NSO Pegasus Malware Deployed To Spy On Palestinian Human Rights Activists

from the now-who-would-want-to-do-a-thing-like-that? dept

Another day, another revelation about the abuse of NSO malware by its customers. The latest report shows NSO Group's powerful Pegasus malware was used to target Palestinian human rights activists. Citizen Lab is again on the case, providing the forensic examination of the detected malware and coming to this conclusion:

In October 2021, the human rights non-governmental organization (NGO) Front Line Defenders (FLD) began collecting data on the suspected hacking of the devices of several Palestinians working for civil society organizations based in the West Bank. FLD shared the data they collected with the Citizen Lab and Amnesty International’s Security Lab for separate independent peer review of their initial findings. FLD’s analysis indicated that six devices belonging to six Palestinian human rights defenders were hacked with Pegasus, a spyware developed by the cyber-surveillance company NSO Group. Both the Citizen Lab and Amnesty International’s Security Lab independently confirmed these findings.

Given the targets of the hacking, one would suspect the Israeli government was involved in this targeting of Palestinian activists. Citizen Lab and Amnesty International have made no allegations as to the source of these attacks, but there are some details that suggest Israel's government is involved.

One of those details comes from the Citizen Lab report:

Of interest is the fact that four hacked phones exclusively used SIMs issued by Israeli telecoms companies with Israeli (+972) phone numbers. NSO Group has said that exported versions of Pegasus cannot be used to hack Israeli phone numbers.

If exportation is key to this restriction on targeting Israeli phones numbers, deploying it from home presumably bypasses this protection.

Adding to the perception that the Israeli government might be behind these hacks is the timeline of the attacks and the publication of these findings. The attacks were apparently carried out in July 2020. The three entities investigating the hackings published their findings November 8, 2021. Shortly before these publications, the Israeli government declared the organizations these targets worked for as "terrorist organizations."

Israel on Friday effectively outlawed six prominent Palestinian human rights groups by declaring them terrorist organizations, a major escalation of its decades-long crackdown on political activism in the occupied territories.

The declaration appeared to pave the way for Israel to raid their offices, seize assets, arrest staff and criminalize any public expressions of support for the groups. Most of the targeted organizations document alleged human rights violations by Israel as well as the Palestinian Authority, both of which routinely detain Palestinian activists.

That happened on October 22. On November 6, the dossier that supposedly justified the designation was leaked. And it didn't appear to have much in it to support Israel's unilateral declaration that these rights groups were actually terrorist groups.

A confidential Israeli dossier detailing alleged links between Palestinian human rights groups and an internationally designated terrorist organization contains little concrete evidence and failed to convince European countries to stop funding the groups.

The 74-page document appears to have been prepared by Israel’s Shin Bet internal security service and shared with European governments in May. The Associated Press obtained the document from the online +972 Magazine, which was the first to report on it, along with the Hebrew-language Local Call.

Here's why this matters: it turns the targets from activists to terrorists, which gives the Israeli government permission (albeit in arrears) to engage in malicious hacking of devices. Protections and rights tend to evaporate pretty quickly once a government -- any government -- decides you're a terrorist. Given the lack of solid intel in the dossier, this almost looks like the laundering of previously illegal surveillance activities. It also gives the government permission to do more of the same in the future.

No one's made any accusations (other than noting NSO customers love targeting opposition leaders and activists), but the defensive statements have been delivered anyway. At best, this is some really lazy deflection by the Israeli government and more of the same "hey, we just sell the stuff" excuses from NSO Group.

The Israeli prime minister’s office and the Defense Ministry denied that Pegasus had been used to hack the Palestinians’ phones. An NSO spokeswoman said that the company would not say who used the software and that it did not have access to information about whom the program was used against.

Well, the Citizen Lab report says otherwise. And this non-denial doesn't say the government didn't hack the phones. All it says is that these two government reps are on record denying something that can't actually be denied while refusing to confirm anything about the activists' targeting by the Israeli government.

This all looks pretty shady. And it's unlikely to persuade the US government to drop NSO from its export regulation blacklist, despite NSO's protestations that its largely-unregulated sales to human rights violators contributes to the overall security and well-being of the entire planet.

And there's this postscript, which suggests NSO is now so toxic even one of its principals wants nothing more to do with it. (Google Translated from the original Hebrew.)

Itzik Benvenisti leaves NSO less than two weeks after being appointed CEO. In August, Benvenisti was appointed co-president of the company.

Calcalist has learned that Benvenisti informed the chairman of the NSO board of directors, Asher Levy, on Tuesday that in light of the special circumstances created in the company, he decided that he would not be able to enter the position of CEO.

The "special circumstances?" Apparently it's the ongoing PR nightmare NSO is battling along with its blacklisting by the US government. According to the Calcalist article, Benvenisti said it was not possible to carry out his plans for the company while being blacklisted. One presumes Benvenisti is well aware that remaining with the company would make his name just as toxic as NSO's since there's no reason to believe this is the last negative press the company will generate.

Filed Under: activists, human rights, israel, malware, palestinian, spyware, surveillance

Interpol Has Been Weaponized By Governments Seeking To Hunt Down Critics And Activists

from the can-it-be-fixed? dept

Interpol has become a weapon. The international consortium of law enforcement does have a legitimate purpose. It's there to prevent people from escaping justice just because they've left the country where they've committed crimes. It's a worthy goal, but it's an easily abused mechanism.

