Is Your Phone Spying on You? Ronan Farrow on His New Doc “Surveilled”

CHRISTIANE AMANPOUR, CHIEF INTERNATIONAL ANCHOR: And next, it’s the one thing we practically never leave home without, but could our smartphones be spying on us? Well, after becoming a target of hacking himself, Pulitzer Prize winning journalist Ronan Farrow made it his mission to shine a light on the shadowy world of cyber surveillance.

(BEGIN VIDEO CLIP)

UNIDENTIFIED MALE: Spyware is this powerful surveillance tool. Big spyware companies say they sell this tech only to governments. But this multi-billion-dollar industry is mostly unregulated. The most advanced spyware can turn your smartphone into a spy in your pocket.

(END VIDEO CLIP)

AMANPOUR: Farrow joins Michel Martin now to discuss his new documentary, “Surveilled,” and the frightening reality of spyware.

(BEGIN VIDEOTAPE)

MICHEL MARTIN, CONTRIBUTOR: Thanks, Christiane. Ronan Farrow, thanks so much for talking with us once again.

RONAN FARROW, JOURNALIST AND PRODUCER, “SURVEILLED” AND INVESTIGATIVE REPORTER AND CONTRIBUTING WRITER, THE NEW YORKER: Always a pleasure. Thanks for having me.

MARTIN: So, this might seem basic, but if you could just take us to the beginning, what is spyware and how did you become aware of it?

FARROW: So, the most modern forms of spyware that we should all be most concerned about can hijack your phone undetectably, turn it into a listening device, turn on the microphone, turn on the camera, and disgorge all your personal content and send it remotely to whoever is operating the technology. So, the core thing to know is that for a long time this has been used as a tool of oppression under dictatorships, autocracies. We see it show up on the phones of people around murdered dissidents, journalists. It’s been linked to hundreds of acts of violence around the world. But what I’ve been tracking in recent years of my reporting is that in one western democracy after another, countries that supposedly have protections against these kinds of intrusions in their bodies of law, we’re also seeing scandals in which this kind of surveillance technology is overused. We’ve seen it happen in Poland, in Greece, in Spain, and a lot of this documentary, “Surveilled,” is actually set in Spain, where we document one of the largest clusters on record of peaceful civil society members and opposition politicians being hacked in this way. And I can tell you, Michelle, from my own experience being followed around, surveilled in various ways, including sometimes high-tech ways where someone was following me, tracking my GPS data, it is not just information gathering, it is intimidation. And it shrinks the space for opposition expression of all kinds. So, it’s something we should all just be really concerned about. And the film shows that not just opposition politicians and activists, but innocent bystanders, apolitical people are caught up in this all the time.

MARTIN: I think we have to get really basic here because I think some people feel that, look, if you’re not doing anything wrong, then what do you care whether people are following you around or listening to your conversations and stuff like that? I just think you really need to explain for people why these matters.

FARROW: I think the reasons to care about this are twofold. First of all, you might have the posture that you just described, Michel. I’m not doing anything wrong, why would anyone want my data? Nobody wants my nudes, you know? And that may intuitively make sense, but what we see over and over again when these Orwellian surveillance dragnets happen, again, increasingly in western democracies where people said, not here, it couldn’t happen here, is that innocent bystanders, totally apolitical people are caught up in those dragnets.

(BEGIN VIDEO CLIP)

UNIDENTIFIED MALE: Why should people around the world care about the hacking that you’re documenting here in Catalonia?

UNIDENTIFIED MALE: This is going to be one of the first cases where there’s such a large and vast number of affected people. And from a vast and different type of categories of society. So, we’ve had the Parliament of Catalonia targeted. We’ve had the Government of Catalonia targeted. We’ve had lawyers targeted. We’ve had civil leaders of cultural organizations of Catalonia targeted.

UNIDENTIFIED MALE: This is not some future Orwellian scenario. It really – – it happened here. It’s happening.

UNIDENTIFIED MALE: It’s happening here.

(END VIDEO CLIP)

FARROW: And to get at the other part of why people should care about this, whether you wind up on a list or not, you have to be invested in how this kind of technology shrinks the space for all forms of dissent and opposition. You know, we’ve seen extreme cases of that, Michel, like in the case of the journalist Jamal Khashoggi, there was an allegation that Pegasus, one of these powerful forms of spyware, showed up on phones of associates of his. Now, some of the players involved in that fact pattern deny it, but that seems to be the case. And that’s the pattern. You had him communicating dissent about the Saudi government, and he wound up dead. So, that’s an extreme case. But in all of the countries that have this technology at its — their fingertips, and the U.S. government has purchased this technology, which we can talk about, we have to be concerned about how private communications that express dissent can quickly become a source of retaliation.

MARTIN: One of the people you interviewed told you that the system of checks and balances we have come to take for granted in the west has unraveled before our eyes. So, walk us through your reporting. Let’s go to Spain, which is — where a lot of the reporting in the — in your documentary is based. What happened there and how did it happen?

