LAURENT RICHARD: The device that you have in your pocket could be a spy that is spying on your life.
RANEY ARONSON-RATH, HOST: In 2020, the journalism nonprofit Forbidden Stories, along with Amnesty International, got access to a leaked list of more than 50,000 phone numbers. They suspected the list contained numbers selected for potential surveillance with a powerful spyware, called Pegasus.
SANDRINE RIGAUD: Pegasus was designed to infect phones like iPhones or Androids.
RANEY ARONSON-RATH: They were right.
NEWS ARCHIVE: Activists, lawyers and journalists are reportedly among those who've been targeted by the phone spyware—
RANEY ARONSON-RATH: Together with journalists from sixteen other newsrooms around the world, including FRONTLINE, Forbidden Stories began a year-long investigation into the spyware.
PAUL LEWIS: This could be transformative in terms of our understanding of the whole cybersurveillance industry.
RANEY ARONSON-RATH: They uncovered how Pegasus had been used on journalists, human rights activists, the wife and fiancée of the murdered Saudi columnist Jamal Khashoggi, and others. Global Spyware Scandal: Exposing Pegasus is the new, two-part series from FRONTLINE and Forbidden Films that goes behind the scenes of the investigation, and it chronicles the responses from governments and institutions seeking to govern the largely unregulated spyware industry. I’m joined by Laurent Richard, founder and executive director of Forbidden Stories, and Sandrine Rigaud, the organization’s editor-in-chief. I’m Raney Aronson-Rath, editor-in-chief and executive producer of FRONTLINE, and this is the FRONTLINE Dispatch.
RANEY ARONSON-RATH: Laurent and Sandrine, thank you so much for joining me today.
LAURENT RICHARD: Hi, Raney. Thank you for having me – having us.
SANDRINE RIGAUD: Thank you.
RANEY ARONSON-RATH: If you would, tell me about what is Pegasus? And then when you started to understand what Pegasus was, how did you think about how you would be able to show that?
LAURENT RICHARD: Yeah, so just to explain Pegasus — Pegasus is a spyware that is able to take control of your device. That mean activate your camera, activate your phone. It's like I said, during the documentary, it's like a person over your shoulder who will read everything that you are reading, even your encrypted messages. So that's a very sophisticated spyware built by people — some of them are coming from the military and it's considered legally in Israel uh, as a weapon. So it's a military weapon used against civilians. So as a citizen, whether you are journalists or lawyers or political opponents, you really can't do anything against that. So for us, when we start on our side as journalists, when we were getting access to that list, starting to understand that it was about Pegasus, starting to understand that we were talking about thousands of victims all around the world, we understood as well that we need to explain that. So as a producer, the challenge was how to explain something that is extremely virtual, that you can't see. You cannot observe physically an infection. We call that an infection. So the way to do to, to do that for us was so as well to film every step of the investigation, so we can understand what's what, what is at stake. And then of course, we were having our cameras behind the shoulder of Amnesty International Security Lab, Claudio Guarnieri, on the computer to track, uh, the traces of infection. So this is the way we try to explain what was Pegasus, and how it works, and how it's a traumatic experience when you are the victim.
RANEY ARONSON-RATH: Right. And, Sandrine, when you started to learn about this, I mean were you surprised at the capabilities of Pegasus? Of course, you know, by the time you shared it with all of us you had absorbed it quite a bit. It was a number of months in. So, what was going through your mind?
SANDRINE RIGAUD: So, you first think of everything you have in your phone. I mean, just imagine how many secrets are stored in your phone, your passwords, your photos, your Google search. Everything is on your phone today. And probably your phone knows more about you than your husband, your kids, your colleagues. So, Pegasus — when you understand how Pegasus can be intrusive and can enter your phone, um, without you having, um, even the slight idea that it is in there. It's just the worst nightmare that could happen. And for an investigative journalist who's in contact with sources, people they need to protect, Pegasus is, is just the, the worst, worst weapon that could be used against an investigative journalist.