For instance, there's Turkey's government, which really wants to keep its top position on the "Most Journalists Jailed" list. It can't do this without the help of Interpol. In 2018, Turkey sent "red alert" notices to Interpol seeking journalists accused of whatever bullshit the government made up in hopes of having police forces in other nations round up the two self-exiled writers the government wanted to punish.

The problem is ongoing. And it may be getting worse, according to this report from Josh Jacobs for The Guardian.

Alongside the growth of [Interpol's] most-wanted list, international legal experts say there has also been an alarming phenomenon of countries using Interpol for political gain or revenge – targeting nationals abroad such as political rivals, critics, activists and refugees. It is not known how many of roughly 66,000 active red notices could be based on politically motivated charges; Interpol does not release data on how many red notices it rejects. But a number of reports, including from the US Congress, the European parliament and academics have documented the misuse of Interpol in recent years. Bromund says: “I don’t think there’s any dispute that […] the number of abusive red notices is growing.”

Using Interpol's alert system to hunt down political opponents and critics violates Interpol's constitution. But constitutions get violated all the time (just look at ours!). But vetting is time-consuming and certain countries are more than willing to swamp the system in hopes of sneaking illegitimate requests through.

And there are certain countries that abuse the process more than others. Russia alone generates nearly 40% of all public red notices, which have been used to target people the government wants to punish for reasons other than what's stated in the notice. Russia is also known to send more informal requests via another Interpol option called a "diffusion," which allows national governments to connect directly with each other with information about wanted fugitives. The breadth of abuse this allows hasn't been quantified but it leads to things like this:

A less-formal Interpol option for hunting fugitives, called “diffusions”, are often regarded as more vulnerable to misuse. Through these alerts, Interpol members can send arrest requests directly to each other. That is how Nikita Kulachenkov, a Russian-born Lithuanian refugee, spent several weeks imprisoned in Cyprus, after he was detained at the airport in 2016 en route to visit his mother.

Kulachenkov faced a five-year prison term in Russia for allegedly stealing a street artist’s drawing. His Interpol alert was issued after he began working on investigations for the Anti-Corruption Foundation in Russia, founded by the opposition politician Alexei Navalny, who was poisoned with the nerve agent novichok last year and is now imprisoned in Russia.

When governments straight up lie to Interpol, it can be difficult for Interpol's vetting staff to disprove allegations or suss out the real reason for the notice. Things get past the filtering system all the time, like the case of Turkmen human rights activist, Annadurdy Khadzhiev, who was detained in Bulgaria after a notice was issued accusing him of embezzling money from Turkmenistan's national bank. The problem was the accusations claimed the embezzlement took place four years after Khadzhiev had stopped working for the bank.

The other problem is known abusers are still allowed to use the system. The report notes Interpol rejected more than 700 of Turkey's requests last year, and yet the country is still allowed to issue red alerts and diffusions. Known human rights horror show Syria has just had its access to Interpol reinstated, over the protests of several members. China is somehow in good standing despite using the system to hunt down Uighur activists who've left the country to avoid near-constant oppression by the government.

Is there an upside? Yes, but it's limited given the number of countries with access to Interpol's system and the abuse that's been observed and documented over the years. Known bad actors are still being given access to the system, but hopefully the system is becoming better at weeding out bogus requests.

Under [Secretary General Jurgen] Stock, Interpol has strengthened its oversight body – the commission for the control of Interpol’s files (CCF), which reviews appeals and can delete red notices – and publishes more information about decisions on complaints. He has also bolstered the specialist squad that reviews notices before they are published. Critics have welcomed the changes, but some say the system is still not robust enough. Stock acknowledges that there is more work to be done. “I don’t have the silver bullet at [this] stage for what else we can do,” he says, but stresses that he is committed to further strengthening safeguards, where possible, during his final three years in the post.

More needs to be done, but at least it's being helmed by a Secretary General who knows work needs to be done, and perhaps more importantly, has been open and direct about the challenges Interpol faces and where it has fallen short of its ideals.

There are no easy answers when it comes to limiting abuse of the red alert system. Interpol could kick out rogue states, but that may just encourage more use of completely extrajudicial measures, like extraordinary rendition or sending state agents to straight up murder political opponents and government critics. At least with Interpol, there's a paper trail that can show how the system is being abused and who's behind politically motivated alerts.

Filed Under: activists, authoritarians, critics, interpol, journalists, law enforcement, red notices, russia, turkey

Investigation: CBP Targeted Journalists, Illegally Shared Info With Mexico, And Attempted To Cover It All Up

from the bad-apples-floating-to-the-top-of-the-barrel dept

A couple of years ago, documents surfaced that showed the CBP was placing journalists, activists, and immigration lawyers on some form of a watchlist, which would allow agents and officers to subject these targets to additional scrutiny when they crossed the border. There were obvious civil liberties implications, ones the CBP seemed largely unconcerned about.

