New documentary details how governments use spyware to monitor citizens’ phones

John Yang:

This past week, the White House detailed the scope of the massive Chinese hacking campaign that's infiltrated at least eight U.S. telecommunications companies. A foreign power reaping information from American cell phone networks.

But an HBO original documentary called Surveilled, which is available to stream now on Max, says some governments around the world use commercial spyware to monitor their own citizens.

Man:

Spyware is this powerful surveillance tool. Big spyware companies say they sell this tech only to governments. But this multibillion dollar industry is mostly unregulated. The most advanced spyware can turn your smartphone into a spy in your pocket. It can copy everything and record you without you ever knowing and then just disappear without a trace.

John Yang:

Pulitzer Prize winning investigative journalist Ronan Farrow produced the documentary. Ronan, is there a difference between the salt typhoon hack that's been in the news so much and what you're covering, what you report on here?

Ronan Farrow, "Survielled":

Well, there is, but there's also a shared theme here. Our data is becoming more and more accessible, porous. And that goes for critical national security, sensitive infrastructure. It goes for data held by major telecom firms. And it goes for what's examined in this documentary, which is our phones, which fascinated me as a reporter who's dealt with various forms of surveillance.

And then when I saw that the bleeding edge of that technology, of those kinds of efforts were so advanced that you could turn any phone into a listening device if you have the resources, I realized, well, this is not an incidental issue. This is not some esoteric human rights problem that's far away. This is coming for all of us.

John Yang:

You've got an example in the documentary. This is a member of the European Parliament from Catalonia, which is a region in northeastern Spain. This politician favors independence from Spain. You were with him the moment he found out his phone had been hacked. Let's take a look.

Man:

We just received confirmation that your phone was hacked twice. Once on the 11th of June and then again on the 27th of June.

Man:

2020?

Man:

2020.

Ronan Farrow:

When does it look like you were infected?

Man:

I have to check at the date, but around that day, I was appointed member of the European Parliament.

Ronan Farrow:

How do you feel, knowing that you may have been compromised in this way?

Man:

Well, I feel surprised and angry at the same time.

John Yang:

Ronan, who's likely to have hacked that phone, and to what end?

Ronan Farrow:

Well, as you pointed out, in Spain, there is an autonomous region, Catalonia. The capital is Barcelona, where a big swath of the population wants independence for that territory. And it doesn't really matter what you think of that prospect politically.

The point is there's peaceful activists and politicians and protesters and civil society members, journalists covering the issue, who wound up in a massive surveillance dragnet. The Spanish government did admit to at least some of the hacking, and there was a firing of an intelligence chief there.

And I just want to point out this isn't a Spain issue. We've seen a string of these kinds of scandals involving the overreach of spyware and its use to target peaceful political opposition members. We've seen it in Poland, in Greece.

So I think we have to heed the people in the film who are in Western democracies and say, we didn't think it could happen here, but it can happen anywhere.

John Yang:

Talk about that. Talk about the U.S. government. Do they have this capability, and do we know if they're using it?

Ronan Farrow:

So the United States government has one of the most sophisticated surveillance set of capacities in the world. Under the first Trump administration, the FBI purchased Pegasus, the same spyware technology that you saw in that scene infecting the phone of that European Parliament member.

Now, the FBI, initially, when this came out, said, well, we just — we're going to use it to test it and understand what our enemies were doing with that kind of tech. But the New York Times later sued for more information. And it seems very clear that the FBI came pretty close to operationalizing this. It really wanted to.

I just reported in the New Yorker on the fact that this fall, the Department of Homeland Security purchased another powerful form of spyware, also made by an Israeli company. In this case, it's a company called Paragon. And the spyware is called Graphite. And this focuses on hacking, even encrypted messaging apps.

To my knowledge, there aren't known cases of targeting of political opposition members by the U.S. government on U.S. soil. But the history of surveillance in this country is full of those kinds of overreach. The legal framework for this is very porous, John. And you have a new administration coming in that's made it clear that they flout a lot of even that existing legal framework.

John Yang:

In the documentary, you also spoke with a former employee of the Israeli company that sort of at the center of this. This person used to demonstrate the product for potential clients, left the company over ethical concerns. In this clip we're about to play the voices distorted to protect the person's identity. Let's take a listen.

Ronan Farrow:

So you're hacking these phones. What kinds of reactions did you get?

Man:

It's jaw-dropping. It's very impressive the first time that you see it.

Ronan Farrow:

What was the pitch that you were offering these governments?

Man:

Usually we had like one iPhone, one Android device. We used to demonstrate how we can exfiltrate the data from those devices. Actively take snapshots of the screen or pictures from the camera, actively record through the microphones.

Ronan Farrow:

What should the average citizen in any country in the world know about this company and this technology?

Man:

It's very powerful. It's very interesting.

Ronan Farrow:

Should people be concerned?

Man:

Yeah, yeah.

John Yang:

People should be concerned. Is there anything people can do to protect themselves?

Ronan Farrow:

Well, there are limited measures you can take if you're a journalist doing confronting politically charged work. If you're a dissident of some kind, you may want to turn your lockdown mode on in iOS. If you're like most people out there where you're looking at this issue and you're thinking, you know, no one's going to want my nudes. Why do I have to care?

I still think exercise good digital hygiene because the truth is you don't know how your information is going to be used. Turn off your phone every day and reboot it. It's not a fail safe, but it will create a situation where at least some of these types of technology would need to be reinstalled. You'd have to be reinfected after the reboot. So a daily reboot is a really good idea. Update all of your apps, update your operating systems. Every single time there's a patch out, don't sleep on it.

John Yang:

Ronan Farrow, thank you very much.

Ronan Farrow:

Thank you, John.