All language subtitles for Storyville - The Spy in Your Mobile 720p HEVC BigJ0554

This programme contains some strong
language and some scenes which
some viewers may find upsetting

IN FRENCH:

REPORTER: The biggest spying scandal
in cyber history.

This investigation, which was
actually done by Forbidden Stories,

which is kind of an investigative
group based in Paris,

and shared with a number of
different news outlets.

FRENCH REPORTER:

A joint investigation
by 17 news outlets...

SPANISH REPORTER:

A massive data leak contained
over 50,000 phone numbers.

A leak of 50,000 phone numbers

belonging to some
big name politicians.

IN MANDARIN:

Pegasus.

Pegasus.

Pegasus. Pegasus.

Pegasus spyware.

Pegasus is like someone
over your shoulder.

It can read everything
you're reading,

it can watch everything
you're watching.

And once the spyware

is taking the control of your
device, basically you're trapped.

REPORTER: This software has the
potential to use the microphone

and camera to listen to
and even look at

the owners of
iPhone and Android devices.

Hello, can you hear me?

I can hear you.
I don't see you.

Hello. Hello, Paul. Hello?

Hi, Donna.

Hi, how are you? Hi, Donna.

Good, and you?

At that time, we quickly called
the Washington Post,

the Suddeutsche Zeitung, and all
the partners to tell them

that we were having access
to a list.

We wanted to tell you about some
information we have

and about a new project
we are starting.

There is a lot that concerns India.
Ah.

Some names in Mexico.

Information about Hungary.

Azerbaijan and Kazakhstan.

What we needed at that moment
was to put together

the best possible team.
We needed tech specialists.

We needed people with good knowledge
of the spyware,

and journalists with contacts in
the intelligence world.

TANNOY: Elephant and Castle.
Change here...

Paul Lewis is the head of the
investigative unit of the Guardian.

The Guardian has been working
for years on Pegasus.

The moment they mentioned
the numbers of phone numbers

that they had, the quantity
of phone numbers,

tens of thousands,

I mean, my jaw just hit the floor.

Now, we had small pieces of
the jigsaw of wrongdoing by NSO.

Never before had anyone been able
to stitch that together

and tell the whole story, so if
Forbidden Stories have got data

that can identify not just who
the customers of NSO are,

but potentially point
in the direction

of who the targets are as well,
this is a game-changer.

Israel has become the world leader
in this industry

and exports these tools
all over the world

and, if you like, NSO Group was
in many ways,

you know, the jewel in the crown.

Here was a company founded by
three guys in 2010,

a tech start-up become a unicorn
that was incredibly successful,

that claimed to have over
40 countries around the world

buying its technology.

We only sell it to government
or to entities that we know

or we want to believe
that they will not misuse the tools.

And this is how we check
the customer,

this is how we diligence them.

We have all the mechanism
to make sure

that they are not
misusing the systems.

All of us suspected that
if NSO Group was giving

authoritarian and repressive regimes

such a powerful instrument
of surveillance -

you know, you can get into the phone
of anyone in the world

and no-one's looking over your
shoulder because NSO Group says,

"You have to sign this piece
of paper to agree

"that this is just
for criminal investigations

"and terrorist investigations,

"but we're not going to check
how you use this technology."

So you have a carte blanche.

We had a kaleidoscope
of potential victims.

But how do we prove that Pegasus
was on the phones?

It's a piece of code that looks
very similar to all the others

that you are running on your phone.

It's just designed to do
something that it shouldn't.

An investigation on a spyware
like this begins with a first case,

begins with a patient zero,
so to speak,

and that opens up everything.

The very first cases,
they left their infrastructure

that was connected
to NSO.Group.com -

that was the first mistake.

And then from there
you start saying,

"OK, I've seen this infrastructure.

"It's connected to the company,
quite evidently."

