“Behold! in various throngs the scribbling crew,
For notice eager, pass in long review:
Each spurs his jaded Pegasus apace,
And Rhyme and Blank maintain an equal race;
Sonnets on sonnets crowd, and ode on ode;
And Tales of Terror jostle on the road;
Immeasurable measures move along;” (Lord Byron – English Bards, And Scotch Reviewers)
By Dragan Vitorovic
Pegasus is the most controversial spyware related to government surveillance programs in 2021. It is considered to be the most effective spyware ever developed, which can infect both iOS and Android while being undetectable. The application requires only a phone number of the targeted person, and the missed call or message can infect the victims’ phone and take complete control over it.
Observed from a broader perspective, Pegasus is one more proof that cyberwarfare is intensifying and that governments increasingly rely on private vendors to establish advanced surveillance systems. In some cases, without the consent of its citizens, which could be a significant issue of legitimacy, especially in post-industrial economies. Arguably, the most media-explored cases of Pegasus’ use are its role in extensive espionage strategy against Pakistan and its implementation in the case of Saudi dissident Jamal Khashoggi.
Reportedly, the demand for Pegasus is growing. It cannot be ascertained, however, the dissenting voices requesting the increased regulation on surveillance cyberweapons could reaffirm the speculation on increased demand in Pegasus.
Forbidden Stories versus Pegasus
The recent investigation conducted on behalf of eighty reporters from seventeen media outlets and ten countries, published by Forbidden Stories, a French-based network organization of journalists with a mandate to protect and publish investigative reports, scrutinized the Pegasus. The investigation implied that the use of Pegasus could influence the government-led surveillance regulations since Pegasus provides an enormous surveillance capacity to a government in tracking its citizens.
Pegasus, a product of Israel-based NSO Group, a cyber warfare company that provides its services to governments, has been allegedly used in more than forty countries. Some countries that used Pegasus have questionable respect for human rights, such as Kenia, Qatar, Saudi Arabia, India, and Hungary. While governments deny the use of Pegasus, civil society circles emphasize that this powerful and invisible software is used to track and monitor human rights activists, journalists, business people, and political dissidents, clearly depicting it as an example of targeted digital espionage and invasion of privacy and human rights. The issue is that governments can adopt plausible deniability and refute the accusations of using Pegasus, so civil society organizations argued for an appropriate regulatory framework addressing cyberweapons, which would consider judicial and executive checks and balances before the implementation of such surveillance measures. However, the broader concept of cyberspace would hardly be fully regulated – if ever – making the consensus amongst the stakeholders in cyberspace almost impossible to reach.
NSO Group
NSO Group, in its report published on 30 June 2021, argued that the technology has been used to collect data from the mobile devices of individuals with criminal or even terrorism-related backgrounds. The company emphasized that the company’s product increased public safety in different countries and prevented more than 100 terror acts. Additionally, NSO Group stressed that the company carefully scrutinizes its clients and denies access to Pegasus to governments that violate human rights. The company stated that it completed hard work to “conduct business ethically and responsibly, taking particular care with their most sensitive tools, like Pegasus”. The company further emphasized it decided not to provide its products and services to 55 countries that do not comply with the company’s standards. What is highly interesting, is that NSO mentioned that the June report is the first of its kind amongst the cyber intelligence company, leaving to the public to ponder if this is true or not, and what the implications of such statements could be. Furthermore, despite the well worded and meticulously constructed NSO Group report, it appears that there have been more than 50,000 phone numbers infected by Pegasus, while 80 journalists from 21 countries were tracked and surveilled.
The Pegasus case will likely put additional pressure on governments, given the complexity of reaching the balance between security and democracy at the state level. The issue becomes even more challenging in postindustrial countries where governments traditionally account for their citizens’ human and privacy rights. In such circumstances, the surveillance industry will have to enter into a dialogue with civil society representatives before providing the license of such cyberweapons to governments. However, it should be clear that the mandate of civil society activities differs from the government-led objectives, while the goal of tech companies developing such tools is, simply put, profit. The coordination of multiple stakeholders, their mandates and goals, in a tech-dependable society, leaves many leeways that could be exploited for long enough to remodel the rules of the game even before those rules are set and implemented.
Do governments have responsibilities?
The United Kingdom is considering launching an inquiry into the adoption and application of Pegasus against its citizens around the globe, arguing that the use of such applications should be conditioned on Parliament’s approval. France has taken some steps ahead of the United Kingdom and launched a series of inquiries related to surveillance of the citizens of France, especially in countries of Northern Africa. And, certainly, adamant critics of Orban insist that Hungary’s president used Pegasus to spy on his political opposition and journalists. It is yet not fully known how many countries in the European Union or countries candidates for the EU have used Pegasus or expressed interest in similar cyber weapons.
Image: NSO Group headquarters in Herzliya (Google Street View)
Author: Dragan Vitorovic
(The views expressed in this article belong only to the author and do not necessarily reflect the editorial policy or views of World Geostrategic Insights).