RANEY ARONSON-RATH: Tell me about the moment in which you both received the leak and what that felt like, and, and, and I know you can't go into great detail, but tell me as much as you can about that moment.
LAURENT RICHARD: So we, when we got access to the leak, uh, of course we immediately realized how huge the story will be, how difficult the journalism and the investigation will be, how dangerous our reporting will be. And we knew that we should be a lot of journalists working on that. When we got access to the leak, that we needed a collaboration to address that, to investigate properly, this. And both our organization and Amnesty International were granted access to that huge leak with only phone numbers. So that was just the beginning. Many things to do to identify the numbers, to find names behind the numbers, and to build some stories to understand what was the context of that kind of targeting, if the people were really targeting. So that was just the beginning. And of course we cannot say, um, anything more about who was providing that.
RANEY ARONSON-RATH: Yeah, I mean, that, that makes a lot of sense. So I, I wanna ask you and Sandrine a question about the fact that you started to film. What, what went through your minds when you decided we should document this? And how complex was that at the beginning?
SANDRINE RIGAUD: Laurent uh, and myself have both directed documentaries before, so we understand the strength of, uh, um, of filming and, and, and documenting an investigation having a camera, uh, with you, um, all the time. Um, we immediately realized that this was big and this, that this was a almost a one, one life story for a journalist. I mean, there are huge stories like the the Panama Papers, the, the Snowden, um, revelation that, that make the big news. Pegasus was, was something from that scale. And, um, and so with that experience of, of making film, um, we decided, uh, quite immediately that this had to be documented. And, and this had to be documented live because, uh, we could not reconstruct this, uh, later on and, uh, and we were living very intense moment. So I think that intensity, uh, appears in the, in the film. We've all done big investigations here, and we know that sometime investigations is really not sexy and boring. I mean, you, you spend your day behind a, uh, a computer. You, you do some phone calls, but from the beginning, That investigation was quite different. We, we had to, um, set up security protocols, contact, uh, people who might have been under surveillance, travel, uh, in a period of, of, of covid, uh, uh, analyze phone, convince people who have been potentially hacked to, uh, to give their phones. We had brainstorming session with our partners on the timing. Uh, when shall we send the request for comment? Uh, what was the best, uh, period for that? How do you contact a source? What security you need to take? So, I mean, all these questions were, were, uh, we're making that investigation, uh, something that was very, uh, interesting to film and, and, and to understand for, for the audience.
RANEY ARONSON-RATH: Sandrine and, and Laurent, you came to visit us in Boston. Um, and when we first sat together, you showed me some sequences that you had been filming; when you guys came, you know, it became abundantly clear that you had to really think about security even as we were screening even not the most, um, confidential material. So how much time and energy went into that to keep the information secure?
SANDRINE RIGAUD: Uh, clearly that , that was almost half the job, um, because we had to invent a new, new ways to communicate, get new devices, uh, create new protocol, analyze the risk. And, um, and of course this was also, uh, the case for the filming. Uh, filming might be a very touchy part because everything is in there. You, you, you can take care of, of the security of your exchanges, of the documents you exchange. But, uh, you have to be extremely and even more careful with the, the footage you have. And, and so, uh, of course we won't get into the detail, but the, the, the, uh, the footage was as protected as, as, as everything else. So yeah, it took some time. But at the end, it, uh, it was extremely important because we are speaking about people that are in danger. Some countries, people that are, who are targeted, and, um, and we needed to, to be the most careful we could.
RANEY ARONSON-RATH: That's really quite something. It takes expertise on all sorts of different levels beyond just practicing investigative journalism. So let's actually just talk about some of the major revelations from the investigation. What revelations stick with you both the most?