FARROW: In Spain, a country where people really did say, well, it couldn’t happen here, you have a peaceful political movement in Catalonia, which is an autonomous region. Barcelona is the capital. There’s a population there that thinks that they should separate and be an independent state. Whatever your views on that, these are peaceful politicians and civil society members. And what we found there, I followed the work of a watchdog group called Citizen Lab, was that there was one of the largest clusters of hacking victims in the world. Just one politician after another. These are European Parliament members in some cases. And we show in the film these cases of politicians testing their phones and finding out they’ve been hacked.

(BEGIN VIDEO CLIP)

UNIDENTIFIED MALE (through translator): The iPhone will generate a diagnostic file which won’t include personal data. We just received

confirmation that your phone was hacked twice. Once on the 11th of June and then again on the 27th of June.

UNIDENTIFIED MALE (through translator): 2020?

UNIDENTIFIED MALE (through translator): 2020.

UNIDENTIFIED MALE: When does it look like you were infected?

UNIDENTIFIED MALE: I have to check the date, but around that day I was appointed member of the European Parliament.

UNIDENTIFIED MALE: How do you feel knowing that you may have been compromised in this way?

UNIDENTIFIED MALE: Well, I feel surprised and angry at the same time.

(END VIDEO CLIP)

FARROW: And they don’t know what sensitive conversations have been disgorged. They don’t know if the Spanish government is going to retaliate against them. And in the U.S., we have been, as a government, flirting with this technology. Parties in power on both sides of the aisle have purchased this tech, have explored using it, have come close to it under the first Trump administration. The FBI did purchase Pegasus, one of these infamous forms of technology. They said for testing. There’s a lot of evidence that they intended to do more than testing. It seems like it hasn’t been deployed operationally yet. But in my latest story, I talk about how they have — despite some efforts under the Biden administration to limit the government’s ability to purchase foreign spyware, they’ve gone ahead and purchased more. Under the Biden administration, the Department of Homeland Security just purchased another really potent form of Israeli spyware technology, a software called Graphite built by a firm called Paragon. That contract is currently being reviewed. But you’re going to have a situation where the new administration comes into power in this country with this kind of tech at its fingertips, and this is a new administration that has threatened to go after journalists, to go after opposition members. So, you can see why privacy rights advocates. And democracy advocates are really fearful about the potential for this happening here, as it has happened increasingly in so many places where people didn’t expect it.

MARTIN: One of the most famous — I don’t know if — when you say infamous companies in this field is the NSO group known for Pegasus, their software. You were actually invited inside their headquarters in Tel Aviv in 2022. What did they say about what they do and what the capabilities of it are and why they do it?

FARROW: The whole framework for the debate around this technology is what we see all the time in terms of powerful intrusive law enforcement tools, which is there’s an argument that theoretically, it can be a really good thing for law enforcement investigations. And I talked to in this film, for instance, law enforcement officials from western democracies, where, by the way, the public doesn’t know that they have and are using Pegasus. And I hear the argument from the law enforcement officials saying, well, we love to be able to completely open up anyone’s phone anytime we want. And they say they use it to target terrorists. So, that’s the kind of the show that’s put on by advocates of this technology. And that’s what I get in the film when I go into NSO’s offices, they say, look, we’re trying to make this technology to help the good guys in law enforcement. But then, I interview, on background, in shadow, whistleblowers who have left that firm because of ethical objections. And what they point out is that the business model of these top spyware makers is often really skewed, where the western democracies that put a good face on this and say that they’re using it with at least some limitations get a really low fee and the bread and butter of the business, the giant fees come from places like Saudi Arabia, where really the spyware makers know that the client is going to be using it to quash dissent. And what the spyware makers themselves say, the top lawyer at NSO Group is on camera saying this in this film, is that they’re basically arms manufacturers. And that it’s not their fault, in their view, that there’s no equivalent to the Geneva Conventions for this really powerful tool that is in practice a weapon that can really harm democratic values.

MARTIN: So, the NSO Group is based in Israel. Does the Israeli government maintain any control over who they sell to?

FARROW: Yes. So, the Israeli spy firms, particularly NSO Group, make the argument that their client selection and activities are all tightly controlled by the Israeli authorities. And the fact that this is a technology that is flourishing out of Tel Aviv specifically is not an accident, Michel. You know, this is a highly innovative tech setting in general with a really strong pool of talent, but it’s also specifically a place where people come out of mandatory military service, they come out of the intelligence units in the Israeli military, and they have a skill set pretty early in their career after they serve, that they then apply starting these companies and working for these companies. So, that’s one reason why you have Israel at the forefront of this kind of private tech, and there’s a really close relationship with the Israeli government and these private spyware makers. For example, the NSO Group has been reported to be deploying its technology on behalf of the Israeli government in its current conflict in the Palestinian territories to try to find hostages. And by the way, on the other hand, we talked to Palestinian politicians in this film who say, look, it’s not just in this current conflict, for years, Israel has been using the Palestinian population as a lab that they surveil activists in that space.