The targeting appeared to be related to the "migrant caravan" that reached the border late in 2018 and performed a mass "incursion" on January 1, 2019. The CBP claimed it had only targeted those people because they had been involved in "violence" near the border late in 2018. It refused to explain what it meant by the word "involved" or how that was enough to ignore First Amendment protections. Nor did it explain why it was deliberately targeting US citizens not suspected to have been involved in any criminal activity. It also did not explain why it shared information on these targets with the government of Mexico, which then assisted in spying on this group of lawyers, journalists, and activists.

The DHS Inspector General opened an investigation [PDF] of these actions. And it has arrived at the conclusion that this all looks pretty bad, but wasn't actually illegal. Read into that what you will.

We did not find that CBP placed lookouts to retaliate against U.S. citizens for performing lawful work related to the migrant caravan. To the contrary, witnesses told us, and contemporaneous emails and documents corroborated, CBP placed lookouts to gain information about suspected illegal activity and then generally sought information consistent with that purpose during the resulting interviews. Although we determined CBP’s lookouts on a number of journalists present at an illegal border crossing were unnecessary, we found no evidence that CBP placed these lookouts to harass the journalists.

But that lead paragraph is misleading. The only thing that still works in context of the rest of the report is "found no evidence."

What this report details is stuff that looks like targeted harassment of individuals -- some of them journalists -- by CBP personnel. And yet, the IG is unwilling -- despite apparent lies from interviewed personnel and deliberate destruction of communications -- to call this what it is: a violation of people's rights for reasons the CBP is unwilling to discuss and actively worked to cover up.

It appears one person was more involved in targeting journalists than anyone else during this time period. This person has also been cleared of wrongdoing by this investigation.

Although we found no evidence in emails or interviews that the EOC [Emergency Operations Center] official who placed these lookouts (EOC Official 1) did so to harass the journalists or for any other ulterior reasons, his subsequent actions, or lack thereof, demonstrate he did not need to place the lookouts.

However, it's hard to believe this official did not order up these lookouts to "harass" journalists or "for any other ulterior reason." There was a stated purpose for these lookouts but this official never bothered to check back in after nominating the targeted journalists for additional harassment by CBP officers.

In one incident, Mexican police identified five American journalists after CBP officials alerted them that CBP officials observed members of the media helping migrants climb a border fence. EOC Official 1 then placed lookouts on the five journalists. The lookouts did not mention the illegal crossing but instructed interviewing officers where to find information about the journalists.

Although EOC Official 1 told us the purpose of these lookouts was to determine whether the journalists had information about the incident, his actions show he actually had no interest in that information. Over the following weeks, all five journalists came back to the United States, and CBP referred them to secondary inspection. Interview records reflect that none of the five journalists were asked about the illegal crossing. In fact, the journalists returned to the United States at various places and times and were therefore interviewed by several different officers. None of the officers asked about the illegal crossing.

It really, really looks like this official just thought it would be fun to subject journalists to secondary screenings.

EOC Official 1 placed more caravan-related lookouts than anyone else and was in regular contact with the TTRT throughout Operation Secure Line. If he wanted to know whether the journalists had information about this incident or other illegal border crossings, he knew how to contact the TTRT. Additionally, EOC Official 1 removed one of the lookouts after the journalist’s third interview, even though according to the interview record, CBP never asked the journalist about the illegal border crossing. If EOC Official 1 no longer needed information about the illegal border crossing at that point, then he also did not need the information when he placed the lookout 9 days earlier.

That wasn't the only case of inappropriate or unjustified targeting. There were more cases, something the system used by the CBP (TECS) appears to allow even though the policy and CBP statements claim that it doesn't.

CBP may place lookouts “only if illegal activity is suspected. The system will not allow a user to indicate that a ‘non-suspect’ is on ‘lookout.’” This last sentence has two possible interpretations. It could mean officials may place lookouts only on people who are suspects of illegal activity, and not on non-suspects; or it could be a description of how the TECS system works.

The footnote to this paragraph makes it clear this is not how the TECS system works:

While the TECS Directive says CBP may place lookouts only when illegal activity is suspected, it allows CBP to create “TECS records” or “TECS subject records” even when there is no suspicion of illegal activity.

This means a lot of lookouts had no direct connection to suspected criminal activity.

Nearly half of the caravan-related lookouts (25 out of 51) were on people for whom there was no evidence of direct involvement in illegal activity. Instead, those lookouts were based solely on the individuals’ associations with other people who were suspected of illegal activity.

Some links were stronger than others. Some "associations," however, were nearly nonexistent.

In one instance, a CBP official placed lookouts on two attorneys who previously crossed the border with someone who was believed to be an administrator of a caravan-related online chat group on WhatsApp. In another example, after a suspected migrant caravan organizer was seen riding in a vehicle, the EOC placed lookouts not only on the owner of that vehicle but also on someone who crossed the border with the vehicle owner one time, 9 months earlier, well before the migrant caravan started traveling towards the United States.

Almost anything can trigger a lookout. And one official (EOC Official 1) was more trigger-happy than most. This official -- who nominated the most journalists -- also refused to remove people from the lookout list when it became obvious they weren't connected to criminal activity and did not need to be subjected to additional screening when crossing borders. What this person did do, apparently, was lie to IG investigators.