These technologies
just evolve continuously,

so it's a cat and mouse game
by nature, meaning that,

but the unfortunate reality is that
against capabilities like those

that Pegasus customers have,
there's not much you can do

from a digital security perspective.
You can't really stop them.

One of the very first things
that we did after getting access

to the list was to cross-check
the list with our own contact list,

and I did that with my personal
contact list.

Immediately a phone number
popping up.

That was the phone number
of a friend of mine,

someone I know well for years.

She's a journalist in Azerbaijan
and her name is Khadija Ismayilova.

REPORTER: Her name
is Khadija Ismayilova.

She's an award-winning
investigative reporter

and an outspoken critic
of the government,

renowned for her exposes
of corruption at the hands

of the country's president.

Khadija Ismayilova relentlessly kept
on exposing the wrongdoing

and the corruption
of the Aliyev regime.

The regime of Azerbaijan is
basically controlling everything,

censoring everything. Human rights
activists, press freedom,

everything is under the control
of that ruling party.

And as soon as you start criticising
them, you will end up in jail.

She showed how they were
having their hands

into a big chunk
of the Azerbaijani economy.

She was showing how they were taking
money in a covert way,

how they were stealing money,
basically, from the people.

IN AZERBAIJANI:

SHOUTING

MAN SHOUTS: Journalist! Journalist!

After all this
investigative reporting,

Khadija became a prime target
for the government in Baku

and for the Aliyevs.

In Azerbaijan, there is a culture
of blackmailing people,

blackmailing political opponents,

blackmailing human rights activists
and journalists.

They can take your
personal pictures,

your personal video
to blackmail you,

and in 2012, Khadija Ismayilova
really paid the price for that.

I remember the day when Khadija
called me and said,

"Paul, something terrible happened.

"I received this envelope
with photos

"that are taken
in my bedroom illegally.

"They probably had a hidden camera.

"And they're blackmailing me
with these photos."

Right next to the picture, there was
a small message saying to Khadija,

"You should stop your investigation,

"otherwise we will publish
those videos."

But Khadija refused that deal

and she decided
to continue her investigation.

CLAMOURING

REPORTER: She was sentenced to
seven-and-a-half years in prison

for embezzlement and tax evasion,

but her supporters say the trial
was politically motivated

and accused the president of
cracking down on press freedoms.

I don't know how to proceed
with Khadija

because I don't want to put Khadija
in danger.

But we wanted to...

..to do some forensic of her device.

The thing that is quite difficult
is how to get in touch with Khadija

without communicating
on electronic device.

According to what we see,
we see that Khadija is really

one of the top persons of interest
for Azeri intelligence services,

which is not a surprise, of course.

This is very sensitive, right?
Yeah.

This is very, very sensitive,
especially for her,

because she's basically
on probation.

So that's going to be a risk anyway.

One day we learned that Khadija
was about to travel to Turkey

for medical reasons. So clearly,
first, that was a kind of opening.

So what we did after that is
that we decided to send one team

over there first to tell Khadija
that we were having reasons

to believe that she was surveilled,

but as well that we found a phone
number in the list.

Now I'm nervous.

LAUGHTER

I cannot stand still.

Khadija! Khadija!

How are you doing?

INDISTINCT CONVERSATION

Can we open the window?

We can take this off, right?

That's too long.

So, basically,
what we have is list of

the phone numbers that were targeted
in Azerbaijan.

That's so cool.

And...yeah, so we have about 1,000
numbers from Azerbaijan.

And you're among them.

Oh! And then we also have

some people who are your friends
and your lawyers.

Mm-hm, OK.

And what does that program do?

So what the program does is,

it basically, without you knowing,

it installs things
on your phone.

And then it allows...

Even if I didn't click on anything?

Yeah, so the secrecy of this,
it's called Pegasus,

and the secrecy of it is
that you don't actually see

or you don't do anything.

So before you had this,
you had to click on something

to be infected. Yeah.

In this case, it all happens
in the background and you have no

idea that you're infected.

