Would you like to inspect the original subtitles? These are the user uploaded subtitles that are being translated:
1
00:00:00,566 --> 00:00:03,666
♪ ♪
2
00:00:07,066 --> 00:00:11,166
♪ ♪
3
00:00:21,400 --> 00:00:23,933
Pegasus... Pegasus...
Pegasus...
4
00:00:23,933 --> 00:00:25,600
Pegasus, Which has been used
to monitor and track
5
00:00:25,600 --> 00:00:27,233
journalists, human rights
activists, and dissidents
6
00:00:27,233 --> 00:00:28,800
across the globe.
7
00:00:28,800 --> 00:00:30,966
NARRATOR: In collaboration
with Forbidden Films,
8
00:00:30,966 --> 00:00:33,266
a two-part investigation...
9
00:00:33,266 --> 00:00:35,866
We immediately realized that
this story would be huge.
10
00:00:35,866 --> 00:00:38,500
NSO was established with the
ambition
11
00:00:38,500 --> 00:00:40,100
to make the world a
safer place...
12
00:00:40,100 --> 00:00:42,533
NARRATOR: Into powerful
spyware...
13
00:00:42,533 --> 00:00:44,800
It is a military weapon used
against civilians.
14
00:00:44,800 --> 00:00:47,800
This is extremely serious for
democracies.
15
00:00:47,800 --> 00:00:49,966
NARRATOR: Used around the
world...
16
00:00:49,966 --> 00:00:53,966
There is no control over how
countries use it,
17
00:00:53,966 --> 00:00:58,000
and they have been using it in
the worst way you could imagine.
18
00:00:58,000 --> 00:01:00,333
NARRATOR: Now on "Frontline,"
part one
19
00:01:00,333 --> 00:01:03,000
of "Global Spyware Scandal:
Exposing Pegasus."
20
00:01:06,566 --> 00:01:10,966
♪ ♪
21
00:01:29,700 --> 00:01:33,500
♪ ♪
22
00:01:36,133 --> 00:01:39,566
Our phones are not just
our phones.
23
00:01:39,566 --> 00:01:41,500
We call them phones,
but they're not phones,
24
00:01:41,500 --> 00:01:43,366
they're computers.
25
00:01:43,366 --> 00:01:45,500
And they're like extensions
of our body.
26
00:01:45,500 --> 00:01:48,133
They're with us all of the time.
27
00:01:48,133 --> 00:01:50,600
And if they are turned into
a surveillance device,
28
00:01:50,600 --> 00:01:52,600
I don't think it's
an exaggeration
29
00:01:52,600 --> 00:01:54,900
to say this was something that
even George Orwell
30
00:01:54,900 --> 00:01:56,800
in "1984" couldn't imagine.
31
00:01:56,800 --> 00:02:02,733
♪ ♪
32
00:02:02,733 --> 00:02:04,733
It's beyond science fiction.
33
00:02:04,733 --> 00:02:07,733
♪ ♪
34
00:02:07,733 --> 00:02:08,866
LAURENT RICHARD (in French):
35
00:02:08,866 --> 00:02:11,466
♪ ♪
36
00:02:29,600 --> 00:02:32,200
♪ ♪
37
00:02:35,000 --> 00:02:37,700
(multiple international
journalists saying "Pegasus")
38
00:02:37,700 --> 00:02:40,233
This technology,
it's so far ahead
39
00:02:40,233 --> 00:02:42,666
of government regulation
and even of
40
00:02:42,666 --> 00:02:46,566
public understanding of
what's happening out there.
41
00:02:46,566 --> 00:02:49,400
♪ ♪
42
00:02:53,833 --> 00:02:55,866
All of us suspected
that if NSO Group
43
00:02:55,866 --> 00:02:59,666
was giving authoritarian
and repressive regimes
44
00:02:59,666 --> 00:03:01,866
such a powerful instrument
of surveillance,
45
00:03:01,866 --> 00:03:05,466
that it was pretty likely that
this technology would be abused.
46
00:03:05,466 --> 00:03:09,266
But none of us had been able
to prove it on a systemic scale.
47
00:03:09,266 --> 00:03:12,333
♪ ♪
48
00:03:13,466 --> 00:03:15,433
De acuerdo con la pesquisa
acabada
49
00:03:15,433 --> 00:03:17,200
por "The Washington Post,"
"The Guardian,"
50
00:03:17,200 --> 00:03:19,166
"Le Monde" y otros medios...
51
00:03:19,166 --> 00:03:21,533
A joint investigation
by 17 news outlets
52
00:03:21,533 --> 00:03:22,733
and Forbidden Stories...
53
00:03:22,733 --> 00:03:24,200
Activists, lawyers,
and journalists
54
00:03:24,200 --> 00:03:27,333
are reportedly among those
who have been targeted by...
55
00:03:27,333 --> 00:03:31,133
Phone numbers belonging
to some big name politicians.
56
00:03:31,133 --> 00:03:34,066
(in Mandarin):
57
00:03:36,766 --> 00:03:41,700
♪ ♪
58
00:03:44,033 --> 00:03:45,833
The device that you have
59
00:03:45,833 --> 00:03:48,066
in your pocket could be a spy
60
00:03:48,066 --> 00:03:50,100
that is spying on your life.
61
00:03:50,100 --> 00:03:55,133
♪ ♪
62
00:04:06,600 --> 00:04:08,333
(car horn honks)
63
00:04:16,666 --> 00:04:21,000
RICHARD (in French):
64
00:04:25,900 --> 00:04:29,700
(indistinct chatter)
65
00:05:17,233 --> 00:05:21,500
♪ ♪
66
00:05:23,266 --> 00:05:25,466
The list doesn't have any names.
67
00:05:25,466 --> 00:05:28,700
You have phone numbers,
area country code,
68
00:05:28,700 --> 00:05:31,200
some timestamps as well.
69
00:05:31,200 --> 00:05:33,900
And it's a list that is about
50,000 phone numbers
70
00:05:33,900 --> 00:05:35,700
from 2016 to 2020.
71
00:05:35,700 --> 00:05:40,566
We can't explain where the list
is coming from.
72
00:05:40,566 --> 00:05:43,133
We can't, of course, reveal who
is our source.
73
00:05:43,133 --> 00:05:47,966
Officially, the Pegasus
spyware is not working
74
00:05:47,966 --> 00:05:50,200
on any plus one U.S. phone
numbers.
75
00:05:50,200 --> 00:05:51,866
It's not possible.
76
00:05:52,866 --> 00:05:56,266
The numbers, they are mostly in
ten countries
77
00:05:56,266 --> 00:06:00,000
most of these governments are
known to be clients of NSO group
78
00:06:00,000 --> 00:06:03,500
who make Pegasus.
79
00:06:03,500 --> 00:06:05,833
Pegasus was designed
to infect
80
00:06:05,833 --> 00:06:08,433
phones like iPhones or Androids.
81
00:06:08,433 --> 00:06:09,933
And once in the phone
82
00:06:09,933 --> 00:06:13,166
it can extract and access
everything from the device--
83
00:06:13,166 --> 00:06:14,666
the phone books,
84
00:06:14,666 --> 00:06:18,600
geolocation, the messages,
the photos,
85
00:06:18,600 --> 00:06:23,166
even the encrypted messages
sent by signal WhatsApp.
86
00:06:23,166 --> 00:06:24,733
It can even access
87
00:06:24,733 --> 00:06:27,966
the mic or the camera
of your phone remotely.
88
00:06:27,966 --> 00:06:30,633
♪ ♪
89
00:06:30,633 --> 00:06:34,633
It's like a person
over your shoulder,
90
00:06:34,633 --> 00:06:36,766
a person who will see
what you are seeing,
91
00:06:36,766 --> 00:06:38,366
a person who would watch
what you are watching,
92
00:06:38,366 --> 00:06:42,600
your emails, your encrypted
communication, everything.
93
00:06:42,600 --> 00:06:44,933
So, once you are infected,
you're trapped.
94
00:06:44,933 --> 00:06:46,933
♪ ♪
95
00:06:48,466 --> 00:06:52,333
Hello? Can you hear me?
I can hear you.
96
00:06:52,333 --> 00:06:54,100
I don't see you.
97
00:06:54,100 --> 00:06:55,700
Hello.
Hello, Paul.
98
00:06:55,700 --> 00:06:57,466
Hello, Laurent.
Hi, Dana.
99
00:06:57,466 --> 00:06:59,233
(on laptop): Hi, how are you?
100
00:06:59,233 --> 00:07:01,433
Hi, Dana.
Good, and you?
101
00:07:01,433 --> 00:07:03,733
We decided to reach out
to some partners;
102
00:07:03,733 --> 00:07:05,166
"The Washington Post,"
"The Guardian,"
103
00:07:05,166 --> 00:07:07,400
and many other ones.
104
00:07:07,400 --> 00:07:10,300
We wanted to tell you
about some information we have
105
00:07:10,300 --> 00:07:11,733
and about a new project
we are starting.
106
00:07:11,733 --> 00:07:15,433
We had no names attached
to the numbers.
107
00:07:15,433 --> 00:07:17,333
We needed more journalists.
108
00:07:17,333 --> 00:07:19,100
We needed reporters
on the ground
109
00:07:19,100 --> 00:07:21,133
who could reach out
to some victims.