EOC Official 1, who was primarily responsible for placing caravan-related lookouts at the EOC, also told us that many U.S. citizens did not need to be interviewed multiple times. Accordingly, EOC Official 1 claimed he went into TECS and removed caravan-related lookouts after individuals were interviewed, but review of TECS data revealed that EOC Official 1 did not remove any of his lookouts on U.S. citizens following their first border crossings. When presented with this information, he maintained that he tried to remove many lookouts and speculated that a technical glitch may have prevented that from happening, but we confirmed that no such glitch occurred. Instead, the evidence demonstrates that EOC Official 1 did not try to remove 18 of his 20 lookouts that resulted in secondary inspections.

Basically, this one official -- who the IG says did not target journalists for "improper" reasons -- targeted a bunch of journalists until it became too much of an embarrassment to ignore.

In fact, EOC Official 1 did not reevaluate or remove his lookouts when he finished his EOC detail at the end of January 2019. Instead, he and his supervisor transferred at least 31 caravan-related lookouts to other EOC personnel without giving any notice or instruction. One official who inherited several of those lookouts stated he did not even learn he was assigned to those lookouts until CBP officers contacted him as they were about to interview the individuals. He recalled that one of the first times this happened, he reached out to EOC Official 1, who originally placed the lookout. EOC Official 1 told him the lookout was no longer necessary, even though he had transferred it to him just days earlier. Still, after this discovery, the EOC did not systematically review the remaining lookouts. Instead, the lookouts remained in place for 2 more weeks, until a media story calling attention to the lookouts spurred the EOC to review and remove 18 caravan-related lookouts it determined were no longer necessary.

In the end, there's no complete absolution for this official. But neither is there any recommendation to discipline this person for using the lookout process as a form of harassment, something the IG report asks readers to infer from paragraphs like these:

Based on our review of all available evidence, we were unable to determine why CBP did not remove unnecessary caravan-related lookouts. We found no direct evidence that CBP kept lookouts active to harass, intimidate, or retaliate against caravan associates. However, EOC Official 1’s vague explanation for not removing lookouts, and the EOC’s disinterest in the repeat interviews, suggest it may not have been entirely accidental. Regardless of whether the EOC intended to punish or dissuade U.S. citizens from traveling between Mexico and the United States, subjecting them to repeated unnecessary inspections can have that effect, as the individual who was referred to secondary inspection four times explained.

Outside of this particularly problematic official, there were other signs the CBP used the lookout list as a way to make things difficult for people officers didn't like.

We found that, in December 2018, a CBP official asked Mexico to deny entry to 14 U.S. citizens affiliated with the migrant caravan, including one individual who was subsequently denied entry into Mexico. CBP may restrict Americans’ rights to travel internationally in certain circumstances, but CBP could not articulate any genuine basis for sending this request and in fact later admitted that the reasons provided to Mexico were not true.

And if the IG didn't find any communications indicating these nominations were done for improper reasons, it's probably because any communications pertaining to possibly illegal targeting were never memorialized, so to speak.

We found that on eight other occasions, CBP officials improperly sent Mexico the names and sensitive information of dozens of additional U.S. citizens, and some of those individuals were later denied entry into Mexico. However, because these CBP officials did not comply with CBP policies on sharing information with foreign entities and did not retain communication records, we cannot determine whether the officials asked Mexico to deny entry to those Americans.

It's harassment.

FOB Official 1 could not offer any reasons to us for asking Mexico to deny entry to the 24 individuals listed in his email. He could not recall anything about most of the 24 individuals, other than he did not think they were involved in illegal activity. In fact, FOB Official 1 initially denied that he ever asked Mexico to reject any individuals and insisted he did not remember this email until we showed it to him. FOB Official 1’s concerns about the 24 individuals could not have been particularly serious, because when we interviewed him, he could not recall what the concerns were or why they prompted him to ask Mexico to deny entry to those individuals, even though he said this was the first and only time he ever sent such a request.

And it was covered up.

Also, in January 2019 another FOB official (FOB Official 3) used his official CBP email account to send unencrypted SPII of six U.S. citizens to a Mexican intelligence official’s Yahoo email address. FOB Official 3 told us he sent the email so the Mexican official could provide information to help prevent a “very serious” threat from occurring. Yet, FOB Official 3’s email does not request any information from the Mexican official, and instead of mentioning a future threat, the email says the six individuals may have been involved in a past event. We were unable to clarify this inconsistency or determine the true reason FOB Official 3 sent this email, because he admitted deleting contemporaneous WhatsApp messages with this Mexican official.

More on the coverup, including the use of WhatsApp as a tool for opacity.

The CBP officials’ inability to recall key details about their communications with Mexican officials, or in some cases, whether they even shared information about U.S. citizens with Mexican officials, raises questions about whether there were other instances of Mexican and CBP officials’ sharing information about American caravan associates. Complete WhatsApp records would have shown whether CBP officials shared U.S. citizens’ SPII with Mexico on other occasions.

The fact that none of these officials retained their WhatsApp messages, and the various ways in which that happened, highlights the challenges of satisfactorily upholding recordkeeping responsibilities when CBP employees use WhatsApp. This is particularly troubling given the widespread use of WhatsApp during Operation Secure Line. Numerous CBP officials, across various offices, regularly used WhatsApp to communicate both with individuals and in various WhatsApp groups, some of which contained up to hundreds of U.S. and Mexican officials. Yet, these officials did not consistently retain their WhatsApp messages or copy or forward them to their official CBP accounts.