And when you're infected,
it's transmitting your messages,

your images, everything that's
happened on your phone,

including the signal, because they
have the phone itself.

And it's legal to sell it? Yes.

So what we know is that most likely

some time in 2018,
the government got it.

OK. And we have a lot of data
from 2019.

And, you know, that was a big
year of protest,

you were on a hunger strike
with other people. Yeah.

You guys had a woman march,

you were leading the march. Yeah.

Shoo...

SHE LAUGHS

It's kind of the most like you
in the country.

Well, why they are so idle,
I mean, that's...

Oh.

Mm.

So one way for us to verify
that what exactly was done

in your case would be to do
forensic on your phone.

So the question is whether you would
allow us to make a backup

of your phone and basically check
it for the traces of Pegasus.

Yeah, yeah.

Is there any way to avoid
this surveillance?

Yes, we will set you up with a new
device

that you will be able to use...
On a phone.

Is there a balcony?

There must be some way
to do it.

There are other ways to
communicate... Yeah.

..securely.

It's like...

..it makes you to want to live
in the...

..bubble.

But then...

..like, so no-one can enter,
like, in some sort of...

This is her phone.

You don't need any cables?

No. OK.

Do you know if she still
has a backup?

Yes, she does.
Yes, she does. OK.

Well, right now,
I'm trying to jailbreak the phone.

PHONE BEEPS

Hopefully it works.

So right now, I am...

..navigating through the phone.

I'm looking for things that might
have executed network activity

that is connectable
to the company,

any leftovers of malicious
executions,

accounts that we know of.

Anything essentially that tells me
the history of this phone.

That's interesting. That's not
something I've seen before.

We see processes that we know
are connected to Pegasus.

We'll see some message accounts
that are connected to the attacks,

because this might indicate
what was the entry point.

Oh, it was Apple Music?
What the fuck?

Oh, really?

That's weird.

So they might have started
using Apple Music to exploit it.

Erm...

..I have to do some more digging
on this, as I need to look at

what specifically
these applications are.

It's definitely among the ones
most targeted.

No, Khadija's coming!

Hi, Claudio.

Hi.

So now tell me how bad it is.

OK.

There are definitely some records

that indicate various points

where the phone seemed
to have been compromised.

Mm-hm.

So I started feeling like I played
doctor in the 1300s,

you know, like, I'm basically kind
of just keeping the death count...

March of 2019...

..I'm contributing to creating
a trauma here

and I can see it in many cases.

Like, I can see
it that they are... Right now,

they're going to a dramatic moment.

And I'm like that person
in the room that is breaking it.

There are also some more recent
records from even as recent as early

May of this year, so until a couple
of weeks ago.

But all in all, it seems
like this probably extended

between 2019 and 2020.

2020, at the very least.

I've been told that you will not
know

what exactly had been monitored
or recorded.

With these kinds of
monitoring technology,

the point where they have that
level of access to the device,

virtually everything is possible,
so...

Yeah, thank you.
Have a good day, bye-bye.

Bye. Bye.

That's not great news. No.

All night I've been thinking
about, what did I do with my phone?

And I feel guilty.

I feel guilty, too, for the messages
I've sent.

I feel guilty for the information
sources who send me...

..thinking that some encrypted
messaging ways are secure.

They did it and they didn't know
that my phone was infected.

I mean, my family members
are also victimised.

The sources are victimised.

Everyone. I mean, people
I've been working with.

People who told me
they had private secrets.

I victimised everyone.

I mean, it's not just me, I...

..I put so many people in danger.

And...

..and I'm angry.

Again, I'm angry,
I'm angry with the government,

I'm angry with the companies
that produce all these tools

and sell it to the bad guys...

..like Aliyev regime.

It's...

It's really... It's despicable,

it's heinous, I don't know...

Israel has the advantage of not only
developing new technologies

and weaponry, but testing it live.

And this is something Israel knows
it can use to sell outside.