110
00:07:21,133 --> 00:07:23,200
We need people with
tech expertise.
111
00:07:23,200 --> 00:07:26,366
We still have to identify
numbers.
112
00:07:26,366 --> 00:07:27,633
Many of them actually
haven't been identified yet.
113
00:07:27,633 --> 00:07:30,566
So we'll need your help on this.
114
00:07:30,566 --> 00:07:32,333
The moment they mentioned
115
00:07:32,333 --> 00:07:33,966
the numbers of phone numbers
that they had,
116
00:07:33,966 --> 00:07:35,866
the quantity of phone numbers,
117
00:07:35,866 --> 00:07:38,000
tens of thousands,
118
00:07:38,000 --> 00:07:40,033
I mean,
my jaw just hit the floor.
119
00:07:40,033 --> 00:07:42,533
There is a lot that
concern India.
120
00:07:42,533 --> 00:07:44,100
(on cellphone): Ah.
121
00:07:44,100 --> 00:07:45,900
Some people in Mexico.
122
00:07:45,900 --> 00:07:47,400
Information about Hungary.
123
00:07:47,400 --> 00:07:50,000
Azerbaijan and Kazakhstan.
124
00:07:50,000 --> 00:07:51,933
If Forbidden Stories have got
125
00:07:51,933 --> 00:07:54,533
data that can identify
126
00:07:54,533 --> 00:07:57,266
not just who the customers
of NSO are,
127
00:07:57,266 --> 00:07:58,300
but potentially point
in the direction of
128
00:07:58,300 --> 00:08:01,200
who the targets are as well,
129
00:08:01,200 --> 00:08:03,033
this is a game changer.
130
00:08:03,033 --> 00:08:05,033
This could be transformative
131
00:08:05,033 --> 00:08:06,800
in terms of our understanding of
132
00:08:06,800 --> 00:08:09,633
the whole cyber surveillance
industry.
133
00:08:09,633 --> 00:08:13,633
I specialize in
national security reporting.
134
00:08:13,633 --> 00:08:18,866
So surveillance is part of
my beat, so to speak.
135
00:08:18,866 --> 00:08:22,766
You could see patterns
starting to emerge
136
00:08:22,766 --> 00:08:26,166
and you could almost like touch,
okay, that might be a story.
137
00:08:26,166 --> 00:08:28,366
You know, here's something
that's happening
138
00:08:28,366 --> 00:08:30,633
in Azerbaijan that might be
a story.
139
00:08:30,633 --> 00:08:33,333
Okay, I see what the
Moroccan story might be.
140
00:08:33,333 --> 00:08:36,200
It's like watching
a photo emerge in a darkroom.
141
00:08:39,133 --> 00:08:42,733
We will shortly be arriving
at Elephant & Castle.
142
00:08:42,733 --> 00:08:44,666
Change here for the Bakerloo
and Northern lines.
143
00:08:47,900 --> 00:08:50,333
We at the "Guardian"
have been reporting about NSO
144
00:08:50,333 --> 00:08:51,833
for a long time.
145
00:08:51,833 --> 00:08:53,566
We thought it was
really important
146
00:08:53,566 --> 00:08:55,233
to hold this company to account.
147
00:08:55,233 --> 00:08:57,466
Israel has become a world leader
in this industry
148
00:08:57,466 --> 00:09:00,766
and exports these tools
all over the world.
149
00:09:00,766 --> 00:09:04,266
And, if you like, NSO Group
was in many ways, you know,
150
00:09:04,266 --> 00:09:06,633
the jewel in the crown.
151
00:09:06,633 --> 00:09:10,333
The NSO Group was
recently valued at $1 billion.
152
00:09:10,333 --> 00:09:12,166
It is one of the
most successful companies
153
00:09:12,166 --> 00:09:14,133
in Israel's start-up space.
154
00:09:14,133 --> 00:09:15,966
NSO says they sell
the software
155
00:09:15,966 --> 00:09:17,466
to governments around the world
156
00:09:17,466 --> 00:09:19,100
for legitimate purposes--
157
00:09:19,100 --> 00:09:23,800
fighting terrorism,
or violating local laws.
158
00:09:23,800 --> 00:09:27,900
Here was a company founded by
three guys in 2010,
159
00:09:27,900 --> 00:09:31,033
that claim to have 40 countries
around the world
160
00:09:31,033 --> 00:09:33,100
buying its technology.
161
00:09:33,100 --> 00:09:37,066
That made bold claims about
its technology being used
162
00:09:37,066 --> 00:09:39,200
to solve serious crimes
163
00:09:39,200 --> 00:09:42,566
and help facilitate
national security enquiries.
164
00:09:42,566 --> 00:09:44,033
This was a big deal.
165
00:09:59,033 --> 00:10:01,766
I can tell you on the last
ten years, we only found
166
00:10:01,766 --> 00:10:05,400
three cases of misuse
167
00:10:05,400 --> 00:10:07,533
and we took very serious action
168
00:10:07,533 --> 00:10:10,666
that we are always taking.
169
00:10:10,666 --> 00:10:12,766
And these serious actions meant
170
00:10:12,766 --> 00:10:15,000
that we shut down the system
completely.
171
00:10:15,000 --> 00:10:19,266
We only sell it to governments
or to entities that we know
172
00:10:19,266 --> 00:10:22,100
or we want to believe that
they will not misuse the tools.
173
00:10:22,100 --> 00:10:24,366
And this is how we check
the customer.
174
00:10:24,366 --> 00:10:26,266
This is how we diligence them.
175
00:10:26,266 --> 00:10:28,466
We have all the mechanism
to make sure that they are not
176
00:10:28,466 --> 00:10:29,833
misusing the systems.
177
00:10:45,000 --> 00:10:48,900
In the middle of Paris,
178
00:10:48,900 --> 00:10:51,966
in the middle of this
big COVID crisis,
179
00:10:51,966 --> 00:10:54,500
we got everyone together
180
00:10:54,500 --> 00:10:56,866
to plan the investigation.
181
00:10:56,866 --> 00:10:59,833
Thank you. Sorry about that.
182
00:10:59,833 --> 00:11:02,966
I'm Dana Priest at the
"Washington Post"
183
00:11:02,966 --> 00:11:05,000
and this is Craig Timberg
who's joining me.
184
00:11:05,000 --> 00:11:07,600
This is Carmen Aristegui
and Sebastién Barragán
185
00:11:07,600 --> 00:11:08,933
from "Aristegui Noticias."
186
00:11:08,933 --> 00:11:11,666
This is Paul Lewis
from the "Guardian."
187
00:11:11,666 --> 00:11:13,600
And Steph,
many of you will know,
188
00:11:13,600 --> 00:11:15,333
writes a lot about NSO.
189
00:11:15,333 --> 00:11:17,333
This is the "Le Monde"
corner.
190
00:11:17,333 --> 00:11:19,566
This is Martin, Christophe,
and I'm Damien.
191
00:11:19,566 --> 00:11:22,133
Usually, we see
192
00:11:22,133 --> 00:11:24,766
reporters at other news
organizations as our rivals.
193
00:11:24,766 --> 00:11:27,100
We compete against them.
194
00:11:27,100 --> 00:11:30,400
We never want to share
information with them because,
195
00:11:30,400 --> 00:11:32,733
you know, we want to keep
our stories to ourselves.
196
00:11:32,733 --> 00:11:34,766
And this is just
a different way of operating.
197
00:11:34,766 --> 00:11:37,333
This seeing other journalists
as partners.
198
00:11:37,333 --> 00:11:39,566
We are really one group.
199
00:11:39,566 --> 00:11:43,600
One group with one goal--
publish those complex stories...
200
00:11:43,600 --> 00:11:45,700
(voiceover): We worked with
more than 80 journalists.
201
00:11:45,700 --> 00:11:48,833
And we set a publication date
of July 2021
202
00:11:48,833 --> 00:11:52,466
that gave us about a year
to investigate the list.
203
00:11:57,633 --> 00:12:01,933
The main task for us and for
all the partners was to identify
204
00:12:01,933 --> 00:12:03,933
the names behind the
phone numbers.
205
00:12:03,933 --> 00:12:05,600
That was crucial.
206
00:12:05,600 --> 00:12:07,266
With phone numbers only
we can do nothing.
207
00:12:07,266 --> 00:12:09,566
The data is the beginning
of the project.
208
00:12:09,566 --> 00:12:12,033
We need to find sources.
We need to go on the field.
209
00:12:12,033 --> 00:12:15,033
This project is about who is
spying on who in many countries,
210
00:12:15,033 --> 00:12:18,100
and those countries,
most of them are very dangerous.
211
00:12:18,100 --> 00:12:20,766
♪ ♪
212
00:12:20,766 --> 00:12:23,433
We had a kaleidoscope
of potential victims.
213
00:12:23,433 --> 00:12:25,100
We have the data,
but how do we prove
214
00:12:25,100 --> 00:12:27,033
that Pegasus was on the phones?
215
00:12:27,033 --> 00:12:29,166
And that was always going to be
the hardest thing
216
00:12:29,166 --> 00:12:32,100
about this project,
which was we had data,
217
00:12:32,100 --> 00:12:33,566
which is a very good indication
218
00:12:33,566 --> 00:12:36,100
of who the persons of interest
were to these
219
00:12:36,100 --> 00:12:39,233
government clients of NSO,
but we couldn't know
220
00:12:39,233 --> 00:12:41,700
whether a phone had been hacked
221
00:12:41,700 --> 00:12:44,033
unless we conducted forensics
on it.
