens with investors in this. I mean, I think one of the things that we're quite proud of at Amnesty International is, you know, is a tool that's meant to go undetectable, but we were able to detect it.
Kosinski: For sure. Alright, Dana. Well, thank you so much for taking the time. It's great to talk to you, and congratulations on the incredible work you've done.
Ingleton: Thank you for that compliment, and thank you so much for having me on the podcast.
ANALYSIS WITH SIR RICHARD DEARLOVE
Kosinski: I would say you're doing God's work, but most people believe that God sees everything and hears everything anyway. So, hey. That's a different kind of surveillance. Right? Conversation, that one. There are growing efforts now to get justice for victims of surveillance. Amnesty International, on behalf of one of its own colleagues targeted by NSO, filed legal action against the Israeli Ministry of Defense. Dana says the court slammed the door pretty hard in Amnesty's face, but it's a start. And there are other cases brewing, especially in France. The group Reporters Without Borders is looking to bring criminal investigations over this. Let's bring back Sir Richard Dearlove, who has retired from spying, we assume. Alright, Richard. To be honest, I wondered if my phone numbers appeared on that list from stories that I broke in Washington that had international implications, but they weren't on there. It was a strange relief.
Dearlove: I mean, if you want to talk to someone securely, you need to be doing it face to face. And you probably best need to be doing it without a mobile phone anywhere near either of you, unless you're in a very, very secure environment, and very secure environments are suspended copper boxes. You would think, oh my god, what on earth is that? Where you can have a conversation pretty much a 100% confident that you cannot be intercepted. But most politicians who are in power in government lead lives which are so chaotic and fast moving. They forget about security, and they're not brought up to think about it.
Kosinski: But also if you're a journalist trying to expose a severely corrupt and authoritarian leaning government, you don't have access to any of those safeguards.
Dearlove: And you're very vulnerable. Yeah. For sure. You're very vulnerable. And you've just got to assume, you know, that your laptop or your phone is going to be compromised. I mean, you go to China and you're a journalist and you're writing, you know, stories that the PRC leadership don't like, from day one they're gonna be intercepting your communications. And they've got massive, massive resources. You know, it's industrial, the scale.
Kosinski: When we were all in China for a G20 meeting a few years ago, in all of our rooms, the Chinese gave us all of these gifts, pieces of luggage, all kinds of things. And, of course, no one trusted them. Everybody just tossed their suitcases out immediately. Like, everyone just suspected that they were tools for surveillance.
Dearlove: The moment you switched on your iPad. Exactly. Switched on your yeah. I mean, even if you go to these countries, you need to take disposable communications, you know, and dump them.
Kosinski: I mean, otherwise, you're making it too easy. And you know what, Richard? We were all told to do that. We all were basically given classes on things we should be doing, but nobody did it. Of course, they don't.
Dearlove: It's unfortunately.
Kosinski: Maybe now people will because we all feel like we're being spied on all the time by who knows who.
Dearlove: Yeah. Well, I think, you know, we all have problems. I mean, I won't go into detail. Even I have problems from time to time. And it's quite clear that there are people. I don't actually, I don't give a damn any longer. I don't care who listens to me. I haven't got any secrets to hide as it were.
Kosinski: That's the way to be, Richard. That is the way to be.
Dearlove: But there are people still clearly doing that to you.
Kosinski: Do you mean people have infiltrated your private communications? Like, you've had evidence of that. I'm not gonna go into detail. Alright.
Dearlove: Will not be drawn on that. I will not be drawn on that.
Kosinski: Alright, Richard. Thanks. This is such an important subject. Thanks for joining us here on One Decision. I'm Michelle Kosinski. Follow our podcast anywhere and our social media. We, as always, would love to hear your thoughts here on One Decision.