MARTIN: So, let’s go back to the United States. I want to mention that there is both the documentary and there’s also a piece that you published in The New Yorker. OK. In The New Yorker article, you detail how ICE, Immigration and Customs Enforcement, acquired Paragon spyware technology under the Biden administration with indications that it could be used more aggressively in the incoming Trump administration. For the record, you spoke to Nathaniel Fick, the Biden administration’s ambassador at large for cyberspace and digital policy. And he defended, quote, “legitimate law enforcement and national security uses of these technologies.” But let’s — you know, we are a couple of weeks away from the Trump administration returning to office. They’ve made it very clear that they expect to have a very aggressive deportation policy. How might this technology be used in the surface of that?

FARROW: Well, this is what privacy law advocates are so frightened about. You have, first of all, a legal framework for privacy protections and for limiting this kind of spyware technology. That’s very porous, Michelle. I mean, after some of my reporting, the Biden White House announced in some of those stories I did that they would do a new executive order that would ostensibly limit the government’s ability to purchase foreign spyware that have been used abusively. It still allows for plenty of new purchases of foreign spyware, which means more offices in the government can use it. It’s more available. There’s a lower threshold and less examination of when it’s used. There are no real clear standards laid out for how and when the government can use this. And then, you have this incoming administration where every single privacy lawyer I’ve talked to has said, you know, not only can they exploit all of those holes in the existing framework, they’re not even sure that the incoming administration will care about the legal framework. You know, you really do have incoming officials, administration members who have said that they disregard the law, that they view the executive as having absolute power. If we have a combination of a disregard for any guardrails, and this technology already being at the fingertips of the government, the consequences are genuinely frightening to me. It’s one of the first times I’ve been afraid as a journalist, you know, even as one who’s dealt with a fair amount of intimidation. There’s always been a legal framework to limit the intrusions on the work that we do in our profession. And, you know, if you lose the space for opposition conversations, for investigations to try to hold people in power to account, you lose the potential for the next Watergate, for the next Pentagon Papers. That’s something we should all care about, I think. And in this case, the Department of Homeland Security has this technology. The Biden administration says they’ve paused the contract. They’re reviewing it. But it’s very powerful phone hacking technology, and you could easily see how ICE specifically, under the Department of Homeland Security, could deploy that in the context of a mandate of mass immigrations, which is what Trump has promised.

MARTIN: I mean, I think people would argue that if you are in the country out of status, then why shouldn’t the government know where you are?

FARROW: Well, I think there’s two responses to that. One is even for people who are caught up in the immigration issues at play here, people who are here in a completely permissible way and they’re awaiting immigration proceedings of some kind, people who are here illegally, I think that there is also a good argument from human rights advocates that the private communications of those people shouldn’t be up for grabs without a specific law enforcement warrant that is about more than just their status. And what I’ve heard from these privacy law experts again and again is technology purchased by the Department of Homeland Security specifically, that’s often the institution that gets the technology that is legally questionable, because they have a clear national security rationale that shields them from scrutiny of it. And once it’s in the hands of DHS, what I’ve been told again and again is, you can’t guarantee that it’s just being used by ICE. We don’t know the answer to that, because there hasn’t been transparency on that. So, I think it’s pivotal that individuals demand Congress demands, going forward, that there is more transparency about who’s using this technology and when. So, this is really going to be a protection that has to come through checks and balances, through an outside counterbalance in the form of Congress. You know, this is a largely unregulated space that I think the history that you just described shows us desperately needs regulation as the technology becomes more pervasive and more intrusive.

MARTIN: What about Paragon? Did the company have anything to say about the way their technology might be used in these immigration efforts that we’ve talked about?

FARROW: There are two camps in this industry. There are the people who see all of the scandals that have emerged around NSO Group, and their response is, well, we’re going to keep selling to the bad guys, and we’re going to be more secretive about it. And then, there are the players who see the lucrative market for selling to the American government and other big western governments. And they realize that those governments are going to be averse to association with scandal. And so, they try to present themselves as a cleaner alternative. Paragon is one of those companies. Part of their pitch is, well, we’re going to police more expertly whether our technology is abused. You know, we’re going to be a little cleaner about which client states we deal with. We’re not going to deal with the real bad guys. That was also the pitch that NSO Group made. Whether Paragon succeeds in that, we don’t know, but that is what they say. They say, look, we’re trying to limit ourselves to countries that aren’t going to abuse this. And a source at that company told me that the vetting process that led to the Department of Homeland Security purchasing their technology included them demonstrating over and over again that they had robust mechanisms for preventing their other client states from spying on Americans. But pivotally, and there’s no guardrails on DHS itself, spying on Americans. Those guardrails have to come from within.

MARTIN: Ronan Farrow, thanks so much for talking with us.

FARROW: Thank you, Michel. Always a pleasure.