When you want to control a huge
population,

like we do with Palestinians,

you have to have assets everywhere,

so everyone can be a target,

because we don't want only the -
I don't know -

terrorists from the Hamas, but also
maybe his neighbour or his cousin

or the person who sells milk
in the corner of the street.

If you want to recruit human agents,

you need to collect
their weaknesses,

things that you can use
to blackmail.

And so part of what 8200 does
is to collect this blackmail

potential information
about everybody.

If you're gay or if you have
medical...special medical condition

or you have financial problems

or someone from your family has one
of those,

then that's something we can use
against you to blackmail you

and get you to cooperate.

It's this kind of approach that you
see again in other countries

used by the clients of NSO.

One of the very first things that we
have been able to see

reading the list was the very high
number of phone numbers

coming from Mexico.

But actually that was not
so surprising,

because we knew for years

that Mexico was one of

the very first customers

of the NSO Group.

And we know as well since 2017

that 19 people from the civil
society in Mexico

were targeted by Pegasus,
including one very famous journalist

called Carmen Aristegui, a
journalist who does work for CNN,

who is extremely popular
in the country.

PHONE RINGS

Carmen Aristegui was already a known
victim of the spyware.

So we asked her to join us
to investigate

the Mexican part of the Pegasus
Project,

and what we first asked her
was to help us to identify

the thousands of Mexican numbers
appearing on the list.

Right...

There's a lot of evidence to suggest
that NSO Group

had the direct backing and support
of Bibi Netanyahu's government.

In order to sell its product to
governments around the world,

it required permits,

effectively licences from the
Israeli Defence Ministry.

I decided several years ago
to turn Israel

into one of the five cyber powers
of the world.

In order for the companies
to develop,

they need to make...

What do they need to make?

Money!

They need to make money.

Now, the easiest way to make sure
that they don't make money is,

one, high taxes, right?

What's the other one?

Regulations.

Have you ever heard of regulations?

We have a problem with regulations.

So the policy we have
is keep taxes low

and keep regulations low.

Minimise regulations.

There is no industry
more susceptible

and more inviting of regulations
than cybersecurity.

It's like weapons.

It is a weapon!

Around us is a sea of dictators
and autocrats

and kings and sultans.

This is the neighbourhood we have.
We didn't choose it.

But at the end of the day,
Iran is the biggest threat

on Arabs and Israelis.

Netanyahu wanted to forge a camp,

a united front against Iran,

and he would use many, many tools
in order to do that.

One of the tools is giving
Israeli technology.

NSO has a very attractive tool.

AMITAI SIGHS

# Do-do, do-do-do-do-do-do. #

Jamal Khashoggi's murder,
really,

in the history of the Post,

stands out.

Jamal Khashoggi was an opinion
writer for the Washington Post.

Very gentle, soft-spoken man,

willing to share his opinions.

His voice became very important

because he was the single most
important dissident

writing about the Saudi regime.

Jamal, let me start with you.

You've compared your Crown Prince
to Putin,

to Iran's supreme leader.

You've said he's creating, quote,

"an interesting form
of dictatorship".

How so?

I still see him as a reformer,

but he is gathering all power
within his hand.

As we speak today, there are Saudi
intellectuals

and journalists jailed.

His murder was so cold-blooded.

Jamal Khashoggi went to the
consulate in Istanbul

and then he disappeared.

His close friends and family are
still trying to figure out

what the situation is.

They're waiting on an official
statement.

I spoke to his fiancee,
who was also here

and told us that they came here
to issue a number of documents

so they could marry.

Turkish officials believe
he was killed by agents

of his own government
inside the consulate.

They dispatched
an assassination team

that landed in a plane
in the airport

and came in cars
with tools to hack him up,

hack his bones,

and carry him out in a suitcase,
or suitcases.

Uh!

The word is that you sold Pegasus
to them,

and then they turned it around
to get Khashoggi.

Khashoggi murder is horrible -
really horrible.