222
00:12:44,033 --> 00:12:49,200
♪ ♪
223
00:12:56,000 --> 00:12:58,100
Claudio Guarnieri is the head
224
00:12:58,100 --> 00:13:00,266
of Amnesty International's
Security Lab.
225
00:13:00,266 --> 00:13:01,800
He worked on
226
00:13:01,800 --> 00:13:05,200
creating a methodology,
a platform that we could use
227
00:13:05,200 --> 00:13:07,566
during our investigation
228
00:13:07,566 --> 00:13:10,466
to have phones analyzed.
229
00:13:10,466 --> 00:13:14,033
He's a key element of
that investigation.
230
00:13:14,033 --> 00:13:18,233
Without his expertise,
nobody in our team
231
00:13:18,233 --> 00:13:22,200
would have been able to detect
traces of Pegasus in a phone.
232
00:13:22,200 --> 00:13:26,000
It's a piece of code
that look very similarly
233
00:13:26,000 --> 00:13:29,233
to all the others that you are
running on your phone,
234
00:13:29,233 --> 00:13:31,266
and it's just designed to do
something that it shouldn't.
235
00:13:31,266 --> 00:13:34,900
Pegasus access files
on the device,
236
00:13:34,900 --> 00:13:37,700
access and records
on the device,
237
00:13:37,700 --> 00:13:42,100
being from WhatsApp,
being from the SMS database
238
00:13:42,100 --> 00:13:44,433
that you have on the phone,
239
00:13:44,433 --> 00:13:47,100
or access on the GPS
of the device,
240
00:13:47,100 --> 00:13:49,033
record the audio,
access the webcam.
241
00:13:49,033 --> 00:13:50,866
These kinds of things.
242
00:13:50,866 --> 00:13:55,400
Apple and companies like it
try to create as many layers
243
00:13:55,400 --> 00:13:57,400
of complication as possible
for an attacker.
244
00:13:57,400 --> 00:13:59,033
But the unfortunate reality is
245
00:13:59,033 --> 00:14:02,166
that against capabilities
like those
246
00:14:02,166 --> 00:14:04,633
that Pegasus customers have,
247
00:14:04,633 --> 00:14:06,000
there's not much you can do
248
00:14:06,000 --> 00:14:08,033
from a digital security
perspective.
249
00:14:08,033 --> 00:14:11,966
You can't really stop them
meaningfully.
250
00:14:11,966 --> 00:14:14,600
You can only try to make it
more complicated.
251
00:14:14,600 --> 00:14:21,733
♪ ♪
252
00:14:29,000 --> 00:14:34,500
(indistinct chatter)
253
00:14:34,500 --> 00:14:38,133
At some point we discover
254
00:14:38,133 --> 00:14:40,300
very crucial information;
255
00:14:40,300 --> 00:14:43,200
an information that change
entirely the project.
256
00:14:43,200 --> 00:14:48,366
For years we heard rumors about
the Pegasus spyware
257
00:14:48,366 --> 00:14:50,000
might have been used against
258
00:14:50,000 --> 00:14:53,966
Jamal Khashoggi,
who was killed in 2018
259
00:14:53,966 --> 00:14:57,200
in the consulate
of the Saudis in Istanbul.
260
00:14:57,200 --> 00:15:01,600
♪ ♪
261
00:15:03,200 --> 00:15:05,066
The minute we found out
about this list,
262
00:15:05,066 --> 00:15:07,900
the first thing we all did
was to check
263
00:15:07,900 --> 00:15:11,933
for any numbers related to
Jamal Khashoggi
264
00:15:11,933 --> 00:15:16,166
or anyone we knew
who was associated with him.
265
00:15:16,166 --> 00:15:20,366
And right away,
we found two numbers
266
00:15:20,366 --> 00:15:25,066
associated with the two women
closest to him in his life.
267
00:15:29,300 --> 00:15:32,200
Jamal Khashoggi's murder,
268
00:15:32,200 --> 00:15:40,066
really in the history of
the "Post," stands out.
269
00:15:40,066 --> 00:15:43,566
He was an opinion writer
for the "Washington Post."
270
00:15:43,566 --> 00:15:47,700
Very gentle, soft-spoken man.
271
00:15:47,700 --> 00:15:50,266
His voice became very important
272
00:15:50,266 --> 00:15:54,500
because he was the single most
important dissident
273
00:15:54,500 --> 00:15:56,533
writing about the Saudi regime.
274
00:15:56,533 --> 00:15:57,966
Jamal, let me start with you.
275
00:15:57,966 --> 00:16:01,266
You've compared
your crown prince to Putin,
276
00:16:01,266 --> 00:16:02,366
to Iran's supreme leader.
277
00:16:02,366 --> 00:16:03,833
You've said he's creating,
278
00:16:03,833 --> 00:16:04,933
"an interesting form
of dictatorship."
279
00:16:04,933 --> 00:16:06,500
How so?
280
00:16:06,500 --> 00:16:10,333
I still see him as a reformer
but he is gathering all power
281
00:16:10,333 --> 00:16:11,666
within his hand.
282
00:16:14,533 --> 00:16:16,766
As we speak today,
283
00:16:16,766 --> 00:16:19,033
there are Saudi intellectuals
and journalists jailed.
284
00:16:19,033 --> 00:16:21,866
His murder was so
cold blooded.
285
00:16:21,866 --> 00:16:24,166
And we, we still don't have
the whole story.
286
00:16:27,066 --> 00:16:30,466
Jamal went to the consulate
in Istanbul
287
00:16:30,466 --> 00:16:33,233
and then he disappeared.
288
00:16:34,566 --> 00:16:35,866
Senior Turkish officials
289
00:16:35,866 --> 00:16:38,566
have reported that he is in fact
in the building
290
00:16:38,566 --> 00:16:41,533
and he is still here.
291
00:16:41,533 --> 00:16:44,333
His close friends and family
are still trying to figure out
292
00:16:44,333 --> 00:16:46,133
what this situation is.
293
00:16:46,133 --> 00:16:47,566
They're waiting on
an official statement.
294
00:16:47,566 --> 00:16:49,800
I spoke to his fiancée
who was also here who told us
295
00:16:49,800 --> 00:16:52,200
that they came here to issue
a number of documents
296
00:16:52,200 --> 00:16:53,866
so they could marry.
297
00:16:53,866 --> 00:16:58,700
They dispatched
an assassination team
298
00:16:58,700 --> 00:17:01,433
that landed in a plane in the,
in the airport,
299
00:17:01,433 --> 00:17:04,566
and came in cars
300
00:17:04,566 --> 00:17:08,533
with tools to hack him up,
301
00:17:08,533 --> 00:17:11,666
hack his bones,
and carry him out
302
00:17:11,666 --> 00:17:14,366
in a suitcase or suitcases.
303
00:17:14,366 --> 00:17:15,366
(scoffs)
304
00:17:15,366 --> 00:17:19,366
♪ ♪
305
00:17:19,366 --> 00:17:21,200
Pretty soon after his murder,
people started asking,
306
00:17:21,200 --> 00:17:24,366
was Pegasus used against Jamal?
307
00:17:29,000 --> 00:17:30,666
The word is that
308
00:17:30,666 --> 00:17:32,700
you sold Pegasus to them
309
00:17:32,700 --> 00:17:36,300
and then they turned it around
to get Kashoggi.
310
00:17:36,300 --> 00:17:38,300
Khashoggi's murder
is horrible.
311
00:17:38,300 --> 00:17:39,666
Really horrible.
312
00:17:39,666 --> 00:17:45,766
And therefore when I first
heard the accusations
313
00:17:45,766 --> 00:17:49,600
that our technology had been
used on Jamal Khashoggi
314
00:17:49,600 --> 00:17:54,833
or on his relatives, I started
an immediate check about it.
315
00:17:54,833 --> 00:17:57,300
And I can tell you, very clear,
316
00:17:57,300 --> 00:18:02,100
we had nothing to do
with this horrible murder.
317
00:18:09,500 --> 00:18:13,133
♪ ♪
318
00:18:13,133 --> 00:18:15,666
I'm hoping that Hatice,
Kashoggi's fiancée,
319
00:18:15,666 --> 00:18:18,866
who we'd all gotten to know
on television
320
00:18:18,866 --> 00:18:21,000
because she was outside
the consulate
321
00:18:21,000 --> 00:18:23,533
when he didn't reappear,
322
00:18:23,533 --> 00:18:27,633
I'm hoping that Hatice
will let us do forensics
323
00:18:27,633 --> 00:18:29,666
on her phone to see for certain
324
00:18:29,666 --> 00:18:33,700
whether she was targeted,
and maybe if we get lucky,
325
00:18:33,700 --> 00:18:36,033
whether we can see what
they took out of her phone.
326
00:18:36,033 --> 00:18:38,500
♪ ♪
327
00:18:55,266 --> 00:18:57,500
They killed my future.
328
00:18:57,500 --> 00:18:58,800
They killed my life.
329
00:19:01,566 --> 00:19:04,500
I felt inside me
something changed and broke.