SANDRINE RIGAUD: Contacting some people we knew to, to let them know that they might be under surveillance, to have their phone analyzed and then discover that they were actually hacked was, was a big thing. And I, I, I have in mind, Khadija Ismayilova, who, who is a journalist in Azerbaijan. Uh, extremely brave, uh, who spent years in prison and whom we discovered because she was in, in Laurent's contact book. And, uh, and so when we matched our contact list with, with the list we discover her name. And I mean seeing the reaction of of Kadija, uh, let you understand how violent it is to be targeted by, uh, by Pegasus. I think those human stories are the one probably that, um, that for us are, are the strongest because of course, uh, knowing that Emmanuel Macron was appearing on the list made the headlines. But, uh, people like head of states or, um, um, yeah, uh, politicians, uh, might be targeted. I mean, this has already been documented. This is known. And, uh, um, and they have means to, to defend themselves. But people like Khadija, like journalists in Morocco, journalists and Bahrain have no means, um, no means to, to, to fight against that. And, uh, and of course these are for us, I think, um, the, the, the strongest and, and the most important revelations. Until the Pegasus Project, cyber Surveillance was a very abstract topic, and I think what the Pegasus Project was able to do is really show the faces of the victim for the first time.
RANEY ARONSON-RATH: Yeah, I think that actually Sandrine is something that I would say was the most revelatory — is as you all you know, sat with the people who were victims of this, watching their faces as they were thinking about everything that was on their phones. As you said, you think about the people you talk to, your family, you think about all like, you know, the, the things that you talk about in earnest. Um, and so seeing their faces was really the first time I had, um, you know, thought deeply about the, the impact of this, uh, the true impact of this on the people who were, um, you know, potentially surveilled. So, so Laurent, what sticks with you the most?
LAURENT RICHARD: For me, what was really impressive is that how large the misuse of the spyware was, that we were having like human rights activists in Mexico, journalist in France, uh, political opponents in some countries in Africa. Khadija Ismayilova in Azerbaijan. The wife and the fiance, the two women around Jamal Khashoggi being targeted. And I was so, I was really, yeah, impressed, surprised, by the scale of the scandal that we were revealing that all those people were basically sharing something in common. They were fighting for democracies because they were journalists. They were challenging their powers and that spyware became a kind of the magic toy for some dictators from some oppressive regime or many other leaders who wanted to track abroad their own dissidents or the people who are challenging them. So I was really yeah, I'm shocked by, by by the scale of that. And, and of course, um, I was so very impressed by the level of how governments were lying. Remember during the Snowden Revelation, the way in the US or other countries were reacting to after the Snowden revelation was, you have nothing to worry about, if you're not a criminal, if you're not a terrorist. And, and NSO was having the same kind of narrative when they are selling the spyware. They say that officially to catch the bad guys, and maybe in our setting we need spyware to prevent terrorist attack. Of course, we, we need everything to prevent terrorist attack. But on that list, and after the investigation done by Amnesty Security Lab On the forensic side, we learned that many journalists, lawyers, people were not terrorists. Khadija Ismayilova – she's not a terrorist. She's not a criminal, and she was the victim of that. So I was really impressed by, yes, the status where we are. You have a private company selling a military weapon to state actors, and nobody's controlling that. There is a lack of regulation. And I hope that we did create a large conversation, uh, over the planet about that.
RANEY ARONSON-RATH: So Laurent, I know we could never get NSO to sit down with us, so that, that was always a challenge to represent their point of view. Can you tell me what, what did they think about the reporting that we did and what did they tell us?
LAURENT RICHARD: Yeah, so NSO did not accept any interview with us. They did, uh, they did reply to some question about some numbers that we thought they were targeted, but basically the position of NSO that NSO is, is denying that the spyware have been used against some journalists or against some lawyers. They deny for instance, if we just speak about something extremely sensitive, the surveillance of the two women around Jamal. We find traces of infection on the two devices of the two women. They deny that. So just about the position of NSO, they deny any kind of involvement in that they explain that they, uh, only sell that to state actors. That the state actors and it's true, are the one using that. So we should keep that in mind. It's not NSO targeting the people, it's governments. So that's what NSO wanted to say and to explain. The thing is when NSO went to the European Parliament to, uh, provide answers. And basically that's the only public hearing that we have so far from NSO — so the only chance that we got to get some answers — NSO was explaining that they cannot say publicly a lot of things. They cannot reveal who are the customers. They cannot reveal exactly uh, what are the policy against, uh, potential misuse. So they're not very precise, uh, because most of the question are under national security classifications. So this is, uh, their position.