At the end of all of this, there are recommendations to clarify policy and better document lookout nominations and interviews. Nowhere in the report are there recommendations to punish anyone involved in this or forbid the use of self-destructing communications to preemptively erase evidence of misconduct or rights violations. So, unless the CBP is willing to step up and discipline those involved in this targeting, it will happen again and again and again. And since we can count on the CBP to take a hands-off approach to internal oversight, we can expect history to repeat itself.

Filed Under: 1st amendment, activists, cbp, immigration, journalists, lawyers, retaliation, surveillance, watchlist

Investigation Finds NSO Malware Being Used By The Bahrain Government To Target Activists And Dissidents

from the truly-unsurprising-development dept

More bad news for Israeli malware purveyor NSO Group. Despite its contradictory and simultaneous claims that it does not allow its customers to abuse its products and that it has no way of monitoring use of its products, more evidence continues to surface that shows the company's customers are deploying NSO's malware to target journalists, activists, prominent politicians, and religious leaders.

Citizen Lab -- which has uncovered plenty of abusive use of NSO malware previously -- has released another report showing an abusive government abusing NSO spyware to spy on activists opposed to the country's current leadership. The investigation also confirms something NSO has repeatedly denied: that the list of numbers leaked to journalists and investigators is actually a list of potential targets of NSO's customers. That list included plenty of journalists, activists, politicians, and religious leaders.

Perhaps the most worrying thing about this report is the use of an exploit that bypasses security measures activists would logically adopt: refusing to click on links sent by unknown senders.

We identified nine Bahraini activists whose iPhones were successfully hacked with NSO Group’s Pegasus spyware between June 2020 and February 2021. Some of the activists were hacked using two zero-click iMessage exploits: the 2020 KISMET exploit and a 2021 exploit that we call FORCEDENTRY.

The hacked activists included three members of Waad (a secular Bahraini political society), three members of the Bahrain Center for Human Rights, two exiled Bahraini dissidents, and one member of Al Wefaq (a Shiite Bahraini political society).

And here's at least partial confirmation that the leaked list of potential targets has something to do with NSO Group and its customers:

We shared a list of the targeted phone numbers we identified with Forbidden Stories. They confirmed that numbers associated with five of the hacked devices were contained on the Pegasus Project’s list of potential targets of NSO Group’s customers, data that Forbidden Stories and Amnesty International describe as dating from 2016 up to several years ago.

If NSO Group is serious about preventing abuse of its products, the first step it could take is refusing to sell exploits to abusive governments. As Citizen Lab points out, Bahrain's government has a long history of human rights abuses. While things improved slightly and briefly around the turn of the century, everything reverted back to the abusive mean a decade later, when reforms were rolled back and the government went back to imprisoning and torturing dissidents, critics, and anti-government activists.

And you can't find people to jail and torture without domestic spying, which the Bahraini government enthusiastically engages in. That apparently includes spying on activists and dissidents who have left the country. The report says two Bahrain citizens who now live in London were hit with NSO malware. But this may have been a proxy hack on behalf of the Bahrain government. Citizen Lab notes it has only seen the Bahrain government deploy malware in its own country or in neighboring Qatar. So, these hacks may have been performed on its behalf by a friendly government with its own set of NSO malware.

In conclusion, NSO Group is complicit in the surveillance, imprisonment, torture, and silencing of activists around the world. The company claims it is selective about who it sells to and that it takes action when there are reports of abuse, but neither of these statements can possibly be true.

While NSO Group regularly attempts to discredit reports of abuse, their customer list includes many notorious misusers of surveillance technology. The sale of Pegasus to Bahrain is particularly egregious, considering that there is significant, longstanding, and documented evidence of Bahrain’s serial misuse of surveillance products including Trovicor, FinFisher, Cellebrite, and, now, NSO Group.

Once again, if NSO's statements about preventing abuse are going to be taken seriously, the company needs to dump customers with proven track records of human rights abuses. That's the bare minimum it can do to prevent its exploits from being used to target people governments just don't like. If these tools have been developed to fight dangerous crime and terrorism, the worst thing to do is place them in the hands of governments whose actions are criminal and often indistinguishable from terrorism.

Filed Under: activists, bahrain, dissidents, malware, pegasus, spyware, surveillance
Companies: citizen lab, nso group

Leaked Data Shows NSO Group's Malware Was Used To Target Journalists, Activists, And World Leaders

from the not-your-usual-bad-guys dept

A massive data leak has confirmed what's been suspected (and reported by security researchers like Citizen Lab) for a long time: Israeli malware developer NSO Group's powerful cellphone snooping tools have been used to target journalists, activists, and dissidents all over the world.

The Guardian and 16 other media outlets have dug into the data leak and uncovered some pretty disturbing info about NSO's Pegasus malware, which allows those deploying the spyware to extract messages, record phone calls, and surreptitiously activate microphones.

Who's in the list of phone numbers seen by the Guardian? Lots and lots and lots of journalists.

The leak contains a list of more than 50,000 phone numbers that, it is believed, have been identified as those of people of interest by clients of NSO since 2016.

[...]

The disclosures begin on Sunday, with the revelation that the numbers of more than 180 journalists are listed in the data, including reporters, editors and executives at the Financial Times, CNN, the New York Times, France 24, the Economist, Associated Press and Reuters.