330
00:19:08,266 --> 00:19:14,133
Do you feel like your phone
is doing anything strange?
331
00:19:14,133 --> 00:19:16,433
Do you think it could be hacked?
332
00:19:16,433 --> 00:19:17,800
We can test it
333
00:19:17,800 --> 00:19:21,066
so we could do that if,
if you wanted to do it?
334
00:19:21,066 --> 00:19:22,900
We...
Okay, you can do that.
335
00:19:22,900 --> 00:19:25,066
Okay, that'd be great.
336
00:19:25,066 --> 00:19:27,333
We just need to plug your phone
into our computer.
337
00:19:27,333 --> 00:19:29,466
Okay.
So maybe we do that.
338
00:19:29,466 --> 00:19:31,033
Great.
339
00:19:31,033 --> 00:19:33,600
(birds twittering)
340
00:19:42,366 --> 00:19:44,066
(on speakerphone): Hello?
341
00:19:44,066 --> 00:19:46,166
Claudio?
342
00:19:46,166 --> 00:19:47,500
All right.
343
00:19:47,500 --> 00:19:49,233
It's Dana.
344
00:19:49,233 --> 00:19:50,566
Hi. How are you?
345
00:19:50,566 --> 00:19:53,133
I don't know, you tell me.
346
00:19:53,133 --> 00:19:56,733
So I checked both
the uploads.
347
00:19:56,733 --> 00:19:59,400
The new one seems clean.
348
00:19:59,400 --> 00:20:01,600
The old one, however,
has some traces
349
00:20:01,600 --> 00:20:04,033
on the 6th of October 2018
350
00:20:04,033 --> 00:20:07,966
seems to have been
a first compromise.
351
00:20:07,966 --> 00:20:12,233
Which was followed by some
additional traces on the ninth.
352
00:20:12,233 --> 00:20:13,466
And then on the 12th.
353
00:20:13,466 --> 00:20:14,666
There is also
an additional record
354
00:20:14,666 --> 00:20:17,766
in June of 2019.
355
00:20:17,766 --> 00:20:21,033
But that seems to be
probably a failed attempt
356
00:20:21,033 --> 00:20:23,833
and I don't see anything
following that.
357
00:20:23,833 --> 00:20:25,200
Okay.
358
00:20:28,433 --> 00:20:30,733
The analysis proved
that the phone belonging
359
00:20:30,733 --> 00:20:34,633
to Jamal Kashoggi's fiancée
had been infected with Pegasus.
360
00:20:36,966 --> 00:20:38,500
Then we find out the date,
361
00:20:38,500 --> 00:20:40,933
which is four days
after his murder,
362
00:20:40,933 --> 00:20:44,366
when she's still trying
to figure out what's happening.
363
00:20:46,733 --> 00:20:50,366
And it just seemed like such a
ballsy move
364
00:20:50,366 --> 00:20:52,666
to surveil the person
365
00:20:52,666 --> 00:20:57,566
who has become the public face
of his disappearance.
366
00:20:57,566 --> 00:21:02,833
♪ ♪
367
00:21:15,366 --> 00:21:19,033
We learned that Jamal
had a complicated personal life.
368
00:21:20,900 --> 00:21:24,000
Hanan Atr is probably
369
00:21:24,000 --> 00:21:27,833
the least known character
in Jamal Khashoggi's life.
370
00:21:27,833 --> 00:21:30,200
She's actually his wife.
371
00:21:30,200 --> 00:21:32,066
And most people have not
heard of her.
372
00:21:32,066 --> 00:21:37,733
He had secretly married
in the United States
373
00:21:37,733 --> 00:21:41,833
in an Islamic ceremony.
374
00:21:41,833 --> 00:21:45,600
What I discovered is Hanan
is living in hiding
375
00:21:45,600 --> 00:21:46,933
in the United States
376
00:21:46,933 --> 00:21:51,133
while she waits for
her political asylum case.
377
00:21:57,600 --> 00:22:01,533
She was a flight attendant
for Emirate Airlines,
378
00:22:01,533 --> 00:22:03,200
and so she flew
all over the world,
379
00:22:03,200 --> 00:22:05,600
and she was communicating
with him on foreign phones.
380
00:22:05,600 --> 00:22:09,100
♪ ♪
381
00:22:11,566 --> 00:22:14,366
He was so happy
and I was so happy as well.
382
00:22:17,933 --> 00:22:21,833
This is in his birthday
in the restaurant in Washington,
383
00:22:21,833 --> 00:22:24,300
and his friend Maggie behind us,
384
00:22:24,300 --> 00:22:26,366
is the one she made
the birthday party.
385
00:22:26,366 --> 00:22:30,800
This all of his friends
around us.
386
00:22:30,800 --> 00:22:33,300
This last birthday in his life.
387
00:22:35,066 --> 00:22:38,033
He was careful,
but he didn't realize
388
00:22:38,033 --> 00:22:40,133
maybe my device is
much dangerous,
389
00:22:40,133 --> 00:22:41,633
and I didn't know as well.
390
00:22:41,633 --> 00:22:44,566
He suspect, but he's not sure,
and I am not sure as well.
391
00:22:47,966 --> 00:22:54,066
She allowed me
to download her phone
392
00:22:54,066 --> 00:22:59,433
to send a copy to Claudio and
to Bill Marczak at Citizen Lab,
393
00:22:59,433 --> 00:23:02,000
who also conducts
forensic analysis.
394
00:23:08,366 --> 00:23:10,566
What I did is I analyzed
395
00:23:10,566 --> 00:23:14,533
all the available data
on two Android phones
396
00:23:14,533 --> 00:23:17,233
and, and one laptop belonging
to Hanan.
397
00:23:17,233 --> 00:23:21,400
On one of the phones,
it appears that there were
398
00:23:21,400 --> 00:23:25,200
two separate links
to the Pegasus spyware
399
00:23:25,200 --> 00:23:26,933
that were actually opened.
400
00:23:26,933 --> 00:23:30,600
Before Jamal's murder,
Hanan had been detained and
401
00:23:30,600 --> 00:23:35,866
interrogated in the United Arab
Emirates, which is of course
402
00:23:35,866 --> 00:23:37,933
a close ally of Saudi Arabia.
403
00:23:39,166 --> 00:23:43,800
They took me to a office
in the airport.
404
00:23:43,800 --> 00:23:45,833
Then they took me to my house.
405
00:23:45,833 --> 00:23:47,066
They searched the whole house.
406
00:23:47,066 --> 00:23:50,033
They take my devices,
my family devices.
407
00:23:50,033 --> 00:23:51,366
They have the password.
408
00:23:51,366 --> 00:23:55,000
I was in investigation
for 17 hours,
409
00:23:55,000 --> 00:23:57,233
until I got tired,
I slept on the floor.
410
00:23:57,233 --> 00:24:00,966
What Bill discovered
411
00:24:00,966 --> 00:24:05,333
was when she was detained
at the U.A.E. airport,
412
00:24:05,333 --> 00:24:08,400
somebody who took her phone
413
00:24:08,400 --> 00:24:11,300
then opened a browser
on her phone,
414
00:24:11,300 --> 00:24:12,766
and then typed in a URL
415
00:24:12,766 --> 00:24:19,033
that then directed the phone to
a website known to Citizen Lab
416
00:24:19,033 --> 00:24:24,033
as being a Pegasus website
that activates the infection.
417
00:24:24,033 --> 00:24:27,666
The link to Pegasus
was actually typed into
418
00:24:27,666 --> 00:24:30,233
the web browser,
character by character.
419
00:24:30,233 --> 00:24:32,633
They made a couple of typos
actually while they were
420
00:24:32,633 --> 00:24:34,933
doing it which tells me
it was done manually.
421
00:24:36,766 --> 00:24:39,766
We have the smoking gun
from Hanan's phone
422
00:24:39,766 --> 00:24:42,266
which is the traces of
the spyware.
423
00:24:42,266 --> 00:24:44,800
You know, almost certainly
the spyware was installed
424
00:24:44,800 --> 00:24:48,333
and exfiltrated information
from, from her phone.
425
00:24:48,333 --> 00:24:51,333
So she was, in my view,
monitored.
426
00:24:54,066 --> 00:24:55,800
He was telling me
what he's doing,
427
00:24:55,800 --> 00:24:58,033
and what his connection,
what his movement,
428
00:24:58,033 --> 00:25:00,200
what is his state of mind.
429
00:25:00,200 --> 00:25:02,200
So you were communicating
with him.
430
00:25:02,200 --> 00:25:03,966
A lot.
431
00:25:03,966 --> 00:25:07,566
They tracked my husband
through me, a long time back,
432
00:25:07,566 --> 00:25:09,566
before they kill him
433
00:25:09,566 --> 00:25:11,866
because he was telling me,
only me, everything.
434
00:25:11,866 --> 00:25:15,000
♪ ♪
435
00:25:15,000 --> 00:25:17,200
I didn't know this much
they track him through me
436
00:25:17,200 --> 00:25:18,966
all the time.
437
00:25:18,966 --> 00:25:20,566
Mm-hmm.
Yeah.
438
00:25:20,566 --> 00:25:23,333
Why is this all come in
my life?
439
00:25:23,333 --> 00:25:26,700
They did track Jamal,
and to kill him through me,
440
00:25:26,700 --> 00:25:28,200
long time back.