RANEY ARONSON-RATH: Let's actually talk about the impact of this reporting and what's happened after you published.
SANDRINE RIGAUD: The revelation had a huge impact in the short term first because there were, um, protests in, in countries, in Hungary, in India, um and of course one of the major decision was the decision from the, the, the US to to blacklist NSO. And I think this decision, uh, was really important, uh, uh, because, because it came from, from the US and uh, because it was a very, very symbolic one. The European Parliament is investigating the, the misuse of Pegasus in, in Europe. And I think this, uh, – I don't know what decision will be, will be taken. But at least this is really putting that, uh, that topic in a global place. And, uh, and is part of the conversation. It's, um, we are actually not doing any advocacy. We're just journalists. We're just revealing things. So we, we don't have solutions. We understand that. It's, uh, those, those spyware might be needed to fight against terrorists or, uh, or criminals. But what we are seeing is that the, the scale of the misuse is much, it's way too important to be ignored.
RANEY ARONSON-RATH: And, Laurent, can you get us up to date on the NSO's perspective and what the latest is?
LAURENT RICHARD: So the latest news is that the CEO of NSO, um, resigned. He's not anymore the CEO. So he is, and now he’s involved in another, uh, company. They're still denying that the spyware were used against some journalists, but they were in a difficult situation because they say on one hand, when they do sell spyware to customer, they say, we sell you this spyware and we will never know about your targets. On the other hand, they say, we, we are able to investigate the misuse by if, if there is a misuse. So we can know the target if we get the permission from the customers. So the reaction from NSO was first to deny. But then all over the world we were having many other reaction – protests in India, um, the French head of state were, uh, making some defense committee over two, three days, were asking the, uh, um, some people from the government defense minister of Israel to come to Paris to answer some question. In the US, uh, the US authorities, uh, put, uh, NSO on the blacklist, making sure that not a single American based company will be able now to contract with the NSO Group. And that was extremely, I think, damaging for the business plan of NSO. There is first some complaints against NSO from WhatsApp, from Apple, but some from journalists as well. So it's, uh, there is a movement. The thing is, okay, we are one year and a half after the revelation. What do we have in place seriously to protect the citizens? And honestly, there is quite nothing yet. And if you continue investigating, which this is what we do about the cybersurveillance, we see how resilient this industry is. And the problem is not NSO the problem is not the spyware, the problem is the regulation around, around that. And so far, that's the wild west and the industry is extremely resilient, extremely secretive, and uh, and the business is extremely lucrative. So this is where we are and why we need, yeah. Um, people from the civil society and Congress people, people who are in power, in charge, to be involved in the conversation.
RANEY ARONSON-RATH: Well, I thank you and Sandrine for all the hard work and the work of Forbidden Stories and Forbidden films. The documentary is incredible and I really thank you for approaching FRONTLINE as well with this remarkable, um, material. And um, it's just been amazing to collaborate with you all.
LAURENT RICHARD: Yeah, likewise, and thank you, uh, Raney, and all the, the FRONTLINE team for giving us a chance to, to, to work with, um, with the Frontline team. That's so crucial that we, we do share a lot together about journalism and, and telling a story like that on FRONTLINE is for us and for all the partners, really an honor and so crucial to make sure that we understand what is at stake when we talk about cybersurveillance and threats for democracy.
RANEY ARONSON-RATH: Thank you so much, Laurent. Really appreciate it. Thank you both for being on the Dispatch.
LAURENT RICHARD: Thank you, Raney.
RANEY ARONSON-RATH: Thank you so much to Laurent Richard and Sandrine Rigaud for joining me on the Dispatch. You can watch parts one and two of Global Spyware Scandal: Exposing Pegasus on FRONTLINE.org, FRONTLINE’s YouTube Channel, and the PBS video app.