Here's who's included in this first revelation by the Guardian:

[J]ournalists who were selected as possible candidates for surveillance by NSO’s clients work for some of the world’s most prestigious media organisations. They include the Wall Street Journal, CNN, the New York Times, Al Jazeera, France 24, Radio Free Europe, Mediapart, El País, Associated Press, Le Monde, Bloomberg, Agence France-Presse, the Economist, Reuters and Voice of America.

Also found on the list was the number of Mexican reporter Cecilio Pineda Birto, who was murdered while waiting for his pickup to finish being cleaned at a local car wash. This followed weeks of death threats that began after his reporting accused state police and local government officials of colluding with crime lords.

It's not just journalists being targeted by NSO's powerful malware. The list also includes numbers linked to religious figures, executives of private companies, union officials, high-ranking government officials, and NGO employees.

NSO, for its part, continues to insist it's not the bad guy here. It says it only sells the software to a "select group" of "vetted" government agencies. Unfortunately, that list of approved governments includes notorious human rights violators like the Saudi government (which killed Washington Post reporter Jamal Khashoggi) and agencies in the UAE, Bahrain, and Kazakhstan.

The government of Mexico is one of NSO's most enthusiastic users. It "selected" 15,000 of the 50,000 numbers recovered in the data leak. This doesn't mean 15,000 successful deployments but it does mean the Mexican government -- which has no shortage of local criminals to target -- also apparently tried to infect phones owned by journalists.

NSO's hands are far from clean. Its list of clients isn't as selective as it likes to pretend. And while it may tell purchasers the spyware should only be used to target criminals and terrorists, it doesn't yank licenses from governments that choose to target journalists, academics, religious figures, and others.

Filed Under: activists, governments, journalists, malware, snooping tools, spyware, surveillance
Companies: nso group

Obnoxious Repair Monopolies Keep Turning Farmers Into Activists

from the this-isn't-going-away dept

Back in 2015, frustration at John Deere's draconian tractor DRM helped birth a grassroots tech movement dubbed "right to repair." The company's crackdown on "unauthorized repairs" turned countless ordinary citizens into technology policy activists, after DRM (and the company's EULA) prohibited the lion's share of repair or modification of tractors customers thought they owned. These restrictions only worked to drive up costs for owners, who faced either paying significantly more money for "authorized" repair (which for many owners involved hauling tractors hundreds of miles and shelling out thousands of additional dollars), or toying around with pirated firmware just to ensure the products they owned actually worked.

Six years later and this movement is only growing, thanks in large part to farmers who are tired of getting ripped off:

"Schweitzer wound up sending his tractor to the dealer. He says it took about a month for the repair to get done. His bill to replace the fuel sensor? Nearly $5,000. He says a local independent mechanic would have charged only a small fraction of that. Schweitzer was fortunate he had an old backup tractor, so his crop didn't get ruined, but the experience made Schweitzer eager to fight for change."

Hoping to appease angry consumers and lawmakers, in late 2018, John Deere and a coalition of other agricultural hardware vendors promised (in a "statement of principles") that by January 1, 2021, Deere and other companies would make repair tools, software, and diagnostics readily available to the masses. But then it turned around and ignored those promises completely. Meanwhile, the support headaches for many of these farmers continues, according to Kevin O'Reilly of U.S. PIRG:

"I myself called 12 different John Deere dealers in six different states, asking to try to buy the software tools and diagnostics that you need to fix your tractor, and at 11 of the 12, I was told that I couldn't buy them. Sometimes I was told they didn't even exist. And then the 12th gave me an email address to reach out to, which I had never heard back from."

John Deere certainly isn't alone in trying to monopolize repair, resulting in massive backlash and proposed legislation in a growing parade of states. But companies like John Deere, Apple, Microsoft, and others have been brutally effective in using grotesque and false arguments to scuttle such legislation so far. Including claims that right to repair reform poses vast privacy and security risks (not true, says the FTC), or that improving repair options emboldens sexual predators and rapists.

27 different right to repair laws were proposed this year, some of them improving repair options for essential medical equipment during COVID-19. But thanks to a coalition of wealthy companies fighting tooth and nail against reform (using a variety of dodgy and false claims), not a single one has passed so far. That's working out well for companies like Apple and John Deere, but it's abundantly clear that when your obnoxious repair restrictions keep turning rural farmers into hard-nosed activists, you might be facing a tough fight over the longer haul.

Filed Under: activists, eula, farmers, ownership, right to repair, tractors
Companies: john deere

During A Police Raid, Russian Activist Uses Drone To Whisk Sensitive Data To Safety

from the video-or-it-didn't-happen dept

Drones have moved beyond the novelty stage, and are now capable of having a global impact. That was shown most dramatically by the recent drone attack on the world's largest oil processing facility in Saudi Arabia. The loss of production has caused the price of oil to spike, and fears about a global recession to mount -- all because of a few tiny drones. An article in the Guardian suggests:

Drones are now an integral part of the inventory of the region's most advanced militaries, and the also-rans. Non state actors have been clamouring to secure them as well -- convinced by the utility of hard-to-detect, dispensable flying toys to be used as weapons of war.