441
00:25:28,200 --> 00:25:31,733
♪ ♪
442
00:25:47,566 --> 00:25:52,500
♪ ♪
443
00:26:07,233 --> 00:26:09,400
Getting evidence
on the device of Hanan,
444
00:26:09,400 --> 00:26:11,033
on the device of Hatice,
445
00:26:11,033 --> 00:26:12,700
all of that was breaking
446
00:26:12,700 --> 00:26:16,400
the narrative of the C.E.O.
of NSO Group
447
00:26:16,400 --> 00:26:19,433
who told to the press
that that spyware
448
00:26:19,433 --> 00:26:22,900
were never used against the...
Jamal or the relatives of Jamal.
449
00:26:22,900 --> 00:26:27,900
♪ ♪
450
00:26:32,600 --> 00:26:33,766
In the list,
451
00:26:33,766 --> 00:26:37,300
we saw more than
15,000 Mexican numbers.
452
00:26:40,600 --> 00:26:42,900
Mexico was among
the very first customers
453
00:26:42,900 --> 00:26:44,100
of the NSO Group.
454
00:26:47,000 --> 00:26:51,633
One of Mexico's best-known
journalists is Carmen Aristegui
455
00:26:51,633 --> 00:26:53,766
and she was part of
our investigation.
456
00:26:53,766 --> 00:26:55,800
♪ ♪
457
00:26:58,800 --> 00:27:01,533
She has maybe more followers
458
00:27:01,533 --> 00:27:03,766
than the president of Mexico.
459
00:27:03,766 --> 00:27:06,500
And we needed to understand
460
00:27:06,500 --> 00:27:09,500
who those phone numbers in
Mexico belongs to.
461
00:27:11,800 --> 00:27:16,633
(phone chiming)
462
00:27:16,633 --> 00:27:18,066
CARMEN: Hola.
463
00:27:18,066 --> 00:27:19,366
Hola, Carmen, es Arthuro
de "Forbidden Stories."
464
00:27:19,366 --> 00:27:20,700
¿Cómo estás?
465
00:27:20,700 --> 00:27:22,966
CARMEN: ¿Cómo estás?
Qué gusto.
466
00:27:22,966 --> 00:27:28,000
Forbidden tuvo un universo de
más de 50,000 números,
467
00:27:28,000 --> 00:27:31,100
pero había que saber de quién
eran esos números.
468
00:27:31,100 --> 00:27:34,633
Se tenía que investigar
uno por uno.
469
00:27:34,633 --> 00:27:37,366
ARTHUR: Y, Carmen, hay muchos
contactos de tu teléfono
470
00:27:37,366 --> 00:27:38,800
en nuestra lista.
471
00:27:38,800 --> 00:27:41,066
CARMEN: Uf. Okey.
472
00:27:41,066 --> 00:27:43,933
ARTHUR: Lo que, lo que
podemos hacer ahora
473
00:27:43,933 --> 00:27:47,000
es que puedes entrar los números
en tu teléfono
474
00:27:47,000 --> 00:27:50,633
para decirme a
quién pertenecen los números.
475
00:27:50,633 --> 00:27:52,266
CARMEN: Así lo vamos
a hacer.
476
00:27:53,266 --> 00:27:55,200
(muttering)
477
00:27:56,866 --> 00:27:59,266
Tengo un directorio nutrido
478
00:27:59,266 --> 00:28:02,233
y entonces ese directorio
lo cruzamos
479
00:28:02,233 --> 00:28:06,000
con los números de Forbidden
y los números de mi directorio.
480
00:28:07,266 --> 00:28:11,233
El tercero es, Sandra Nogales
481
00:28:11,233 --> 00:28:13,700
que por muchos años fue
mi asistente.
482
00:28:14,866 --> 00:28:18,033
!¡¡Ah, caray!
Tengo aquí una sorpresa.
483
00:28:18,033 --> 00:28:22,000
El séptimo número corresponde
a Karina Maciel.
484
00:28:22,000 --> 00:28:25,366
Karina Maciel es la productora
de mi programa
485
00:28:25,366 --> 00:28:29,300
en la cadena de
televisión CNN en México.
486
00:28:29,300 --> 00:28:31,766
Otro colega periodista
487
00:28:31,766 --> 00:28:35,566
de la revista Processo,
Alejadro Caballero.
488
00:28:37,600 --> 00:28:40,433
Al cruzar, empezaron a salir
nombres, nombres, nombres,
489
00:28:40,433 --> 00:28:43,233
nombres, nombres
y nosotros decíamos:
490
00:28:43,233 --> 00:28:45,366
¿hasta dónde va
a terminar esto?
491
00:28:46,866 --> 00:28:50,700
Ah, caray, el que sigue es
Alejandro Encinas,
492
00:28:50,700 --> 00:28:57,033
es un muy importante
político de la izquierda.
493
00:28:57,033 --> 00:29:02,466
Y estaban ahí políticos,
diplomáticos, abogados,
494
00:29:02,466 --> 00:29:07,233
periodistas, activistas,
defensores de derechos humanos.
495
00:29:07,233 --> 00:29:09,533
Ah, caray.
(laughs)
496
00:29:09,533 --> 00:29:14,033
Bueno, aquí te puedo decir que
está mi hermana.
497
00:29:14,033 --> 00:29:18,066
Aquí aparece mi hermana,
Teresa Aristegui Flores.
498
00:29:19,900 --> 00:29:22,633
Es mi hermana,
pero no está relacionada
499
00:29:22,633 --> 00:29:25,333
con ninguna
actividad pública.
500
00:29:27,266 --> 00:29:31,600
Yo intuyo que aquí
nadie se salva,
501
00:29:31,600 --> 00:29:35,300
Si hicieron esto, imagínate,
ya perdieron el pudor.
502
00:29:35,300 --> 00:29:38,666
ÓÓsea, pudieron haber espiado
a su gato, ¿no?
503
00:29:38,666 --> 00:29:41,466
A su perro, al canario.
504
00:29:41,466 --> 00:29:43,866
(laughs) ÓÓsea...
505
00:29:43,866 --> 00:29:46,166
¿Estás de acuerdo?
A su propia familia.
506
00:29:52,833 --> 00:29:54,233
We knew
507
00:29:54,233 --> 00:29:56,133
from a previous investigation
that Carmen's phone
508
00:29:56,133 --> 00:30:00,300
was heavily targeted with
Pegasus in 2015 and 2016.
509
00:30:04,400 --> 00:30:07,933
So from that date,
she is still investigating
510
00:30:07,933 --> 00:30:10,366
NSO Group, the Pegasus spyware
511
00:30:10,366 --> 00:30:13,733
or the agents and operators who
are using that in Mexico.
512
00:30:14,833 --> 00:30:17,166
CARMEN: Durante los años que
fui espiada,
513
00:30:17,166 --> 00:30:18,700
estuvimos realizando
investigaciones
514
00:30:18,700 --> 00:30:20,733
periodísticas importantes
para México
515
00:30:20,733 --> 00:30:23,933
relacionadas con la Casa Blanca
516
00:30:23,933 --> 00:30:25,633
del presidente
Enrique Peña Nieto.
517
00:30:31,200 --> 00:30:35,066
Una casa en un barrio muy lujoso
de la Ciudad de México,
518
00:30:35,066 --> 00:30:38,600
en posesión del presidente de
México, de Enrique Peña Nieto,
519
00:30:38,600 --> 00:30:40,733
y de su familia,
que no podían explicar.
520
00:30:43,266 --> 00:30:47,033
Que desde luego no podía haber
obtenido el presidente
521
00:30:47,033 --> 00:30:49,466
con los ingresos
que el presidente
522
00:30:49,466 --> 00:30:52,600
pudo haber tenido como
presidente, como gobernador
523
00:30:52,600 --> 00:30:55,233
o como hijo de una familia
de clase media.
524
00:30:58,433 --> 00:31:02,366
♪ ♪
525
00:31:04,366 --> 00:31:09,700
Es que yo sospecho
que mi teléfono está intervenido
526
00:31:09,700 --> 00:31:12,700
y el teléfono de mi hijo Emilio
está intervenido
527
00:31:12,700 --> 00:31:17,466
es cuando Emilio, un chico menor
de edad, me pregunta:
528
00:31:17,466 --> 00:31:20,300
"¿Oye, mamá, eh,
tú sabes por qué recibo
529
00:31:20,300 --> 00:31:22,100
estos mensajes tan extraños?"
530
00:31:22,100 --> 00:31:25,500
Y yo le digo: "Yo también estoy
recibiendo mensajes extraños."
531
00:31:28,300 --> 00:31:30,666
♪ ♪
532
00:31:30,666 --> 00:31:34,533
(chattering indistinctly)
533
00:31:36,366 --> 00:31:39,533
Que hicieras clic
para ver algún problema
534
00:31:39,533 --> 00:31:41,100
de tu visa en Estados Unidos.
535
00:31:41,100 --> 00:31:43,733
Claro, claro, claro, ¿qué
puede estar mal con tu visa, no?
536
00:31:43,733 --> 00:31:45,700
CARMEN: Sí, pero era
imposible que no hicieras clic.
537
00:31:45,700 --> 00:31:47,800
A ver,
yo veía mi visa y decía,
538
00:31:47,800 --> 00:31:51,233
pues que vigencia tiene...
tiene.