And therefore, when I first
heard their accusations

that our technology been used
on Jamal Khashoggi,

or on his relatives, I started
an immediate check about it.

And I can tell you very clear.

We had nothing to do with
this horrible murder.

When Forbidden Stories
first contacted me,

the minute we found out
about this list,

the first thing we all did was
to check for any numbers

related to Jamal Khashoggi.

And right away, we found two numbers
associated with the two women

closest to him in his life.

His fiancee Hatice,

who we'd all gotten to know
on television,

because she was outside
the consulate

when he didn't reappear.

I'm hoping that they will let us
do forensics on her phone

to see for certain whether she
was targeted.

And maybe, if we get lucky,

whether we can see what they took
out of her phone.

They killed my future.

They killed my life.

I lost everything -
just the one day.

I felt inside me something changed
and broke, you know?

I remember the first days
after the murder.

A lot of times, they try to hack
my email.

Hmm.

Do you feel like your phone
is doing anything strange?

Do you think it could be hacked?

We can test it.

So we could do that if you wanted
to do it.

We... OK, you can do that.

OK, that'd be great.

Well, we just need to plug your
phone into our computer.

OK. So maybe we do that.

Great.

Hello?

Claudio?

Hi.

It's Dana.

Hi, how are you?

I don't know. You tell me.

So I checked both the uploads.

Er...

The new one seems clean to me.

The old one, however,
has some traces

on 6th October 2018.

Seems to have been a first
compromise,

which was followed by some
additional traces

on the 9th and then on the 12th.

There's also an additional record
in June of 2019,

but that seems to be probably
a failed attempt.

And I don't see anything
following that.

OK.

And then we find out the date,

which is four days after his
murder...

..when she's still outside
the embassy,

trying to figure out what's
happening.

And it just seemed like
such a ballsy move

on the Saudis' part,

to surveil the person who has become
the public face

of his disappearance.

We learnt that Jamal had a
complicated personal life.

The other phone number
that we discovered

was a woman named Hanan El-Atr.

Hanan Atr is probably the
least-known character

in Jamal Khashoggi's life.

She's actually his wife,

and most people have not
heard of her.

He actually had secretly married
in the United States

in an Islamic ceremony.

It took me a long time
to find Hanan.

And what I discovered is Hanan
is living in hiding

in the United States while she waits
for her political asylum case.

She was a flight attendant
for Emirates Airlines.

And so she flew all over the world

and she was communicating with him
on foreign phones.

He was so happy, and they were
so happy as well.

This is on his birthday in
a restaurant in Washington,

and his friend Maggie behind us -

she made the birthday party.

There's all of his friends
around us.

This last birthday in his life.

He was careful, but he didn't
realise maybe, my device,

it is much dangerous.

And I didn't know as well.

He suspect but he's not sure -
and I am not sure as well.

She allowed me to
download her phone...

..to send a copy to Bill Marczak
at Citizen Lab,

who also conducts
forensic analysis of phones.

So we've set up a meeting with Hanan
and her lawyer, Randa Fahmy,

and Bill's going to Zoom in from
California, where he's working.

What I did is I analysed,

erm, all the available data
on two Android phones

and one laptop belonging to Hanan.

On one of the phones,

it appears that there
were two separate links

to the Pegasus spyware
that were actually opened.

There are a number...

In fact, there are
seven text messages

from a period of November 8th
to November 26th 2017.

We have the smoking gun
from Hanan's phone.

There was no other member
of Jamal's family

that was spied on
prior to the murder.

He was telling me what he's doing
and what his connection,

what is his movement,
what is his state of mind.

So you were communicating
with him. A lot.

They tracked my husband
through me a long time back

before they killed him.

Because he was telling me,
only me, everything.

I didn't know this much - they track
him through me all the time.

Mm-hm. Yeah.

Why is this all coming in my life?

They did track Jamal and
kill him through me.

Long time back.

