Pegasus: How a Spy in Our Pocket Threatens the End of Privacy, Dignity and Democracy

Résumé de Pegasus

1. 1

   The Invisible Predator in Your Pocket

   

   00:00

   00:00

   Your smartphone-that intimate extension of your mind containing your most private thoughts-can be weaponized against you without your knowledge. In 2021, the Pegasus Project investigation revealed that NSO Group's military-grade spyware had targeted over 50,000 phones worldwide, including those belonging to journalists, human rights defenders, and even heads of state like Emmanuel Macron. As Edward Snowden remarked: "Stop what you're doing and read this. This leak is going to be the story of the year." This investigation exposed what Rachel Maddow called a "worldwide Orwellian nightmare" and shook the foundations of the unregulated global surveillance industry. Imagine waking up to discover that the device you carry everywhere has been silently betraying your most intimate secrets for months or even years-your location, conversations, photos, and encrypted messages all flowing to unknown watchers.

2. 2

   From Chicken Coop to Global Surveillance Empire

   Commencer l'écoute

   NSO Group was founded by Israeli entrepreneurs Shalev Hulio and Omri Lavie, who were "serial entrepreneurs" rather than cybersecurity experts. After failed ventures and work at CommuniTake developing remote access software, they established NSO when a European intelligence agency approached them about adapting this technology for surveillance. With $1.6 million in venture capital, they operated from a renovated "chicken coop" outside Tel Aviv. Their timing was strategic - focusing on mobile surveillance when most security researchers still targeted desktop systems. By 2011, they had developed Pegasus, named after the mythological flying horse: "a Trojan horse we sent flying through the air to devices." Mexico became their first major client during President Calderon's battle against drug cartels. Mexico's Secretary of Defense quickly signed a $15 million deal after a demonstration. Though Hulio later claimed NSO always vetted clients for human rights compliance, an insider revealed: "If you're a small company struggling to pay salaries and you have ten million dollars coming from a state in Mexico, you don't really think about human rights."

3. 3

   The God-Like Power and Technical Marvel of Pegasus

   Commencer l'écoute

   Once deployed, Pegasus grants operators virtually unlimited access to a target's digital life. The system processes terabytes of intercepted data and infects devices through zero-day exploits - previously unknown software vulnerabilities delivered via personalized text messages with links. The infected phone becomes a perfect spy. Operators can access current and deleted messages, emails, photos, videos, call histories, GPS location, and remotely activate microphones and cameras without detection. The base system monitors 400 phones simultaneously for a year, with expansion options available. Pegasus's brilliance lies in its exploit system. NSO leverages zero-day vulnerabilities unknown to companies like Apple. Modern devices typically require chains of three or more exploits to breach security, each potentially worth millions on the black market. NSO maintained a relentless cat-and-mouse game with Apple. When vulnerabilities were patched, NSO found alternatives within days - a profitable process given their reported $1 million per-target fees. By June 2021, researchers identified the sophisticated zero-click iMessage exploit "Megalodon." NSO cleverly disguised malware by slightly altering legitimate Apple process names (changing "ckkeyrolld" to "ckkeyrollfd"), making it nearly undetectable.

4. Chapitre 4

   The Human Cost of Digital Surveillance

   Pegasus surveillance devastated its targets. Moroccan journalist Omar Radi's case shows how technology transformed from liberation tool to instrument of repression. As an activist exposing how public resources enriched the monarchy's allies, Omar became a target. After Forbidden Stories revealed Omar had been targeted with Pegasus, he was arrested for allegedly working with foreign intelligence and rape. Despite his defiance, he received a six-year prison sentence on dubious charges, his health deteriorating in jail. In Azerbaijan, journalist Khadija Ismayilova faced similar persecution after exposing the Aliyev family's corruption. She endured blackmail and imprisonment until Pegasus infiltrated her phone in 2019. When informed about the targeting, she felt overwhelming guilt for everyone she'd inadvertently compromised. Hungarian journalist Szabolcs Panyi discovered his phone had been compromised, giving the government access to everything he saw, spoke, and wrote. Forensic analysis revealed half of his news organization's staff had been targeted. A former Pegasus operator warns: "These tools generate a feeling of supremacy, of power, of control. And its use becomes perverse." This pattern repeated globally - whenever journalists, activists, or opposition figures challenged powerful interests, Pegasus infections appeared in their devices, stalking prey across borders.

   Chapitre 5

   The Investigation: Exposing the Invisible

   The Pegasus Project began when Forbidden Stories journalists and Amnesty International's Security Lab tackled "the List" - fifty thousand phone numbers targeted by NSO Group's spyware requiring verification. Unlike investigations with explicit documents, this required finding spyware evidence on actual phones. The team created a caller ID operation to match numbers to names, starting with Truecaller. They reverse-engineered code and wrote a Python script to crawl the database, using twenty anonymous phones to identify about 1,200 numbers daily. This digital hunt uncovered significant targets, including members of French President Macron's government and Turkish President Erdogan's son. As media partners joined, the operation expanded to verification through multiple sources and analysis of targeting patterns. In one breakthrough, researchers discovered Pegasus actively infecting Carine Kanimba's phone (daughter of "Hotel Rwanda" hero Paul Rusesabagina) during examination, providing insight into Pegasus operations and helping develop better detection methods. By July 18, 2021, the Pegasus Project launched across seventeen media outlets in ten countries, documenting global surveillance abuse targeting journalists, politicians, activists, and business leaders across continents.

   Chapitre 6

   The Aftermath: A Digital Reckoning

   The publication triggered global shockwaves. NSO initially claimed they "care about journalists and activists" while citing Israeli regulation, but as stories gained traction, their response grew angrier until they declared "Enough is enough" and refused further media inquiries. Official confirmations quickly emerged. France's National Cybersecurity Agency verified findings about targeted journalists and identified additional victims including five government ministers. Other revelations followed: Dubai's emir using Pegasus against his estranged wife, Israel targeting Palestinian activists, and Mexico arresting someone who targeted journalist Carmen Aristegui. Apple responded by patching the Megalodon exploit, developing a Lockdown Mode, and suing NSO as "amoral 21st century mercenaries." The US government blacklisted NSO, cutting them off from American technology suppliers. By November 2021, NSO faced existential threats. Their incoming CEO fled before his official start date, their majority owner had collapsed, and even the Oregon state pension fund questioned its investment. Despite desperate attempts including a proposed "phoenix plan" to offload liabilities, NSO's future looked bleak.

   Chapitre 7

   The Battle for Digital Privacy Continues

   While NSO's decline serves as a cautionary tale, the fundamental problems remain unsolved. Despite numerous government hearings following the Pegasus Project, there has been plenty of "lip-flapping" but little actual regulation. The cybersurveillance industry continues operating without real guardrails. Other companies have rushed to fill the void. The UAE created DarkMatter, hiring NSO's top talent with seven-figure salaries. Similar operations have emerged in countries with advanced tech sectors but limited oversight. Most concerning is that governments who abused Pegasus have faced virtually no consequences. Our phones contain our most intimate thoughts and data, yet Pegasus-style technology can breach this privacy for anyone who attracts powerful attention. Without decisive action, the surveillance technology arms race threatens to reshape the citizen-state relationship. The Pegasus Project revealed how our smartphone can become our most dangerous betrayer.

   Continuer la lecture