539
00:31:51,233 --> 00:31:53,433
Fuera de la vigencia,
¿qué problema puede tener?
540
00:31:53,433 --> 00:31:55,600
Pero, sabe, es algo que
es inevitable,
541
00:31:55,600 --> 00:31:57,500
que hagas un clic.
Que les piques.
542
00:31:58,566 --> 00:32:03,566
Sabemos que Pegasus se vendió
a la Procuraduría General
543
00:32:03,566 --> 00:32:06,933
de la República, se vendió
Pegasus al Ejército,
544
00:32:06,933 --> 00:32:10,166
se vendió Pegasus al CISEN, al
Sistema de Inteligencia,
545
00:32:10,166 --> 00:32:15,933
se vendió Pegasus a algunas
instancias de caracter publico.
546
00:32:20,633 --> 00:32:22,866
SOURCE (voice distorted):
No puedo decirles mi nombre.
547
00:32:25,733 --> 00:32:29,600
No puedo referir con exactitud
la institución
548
00:32:29,600 --> 00:32:32,666
en la cual me desempeñé.
549
00:32:32,666 --> 00:32:37,400
Y puede resultar peligroso
para mí la identificación
550
00:32:37,400 --> 00:32:41,333
y el conocimiento de que
yo tengo o tuve acceso
551
00:32:41,333 --> 00:32:43,166
a cierta información.
552
00:32:45,733 --> 00:32:50,100
El sistema Pegasus, pues era
toda una novedad para nosotros.
553
00:32:50,100 --> 00:32:54,900
El procedimiento era tener
el número objetivo,
554
00:32:54,900 --> 00:32:59,000
hacer lo que se denominaba
la ingeniería social,
555
00:32:59,000 --> 00:33:03,933
que es búsqueda de información
en fuentes abiertas
556
00:33:03,933 --> 00:33:09,900
del objetivo con la finalidad
de elaborar mensajes de texto
557
00:33:09,900 --> 00:33:12,433
que pudieran ser enviados
al dispositivo móvil.
558
00:33:14,066 --> 00:33:17,400
Debiera ser uno o dos
intentos muy precisos
559
00:33:17,400 --> 00:33:20,533
con información que le resultara
útil al objetivo
560
00:33:20,533 --> 00:33:22,766
y que este pudiera dar clic.
561
00:33:24,000 --> 00:33:29,200
Si lográbamos el éxito de que
diera clic en el mensaje,
562
00:33:29,200 --> 00:33:33,166
eso automáticamente instalaba
el software en el equipo móvil,
563
00:33:33,166 --> 00:33:37,000
y a partir de ahí, ya podíamos
tener acceso al teléfono,
564
00:33:37,000 --> 00:33:38,333
a toda la información.
565
00:33:38,333 --> 00:33:41,500
Los resultados, pues,
eran increíbles
566
00:33:41,500 --> 00:33:43,466
porque una vez que se lograba
567
00:33:43,466 --> 00:33:45,700
instalar infectar
el dispositivo,
568
00:33:45,700 --> 00:33:49,266
se tenía acceso pleno
al equipo móvil.
569
00:33:52,266 --> 00:33:55,600
Era una pantalla negra.
570
00:33:55,600 --> 00:33:58,033
En la parte superior izquierda
teníamos
571
00:33:58,033 --> 00:34:00,266
la visualización principal
572
00:34:00,266 --> 00:34:04,533
y en la parte del lado
derecho y abajo
573
00:34:04,533 --> 00:34:10,133
estaban, digamos, módulos
o pestañas en donde se tenía
574
00:34:10,133 --> 00:34:14,933
cada una de las aplicaciones de
las que se extraía información.
575
00:34:14,933 --> 00:34:18,500
Por ejemplo, teníamos el cuadro
de la aplicación
576
00:34:18,500 --> 00:34:20,966
de WhatsApp, Telegram.
577
00:34:20,966 --> 00:34:26,000
Abajo teníamos los micrófonos,
el micrófono, las cámaras,
578
00:34:26,000 --> 00:34:31,400
la geolocalización y dependiendo
de lo que nos interesara,
579
00:34:31,400 --> 00:34:34,133
le dábamos clic y era
lo que se proyectaba
580
00:34:34,133 --> 00:34:36,066
en la visualización principal.
581
00:34:38,133 --> 00:34:41,900
A partir de la infección
cualquier información
582
00:34:41,900 --> 00:34:46,266
que sea eliminad podemos
verla nosotros.
583
00:34:46,266 --> 00:34:49,166
Y a sea en fotos
o conversaciones.
584
00:34:49,166 --> 00:34:51,933
Pero podemos seguir viéndolas.
585
00:34:57,100 --> 00:35:01,666
CARMEN: Cuando empiezas
a saber qué cosa es Pegasus,
586
00:35:01,666 --> 00:35:03,100
te vas de espaldas.
587
00:35:04,333 --> 00:35:08,666
Quedas desnudo frente a un poder
588
00:35:08,666 --> 00:35:11,166
que no sabes quién detenta.
589
00:35:11,166 --> 00:35:15,500
Quedas vulnerable frente
a alguien
590
00:35:15,500 --> 00:35:18,233
que está observándote
bajo una lupa.
591
00:35:18,233 --> 00:35:22,100
Pueden estar contigo
en la oficina, en la regadera,
592
00:35:22,100 --> 00:35:26,600
en la cocina con un amigo,
con una fuente.
593
00:35:26,600 --> 00:35:29,266
Todo el tiempo.
594
00:35:32,966 --> 00:35:37,766
♪ ♪
595
00:35:53,933 --> 00:35:58,233
♪ ♪
596
00:35:58,233 --> 00:36:01,533
All the time during this
investigation,
597
00:36:01,533 --> 00:36:04,500
we tried every day to identify
598
00:36:04,500 --> 00:36:07,600
the person behind
that phone number.
599
00:36:07,600 --> 00:36:10,266
(indistinct phone chatter)
600
00:36:10,266 --> 00:36:12,233
This is what all the partners
601
00:36:12,233 --> 00:36:14,800
in Forbidden's team were
doing most of the time.
602
00:36:14,800 --> 00:36:17,066
Basically, the consortium had
access
603
00:36:17,066 --> 00:36:21,900
to a list of potential targets.
604
00:36:21,900 --> 00:36:23,500
Exactly.
605
00:36:23,500 --> 00:36:27,033
To be sure that you was indeed
infected or surveilled,
606
00:36:27,033 --> 00:36:29,266
we would have to run forensic
analysis.
607
00:37:13,166 --> 00:37:17,266
(gently):
Of course, of course.
608
00:37:20,600 --> 00:37:22,533
(sighs)
609
00:37:24,433 --> 00:37:27,800
I saw one number in the
list that belonged to a friend,
610
00:37:27,800 --> 00:37:29,900
a journalist in Azerbaijan.
611
00:37:35,233 --> 00:37:37,800
Her name is Khadija
Ismayilova.
612
00:37:37,800 --> 00:37:40,633
She's an award-winning
investigative reporter
613
00:37:40,633 --> 00:37:42,533
and an outspoken critic
of the government,
614
00:37:42,533 --> 00:37:44,633
renowned for her exposés
615
00:37:44,633 --> 00:37:46,833
of corruption at the hands of
the country's president.
616
00:37:48,800 --> 00:37:50,566
Azerbaijan, you have
a lot of oil and gas.
617
00:37:52,500 --> 00:37:54,433
It's a dictatorship.
618
00:37:54,433 --> 00:37:57,800
And the dictator's name
is Ilham Aliyev.
619
00:37:57,800 --> 00:38:00,600
And this person and this state
620
00:38:00,600 --> 00:38:03,466
is extremely violent
621
00:38:03,466 --> 00:38:07,366
against dissidents, political
opponents, journalists.
622
00:38:09,600 --> 00:38:13,200
I first met Khadija
Ismayilova in Azerbaijan
623
00:38:13,200 --> 00:38:16,233
in about 2006, 2007.
624
00:38:17,500 --> 00:38:21,200
Khadija Ismayilova relentlessly
kept on exposing
625
00:38:21,200 --> 00:38:25,000
the wrongdoing and the
corruption of the Aliyev regime.
626
00:38:25,000 --> 00:38:27,533
She showed how, you know,
627
00:38:27,533 --> 00:38:29,400
they were having their hands
628
00:38:29,400 --> 00:38:33,100
into a big chunk of the
Azerbaijani economy.
629
00:38:33,100 --> 00:38:36,200
She was showing how they were,
you know, taking money
630
00:38:36,200 --> 00:38:37,800
in a covert way,
631
00:38:37,800 --> 00:38:39,733
how they were stealing money,
basically, from the people.
632
00:38:41,000 --> 00:38:44,366
(speaking Azerbaijani):
633
00:38:47,200 --> 00:38:50,100
(shouting)
634
00:38:52,866 --> 00:38:54,466
She kept on doing what
she was doing.
635
00:38:54,466 --> 00:38:56,100
And she got arrested.
636
00:38:56,100 --> 00:38:58,733
She got thrown behind bars.
637
00:39:03,600 --> 00:39:06,000
After all this investigating
reporting,
638
00:39:06,000 --> 00:39:08,833
Khadija became a
prime target
639
00:39:08,833 --> 00:39:11,966
for the government
in Baku and for the Aliyevs.