But as Techdirt has noted before, drones are not all about death and destruction. BBC News has an interesting example of a novel use from Russia. It concerns a police raid on the flat of Sergey Boyko, who heads the local branch of the movement of opposition leader Alexei Navalny. Raids were conducted in more than 40 cities across the country, allegedly investigating money laundering, something denied by Navalny's supporters. Elsewhere, the police seized activists' computers and mobile phones. But they came away empty-handed from their raid on Boyko, thanks to the use of a small drone:

The drone was loaded with various hard disks, solid-state drives and flash sticks containing "very important" information that he did not want to fall into the police's hands, according to the activist.

"Done. The evacuation has been carried out. The drone reached its destination," he says at one point.

The drone's destination was an unnamed friend of Boyko, presumably not an obvious one that the police might easily find in their search for the data. Boyko was clearly expecting to be raided. He not only had the presence of mind to have a drone to hand for the delivery, but he also recorded the police raid as it was happening. The video concludes with a plea for viewers to support the Navalny campaign financially -- a neat way of using the police raid against the authorities who ordered it. The whole episode is another indication of how Russians seem able to keep calm in even the most difficult situations, which is probably just as well given the way that some people drive there.

Follow me @glynmoody on Twitter, Diaspora, or Mastodon.

Filed Under: activists, drones, russia, secrecy, sergey boyko, strategy, technology

Mexican Government Pitched In To Help The CBP Spy On Journalists, Activists, And Lawyers

from the odd-coupling dept

The CBP has an unlikely partner in its surveillance of journalists, activists, and lawyers: the Mexican government. It's not going to pay for The Wall™, but it's apparently willing to help out in other ways.

A government review of how journalists, attorneys, immigration advocates, and activists were monitored and tracked by U.S. border agencies confirms the Mexican government had a major role in the controversial tracking program.

In a letter dated May 9, 2019, Randy Howe, Executive Director of Field Operations for U.S. Customs and Border Protection (CBP) notes that “...CBP partnered with the Government of Mexico [to] address developing threats…” posed by the Central American Migrant caravan.

“A number of journalists and photographers were identified by Mexican Federal Police as possibly assisting migrants in crossing the border illegally and/or as having some level of participation in the violent incursion events,” CBP’s letter states.

Mexican government officials originally stated the government was not involved in this controversial surveillance. These assertions have been undercut by a statement written in response to a letter from a coalition of press outfits and rights groups demanding to know why the CBP and DHS were adding First Amendment violations to their long list of Fourth and Fifth Amendment violations.

Here's the Mexican government's original statement, which has suddenly aged very badly.

“The government of Mexico disapproves of all acts of illegal espionage against any person, domestic or foreign. The Mexican government does not conduct illegal surveillance on anyone, for any type or category of activity,” a statement read.

I guess it all depends on how you define "illegal." Or "surveillance." Maybe the federal police limited themselves to adding people to the CBP's watchlist. Perhaps this sort of surveillance isn't illegal in Mexico. But it's definitely on the illegal side here in the United States. If it's not a legal issue on the other side of the border, then the CBP and DHS are basically using a foreign government to engage in surveillance they're not allowed to perform on this side of the fence.

It doesn't appear the CBP and DHS are all that concerned about the possible Constitutional violations they're engaged in themselves. The letter the CVP sent says the agency was only trying to round up people trying to assist migrants in crossing the border illegally, which somehow included journalists covering the border caravans and immigration lawyers trying to help people through the asylum process.

The CBP does admit it will periodically violate Constitutional rights, but it claims these violations are only minor speed bumps on the road of American life.

Occasionally, CBP may inconvenience law-abiding persons in our effort to detect, deter, and mitigate threats to our homeland.

Well, I'm glad that's all cleared up. The CBP does not engage in illegal surveillance (except when it does) and does not target protected First Amendment activities (except those occurring near the border) and only in the interest of national security does it ignore rights guaranteed by the Constitution of the United States. And it's doing all this with a foreign government's help -- a government that denied it had anything to do with this surveillance when first asked about its involvement.

Filed Under: activists, cbp, journalists, mexico, spying, surveillance

Coalition Of Rights Activists And Journalists Wants To Know Why DHS, CBP, And ICE Are Spying On Activists And Journalists

from the can't-be-authoritarian-without-exceeding-your-authority dept

Early this March, documents obtained by NBC San Diego showed the DHS was targeting journalists. activists, and immigration lawyers for enhanced screenings and device searches by the CBP. The previously-secret database held dossiers on people suspected of doing nothing more than participating in Constitutionally-protected activity.

The DHS provided no explanation for this collection of dossiers. The CBP attempted to explain its participation in rights violations by first claiming it was necessary to secure the border. Then it said every one of the 59 journalists, lawyers, and activists in the leaked documents were "present" during "violence" that "broke out at the border" last November. That these people would be present at such an event is unsurprising, given the amount of attention being paid to our southern border and immigration in recent months. That the CPB would decide this justifies dossiers, enhanced screenings, and invasive device searches is a bit more disturbing, as it has the potential to negatively affect a number of Constitutional rights.

The Center for Democracy and Technology -- along with dozens of humans rights activists and journalist entities -- have sent a letter to the head of the DHS, demanding this surveillance stop immediately and that an investigation be opened to determine this effort's origins, as well as its extent. It also demands DHS and CBP hand over all policies, guidelines, and documents detailing what information the agencies collected during this possibly-unlawful surveillance.