640
00:39:18,300 --> 00:39:22,366
I don't know how to, to
proceed with Khadija,
641
00:39:22,366 --> 00:39:25,633
because I don't want us
to put Khadija in danger.
642
00:39:25,633 --> 00:39:28,633
The thing that is quite
difficult is how
643
00:39:28,633 --> 00:39:30,666
to get in touch with Khadija
644
00:39:30,666 --> 00:39:34,700
without communicating on
electronic device.
645
00:39:34,700 --> 00:39:36,666
This is very sensitive,
right? Yeah.
646
00:39:36,666 --> 00:39:39,433
This is very, very
sensitive, especially for her,
647
00:39:39,433 --> 00:39:40,900
because she's basically on
probation.
648
00:39:40,900 --> 00:39:43,766
That's gonna be a risk anyway.
649
00:39:43,766 --> 00:39:48,533
We learned that Khadija was
about to go to Turkey
650
00:39:48,533 --> 00:39:53,366
for some personal reasons, and
so we set up immediately a team
651
00:39:53,366 --> 00:39:55,833
who went to Turkey
to meet Khadija
652
00:39:55,833 --> 00:39:58,033
once she landed in the airport.
653
00:40:02,066 --> 00:40:05,600
♪ ♪
654
00:40:20,233 --> 00:40:22,566
Now, I'm nervous.
(chuckles)
655
00:40:22,566 --> 00:40:24,400
I'm nervous too.
656
00:40:24,400 --> 00:40:26,800
I cannot stand still.
657
00:40:28,933 --> 00:40:30,500
(sighs)
658
00:40:32,366 --> 00:40:35,366
There she is.
Khadija!
659
00:40:37,433 --> 00:40:41,033
(laughs)
660
00:40:42,533 --> 00:40:45,600
So many years!
661
00:40:47,200 --> 00:40:50,533
(indistinct chatter)
662
00:40:57,600 --> 00:40:59,866
(indistinct chatter)
663
00:40:59,866 --> 00:41:01,633
It's a good size.
664
00:41:01,633 --> 00:41:04,533
We can take these off, right?
665
00:41:13,833 --> 00:41:18,233
So we have about 1,000
numbers from Azerbaijan
666
00:41:18,233 --> 00:41:20,866
and you're among them.
Oh!
667
00:41:20,866 --> 00:41:22,566
And then we also have
668
00:41:22,566 --> 00:41:24,766
some people who are your
friends.
669
00:41:24,766 --> 00:41:29,233
Okay, and what does that
program do?
670
00:41:29,233 --> 00:41:32,733
So what the program does is,
it basically,
671
00:41:32,733 --> 00:41:35,766
without you knowing, um,
672
00:41:35,766 --> 00:41:38,433
it installs things on your
phone. (bleep)
673
00:41:38,433 --> 00:41:42,533
And then it allows...
674
00:41:42,533 --> 00:41:44,633
Even if I didn't click
on anything?
675
00:41:44,633 --> 00:41:47,766
Yes, so the secrecy of
this, it's called Pegasus,
676
00:41:47,766 --> 00:41:50,600
and the secrecy of it is that
677
00:41:50,600 --> 00:41:54,166
you don't actually see
or you don't do anything.
678
00:41:54,166 --> 00:41:57,166
So before, you had to click on
something, to be infected.
679
00:41:57,166 --> 00:42:00,466
In this case, it all happens
in the background,
680
00:42:00,466 --> 00:42:03,500
and you have no
idea that you are infected.
681
00:42:03,500 --> 00:42:05,266
(bleep)
And when you're infected,
682
00:42:05,266 --> 00:42:07,300
it's transmitting your messages
683
00:42:07,300 --> 00:42:10,600
your images, everything that's
happening on your phone,
684
00:42:10,600 --> 00:42:14,500
including on signal, because
they have the phone itself.
685
00:42:14,500 --> 00:42:16,466
And it's legal to sell it?
686
00:42:16,466 --> 00:42:21,033
Yes, so what we know
is that most likely,
687
00:42:21,033 --> 00:42:24,433
sometimes in 2018,
the government got it.
688
00:42:24,433 --> 00:42:27,600
Okay.
And we have a lot of data
689
00:42:27,600 --> 00:42:29,500
from 2019.
690
00:42:29,500 --> 00:42:32,600
And, you know, that was
a big year of protest.
691
00:42:32,600 --> 00:42:34,100
You were on a hunger strike
with other people.
692
00:42:34,100 --> 00:42:35,466
Yeah, yeah.
693
00:42:35,466 --> 00:42:37,100
You guys had a woman march.
Yeah.
694
00:42:37,100 --> 00:42:38,900
You were leading the march.
695
00:42:38,900 --> 00:42:41,000
(quietly):
(bleep)
696
00:42:41,000 --> 00:42:42,666
(laughs)
697
00:42:42,666 --> 00:42:46,200
It's... kind of the most,
like, in the country.
698
00:42:49,766 --> 00:42:53,800
So one way for us to verify
that, you know,
699
00:42:53,800 --> 00:42:57,433
what exactly, you know,
was done in your case
700
00:42:57,433 --> 00:42:59,400
would be to do forensic
on your phone.
701
00:42:59,400 --> 00:43:01,766
Yes, why not?
702
00:43:06,166 --> 00:43:11,066
Is there any way to avoid
this surveillance?
703
00:43:11,066 --> 00:43:13,900
Yes, we will set you up
with a new device
704
00:43:13,900 --> 00:43:17,166
that you will be able to use.
705
00:43:17,166 --> 00:43:19,400
And a phone.
Is there a balcony?
706
00:43:20,433 --> 00:43:25,300
...be some way, you know,
to do it like...
707
00:43:25,300 --> 00:43:27,333
There are other ways to
communicate.
708
00:43:27,333 --> 00:43:29,433
Yeah.
709
00:43:36,433 --> 00:43:39,433
It's like...
710
00:43:39,433 --> 00:43:41,733
It makes you to want
711
00:43:41,733 --> 00:43:44,066
to live in the bubble.
712
00:43:45,766 --> 00:43:49,966
But then, like, so no one can
enter.
713
00:43:49,966 --> 00:43:53,866
Like, in some sort of...
714
00:43:55,700 --> 00:44:00,000
Like living, like living inside
the condom.
715
00:44:00,000 --> 00:44:03,266
But then you cannot reproduce.
716
00:44:10,733 --> 00:44:15,100
♪ ♪
717
00:44:22,600 --> 00:44:24,366
That's her phone.
718
00:44:27,300 --> 00:44:29,166
You don't need any cables?
719
00:44:29,166 --> 00:44:30,566
Nope.
Okay.
720
00:44:38,666 --> 00:44:41,933
Do you know if she still has
a backup of the phone?
721
00:44:41,933 --> 00:44:44,066
Yes, she does. Yes, she does.
Okay.
722
00:44:44,066 --> 00:44:47,200
Well, right now I'm trying
to jailbreak the phone.
723
00:44:47,200 --> 00:44:48,833
(phone chimes)
724
00:44:50,566 --> 00:44:53,033
Hopefully, it works.
725
00:45:02,766 --> 00:45:06,300
So right now, I am...
726
00:45:08,833 --> 00:45:10,700
navigating through the phone.
727
00:45:14,900 --> 00:45:16,133
So I'm looking for things
728
00:45:16,133 --> 00:45:18,433
that might have executed network
activity
729
00:45:18,433 --> 00:45:20,633
that is connectable
to the company,
730
00:45:20,633 --> 00:45:24,600
any leftovers of malicious
executions.
731
00:45:27,500 --> 00:45:29,000
Um, accounts that we know of--
anything,
732
00:45:29,000 --> 00:45:33,900
essentially, that tells me
the history of this phone.
733
00:45:40,266 --> 00:45:43,800
That's interesting, that's not
something I've seen before.
734
00:45:52,200 --> 00:45:54,333
We see processes
735
00:45:54,333 --> 00:45:57,533
that we know
are connected to Pegasus,
736
00:45:57,533 --> 00:45:59,833
We see some iMessage accounts
737
00:45:59,833 --> 00:46:03,566
that are connected
to the attacks.
738
00:46:04,700 --> 00:46:07,666
Because this might indicate
what was the entry point.
739
00:46:07,666 --> 00:46:09,400
Oh, it was Apple Music,
what the (bleep)?
740
00:46:09,400 --> 00:46:11,833
Oh, really?
741
00:46:11,833 --> 00:46:15,333
That's, that's weird.
742
00:46:15,333 --> 00:46:18,966
So they might have started
using Apple Music to exploit it?
743
00:46:21,866 --> 00:46:24,233
Um...
744
00:46:24,233 --> 00:46:25,833
I have to do some more digging
on this,
745
00:46:25,833 --> 00:46:27,400
because I need to look at
746
00:46:27,400 --> 00:46:30,233
what specifically these
applications are.
747
00:46:34,133 --> 00:46:37,100
She's definitely among
the ones most targeted.
748
00:46:43,933 --> 00:46:46,933
♪ ♪
749
00:46:48,266 --> 00:46:49,433
It's important
750
00:46:49,433 --> 00:46:51,666
to rectify this story,
which is that
751
00:46:51,666 --> 00:46:55,233
these technologies
are exclusively used
752
00:46:55,233 --> 00:46:57,100
for good purposes and
for fighting evil
753
00:46:57,100 --> 00:47:00,800
and for fighting crime
and terrorism and all that.
754
00:47:04,866 --> 00:47:06,466
(dog barking)
755
00:47:08,666 --> 00:47:10,100
Okay, so-- no,
Khadija is coming.
756
00:47:10,100 --> 00:47:11,433
(chuckles)
757
00:47:11,433 --> 00:47:13,766
Hi, Claudio.
758
00:47:13,766 --> 00:47:16,433
(on phone): Hi.
759
00:47:16,433 --> 00:47:19,000
So now tell me how bad it is.
760
00:47:22,566 --> 00:47:29,633
(on phone): Okay, there are
definitely some records
761
00:47:29,633 --> 00:47:34,300
that, that indicate various
points
762
00:47:34,300 --> 00:47:37,400
where the phone seemed to have
been compromised.
763
00:47:37,400 --> 00:47:38,800
Mm-hmm.
764
00:47:38,800 --> 00:47:40,966
(voiceover):
So I started feeling like
765
00:47:40,966 --> 00:47:44,333
a plague doctor in the 1300s.
766
00:47:44,333 --> 00:47:47,033
I'm basically kind of
just keeping the death count.
767
00:47:48,533 --> 00:47:51,566
I'm contributing to creating a
trauma here,
768
00:47:51,566 --> 00:47:55,433
and I can see it in many cases,
like I can see it, that they are
769
00:47:55,433 --> 00:47:58,166
right now, they're going through
a dramatic moment,
770
00:47:58,166 --> 00:48:03,333
and I'm like that person in the
room that is breaking it.
771
00:48:04,666 --> 00:48:06,800
(on phone): There are also
some more recent records
772
00:48:06,800 --> 00:48:11,233
from even as recent as early May
of this year,
773
00:48:11,233 --> 00:48:13,433
so until a couple of weeks ago.
774
00:48:13,433 --> 00:48:15,533
But all in all, it seems like
775
00:48:15,533 --> 00:48:19,166
this probably extended
between 2019 and 2020.
776
00:48:19,166 --> 00:48:21,466
2020 at the very least.
777
00:48:21,466 --> 00:48:24,166
I've been told that you will
not know
778
00:48:24,166 --> 00:48:28,700
what exactly had been monitored
or recorded.
779
00:48:28,700 --> 00:48:33,300
Yeah, with this kinds of...
kind of monitoring technology,
780
00:48:33,300 --> 00:48:37,533
the point where they have that
level of access to the device,
781
00:48:37,533 --> 00:48:41,100
virtually
everything is possible, so...
782
00:48:44,533 --> 00:48:45,766
Yeah, thank you.
783
00:48:45,766 --> 00:48:48,100
Have a good day, bye-bye.
784
00:48:48,100 --> 00:48:50,066
Bye.
785
00:48:50,066 --> 00:48:53,400
That's not great news.
Yeah.
786
00:49:03,333 --> 00:49:05,800
All night I've been thinking
about
787
00:49:05,800 --> 00:49:08,166
what did I do with my phone?
788
00:49:08,166 --> 00:49:10,833
And I feel guilty.
789
00:49:10,833 --> 00:49:14,066
I feel guilty to...
for the messages I've sent.
790
00:49:14,066 --> 00:49:18,266
I feel guilty for the
information sources that,
791
00:49:18,266 --> 00:49:22,233
that... who send me,
thinking that
792
00:49:22,233 --> 00:49:26,700
some encrypted messaging ways
are secure.
793
00:49:26,700 --> 00:49:31,233
They did it and they didn't
know that my phone is infected.
794
00:49:31,233 --> 00:49:35,933
I mean, my family members
are also victimized.
795
00:49:35,933 --> 00:49:38,666
The...
796
00:49:38,666 --> 00:49:41,633
the sources are
victimized, everyone.
797
00:49:41,633 --> 00:49:44,533
I mean, people I've been
working with,
798
00:49:44,533 --> 00:49:49,500
people who told me their private
secrets are victimized.
799
00:49:49,500 --> 00:49:51,833
Everyone, I mean,
it's not just me.
800
00:49:51,833 --> 00:49:56,800
I, I put so many people
in danger.
801
00:49:56,800 --> 00:49:58,333
And...
802
00:49:59,833 --> 00:50:02,600
And I'm angry.
803
00:50:02,600 --> 00:50:05,766
Again, I'm angry, I'm angry
with the government,
804
00:50:05,766 --> 00:50:09,833
I'm angry with the companies
that produce all these tools
805
00:50:09,833 --> 00:50:12,500
and sell it to the bad guys,
806
00:50:12,500 --> 00:50:15,900
like Aliyev's regime.
807
00:50:15,900 --> 00:50:19,266
It, it's...
808
00:50:19,266 --> 00:50:22,233
it's really... it's despicable.
809
00:50:22,233 --> 00:50:24,600
It's heinous.
810
00:50:41,366 --> 00:50:44,366
Khadija is not a terrorist,
Khadija is not a criminal.
811
00:50:46,100 --> 00:50:48,966
She's a journalist that is
taking a lot of risk
812
00:50:48,966 --> 00:50:52,400
to write some stories to make
sure people will get access
813
00:50:52,400 --> 00:50:54,033
to independent information.
814
00:50:54,033 --> 00:50:56,566
So that was one more evidence
815
00:50:56,566 --> 00:50:59,400
of the global misuse
of that spyware.
816
00:50:59,400 --> 00:51:03,833
♪ ♪
817
00:51:08,866 --> 00:51:10,433
Powerful governments manage
818
00:51:10,433 --> 00:51:14,366
to retain their power by seeing
off threats
819
00:51:14,366 --> 00:51:17,600
from people who are
campaigning for democracy
820
00:51:17,600 --> 00:51:19,600
or holding them to account,
telling the truth.
821
00:51:19,600 --> 00:51:21,866
And, you know, here's a company
822
00:51:21,866 --> 00:51:23,333
that gave them a tool to do
that.
823
00:51:25,166 --> 00:51:27,800
It's a military weapon used
against civilians.
824
00:51:29,600 --> 00:51:31,300
And the civilians,
they don't have
825
00:51:31,300 --> 00:51:34,566
any mechanism to help them
in seeking justice,
826
00:51:34,566 --> 00:51:36,900
any mechanism to find
some traces,
827
00:51:36,900 --> 00:51:39,866
any mechanisms to know that at
least they are the target.
828
00:51:43,733 --> 00:51:45,500
You got a real sense
829
00:51:45,500 --> 00:51:48,700
that it was free for all.
830
00:51:48,700 --> 00:51:50,666
That there is no control over
how countries use it,
831
00:51:50,666 --> 00:51:55,433
and they have been using it in
the worst way you could imagine.
832
00:51:57,033 --> 00:51:59,833
Even after months of
investigating
833
00:51:59,833 --> 00:52:02,800
we kept discovering
new things
834
00:52:02,800 --> 00:52:04,866
new names from the list--
835
00:52:04,866 --> 00:52:08,600
politicians, heads of state,
and even a princess.
836
00:52:11,533 --> 00:52:14,233
Hello, my name is
Latifa al-Maktoum.
837
00:52:14,233 --> 00:52:15,833
And I'm making this video
838
00:52:15,833 --> 00:52:20,666
because it could be the last
video I make, yeah.
839
00:52:21,833 --> 00:52:23,233
(sighs)
840
00:52:23,233 --> 00:52:27,566
♪ ♪
841
00:52:29,166 --> 00:52:31,133
(music ends)
842
00:52:34,166 --> 00:52:38,900
Go to pbs.org/frontline for a
Q&A with the journalists
843
00:52:38,900 --> 00:52:41,900
at Forbidden Stories who led the
Pegasus investigation.
844
00:52:41,900 --> 00:52:44,500
And once on the phone
it can extract
845
00:52:44,500 --> 00:52:46,366
and access everything from the
device.
846
00:52:46,366 --> 00:52:50,066
Everything, so once you are
infected, you're trapped.
847
00:52:50,066 --> 00:52:52,900
And an archive of stories
with our reporting partners
848
00:52:52,900 --> 00:52:55,466
on the Pegasus project.
849
00:52:55,466 --> 00:52:58,700
Connect with "Frontline" on
Facebook, Instagram and Twitter,
850
00:52:58,700 --> 00:53:01,766
and stream anytime on
the PBS app, YouTube,
851
00:53:01,766 --> 00:53:03,966
or pbs.org/frontline.
852
00:53:06,400 --> 00:53:11,566
♪ ♪
853
00:53:31,600 --> 00:53:34,666
For more on this and other
"Frontline" programs,
854
00:53:34,666 --> 00:53:37,566
visit our website at
pbs.org/frontline.
855
00:53:37,566 --> 00:53:41,333
♪ ♪
856
00:53:46,466 --> 00:53:50,633
♪ ♪
857
00:53:55,033 --> 00:53:59,333
"Frontline's" "Global Spyware
Scandal: Exposing Pegasus"
858
00:53:59,333 --> 00:54:02,133
is available on
Amazon Prime Video.
859
00:54:04,166 --> 00:54:08,366
♪ ♪
65041
Can't find what you're looking for?
Get subtitles in any language from opensubtitles.com, and translate them here.