But there's more to the letter than demands and expressed concerns. CDT's letter also recounts further details that have come to light over the past couple of months, including ICE joining the unconstitutional party to engage in immigration and customs enforcement by… surveilling political protests?

In addition to CBP, ICE engaged in questionable conduct that threatens the rights of free expression and association. ICE-HSI created a spreadsheet of protests that occurred in New York City between July 21 and August 17, 2018. The list contained the names of the groups sponsoring each protest, the political goal of the protest, and the number of people who signed up on Facebook to attend the protest. One spreadsheet was labeled “Anti-Trump Protests.” ICE’s surveillance activity does not appear to be predicated upon any suspected violation of a law ICE enforces.

While we do not see evidence that ICE created records with personally identifying information, it is unambiguous that ICE documented First Amendment-protected activity, which may violate the Privacy Act of 1974 and warrants further investigation. To the extent ICE is monitoring and creating records of First Amendment-protected activity of U.S. citizens and lawful permanent residents, and to the extent such records are not pertinent to and within the scope of its authorized law enforcement activity, such conduct is in violation of the Privacy Act.

The DHS and its subsidiaries are keeping the homeland secure by using Constitutional rights as a doormat. There's nothing about this surveillance and targeting that even remotely suggests the end result will be a safer America. There can be little doubt these activities are being engaged in almost solely for the purpose of dissuading journalists from covering border activities, immigrants from finding good legal representation, and activists of all sorts from expressing their displeasure with the government.

The answers these entities are seeking probably won't arrive any time soon. Most likely, it will take pressure from Congress, along with a number of FOIA lawsuits, to make this information public. The current administration seemingly has no problem with the collateral damage its border-focused directives are creating. And with zero pressure to fall in line with the Constitution coming from up top, it's likely these abuses will continue unabated for immediate future.

Filed Under: 4th amendment, activists, cbp, dhs, ice, reporters, surveillance

CBP Put A Bunch Of Journalists, Immigration Lawyers, And Activists On A Secret Watchlist

from the fuck-the-Constitution-I-guess dept

Leaked documents obtained by an NBC affiliate show the government has taken a direct interest in journalists and activists covering the many, many happenings at our southern border. But the government isn't interested in keeping them safe or giving them the space to do their jobs. Nope, the CBP has been treating journalists like suspected criminals, hauling them in for hours of questioning and examining the contents of their phones and laptops.

Oh well. I guess the First Amendment had a good run.

Documents obtained by NBC 7 Investigates show the U.S. government created a secret database of activists, journalists, and social media influencers tied to the migrant caravan and in some cases, placed alerts on their passports.

[...]

One photojournalist said she was pulled into secondary inspections three times and asked questions about who she saw and photographed in Tijuana shelters. Another photojournalist said she spent 13 hours detained by Mexican authorities when she tried to cross the border into Mexico City. Eventually, she was denied entry into Mexico and sent back to the U.S.

The documents (which appear to be screenshots of the CBP database) show an extensive list of journalists and activists, along with notes stating whether or not the person was interviewed and/or placed on a CBP "alert" list. The surveillance of protected First Amendment activities is apparently part of the DHS's "Operation Secure Line," which monitored the caravan travelling through Mexico to the US border.

Here's who's on the list, according to NBC 7's investigation:

The individuals listed include ten journalists, seven of whom are U.S. citizens, a U.S. attorney, and 47 people from the U.S. and other countries, labeled as organizers, instigators or their roles “unknown.” The target list includes advocates from organizations like Border Angels and Pueblo Sin Frontera.

The CBP's first statement said this all just normal border-protecting stuff. According to its initial deflection, adding journalists and activists to watchlists that targeted them for enhanced screening and other unpleasantness is all part of the government's plan to address the multiple caravans headed for our borders. The CBP statement does not explain why targeting lawyers, activists, and journalists is considered an appropriate use of government resources. In fact, it doesn't attempt to address the database and its contents at all.

And it's not just secondary screenings and hours-long interviews of people engaging in protected speech. The DHS is apparently compiling entire dossiers about this group of targets -- none of which is suspected of participating in criminal behavior. According to a DHS source quoted in the article, the agency doesn't have the authority to compile information on people not suspected of criminal activity. As the unnamed person notes, DHS isn't an intelligence agency. It's a law enforcement agency.

CBP now appears to be in panic mode. An update added to the story indicates the agency is throwing any justification it can against the wall in hopes of something sticking.

Minutes after our story published and five days after a Customs and Border Protection spokesperson gave us the agency's statement above, CBP told our colleagues at NBC News that the names in the database are all people who were present during violence that broke out at the border in November. The agency also said journalists are being tracked so that the agency can learn more about what started that violence. CBP never clarified that point directly to NBC 7 Investigates.

Even this hasty course correction is a spectacular failure of logic. The CBP is investigating a confrontation at the border... by placing journalists, lawyers, and activists under surveillance? That makes no sense. The CBP can speak to these people without placing them on an alert list and subjecting them to enhanced screening and device searches. If the agency needs to interview witnesses, there are processes for that -- none of which look like an attempt to chill press freedom and pro-immigrant activism at the border.

Filed Under: activists, cbp, customs and border patrol, immigration, journalists, lawyers, watchlist