This is a very crucial information,
because we know for years

that NSO Group has always say
that if we learn one day

about any kind of misuse
from our spyware,

used against dissidents,
used against journalists,

used against the
human rights activists,

we will then, of course,
investigate the case.

But in that case we're talking
about, that's extremely serious.

We're talking about someone
who has been dismembered

within the consulate, who has been
killed within the consulate

and we know that
the relatives of that person

have been targeted by Pegasus.

It's important to rectify
this story,

which is that these technologies
are necessary

and exclusively used
for good purposes

and for fighting evil
and for fighting crime

and terrorism and all that.

This is a bunch of lies
for the most part,

on the part of this industry
who has a vested interest

in exploiting as much as possible
out of this to make money.

When we started analysing the list,

we immediately saw
a lot of French numbers,

more than 1,000 potentially
targeted by Morocco.

There were journalists,
lawyers, activists, but not only.

We also saw 15 members
of the French government

and the President Macron himself.

At that moment,
we immediately realised

that this was going to be a bomb.

Mm-hm.

The last phase was
very, very intense.

This is precisely the moment
where you knock on the door

of the NSO Group and you told them

we were investigating you
for months.

We know about your businesses

and we have plenty
of questions to ask you.

And so we were thinking
that we should get some answers

in the next hours following the
email, but nothing was happening.

PHONE RINGS OUT

Hello. This is Laurent Richard
from Forbidden Stories.

How are you doing?

Yeah, I'm good.

Yeah. Thank you for taking
the time to answer.

I was just wondering if you are
planning to answer our question.

Well, you can see it
in your email now.

EMAIL NOTIFICATION

OK. I see it.

Thank you. OK. Bye.
Thank you. Bye. Bye.

So, at the end, what we got
was a very, very short email,

very brief, where NSO Group
were telling us that

all your questions, all your
information, everything is wrong.

But what we can tell you that
we are here just to save life,

just to fight terrorism,
and that's it.

"Furthermore, as NSO
has previously stated,

"our technology was not
associated in any way

"with the heinous murder of
Jamal Khashoggi.

"This includes listening,
monitoring,

"tracking or collecting
information..."

At that time, here,
there was a kind of calm,

but the calm, you know,
that is preceding the storm.

But we discovered the day after
that, NSO sent letters,

letters from lawyers
to most of the partners

at the same time on all continents,

to threaten them and to tell them
that if you publish anything,

we will sue you.

Here was a company valued
at over a billion dollars.

The NSO Group and its clients,

these governments, were not
going to put their hands up

and confess to this activity.

They were fighting it as hard
as they possibly could.

It's a bit tense here,
if I'm honest. Yeah. Yeah.

Erm...

We've had a provisional response
from NSO to the Washington Post,

and we will have the formal...

..another response
from them to us in about...

..15, 20 minutes, so we're going
to keep this call really quick.

Erm...

VOICEOVER: The stakes
are really high

when you do this kind of reporting.

..discussions around the public
interest and exactly what it is...

I mean, this was a story
of global significance

and the repercussions
were about to be ignited.

All going well, if we're proceeding
with this project,

I think the crunch point, really,
is going to be in the next 12 hours.

What do you mean, in the sense of
IF we are proceeding, Paul?

Yeah.

Is that in doubt?

Well, it's always... It's never...

It's never confirmed
until it's confirmed, right?

EMAIL NOTIFICATION

So, Paul, just to be 100% clear,
you guys are ready to hit the button

on a version of the story
in...42 minutes?

Of the heads of state story.
Heads of state only.

We're not ready now, but in 42
minutes we will be ready.

LAUGHTER

Here we were,
simultaneously publishing

17 different media outlets,

all over the world in several
different languages,

all at the same time - on the
same minute of the same day -

after months of investigating.

OK, so one other thing, I think
I have made some...

That's OK. I'll just say...

We've done it.

So the story is now live.

REPORTERS: A joint investigation by
17 news outlets, including...

Activists, lawyers and journalists

are reportedly among
those who've been targeted...

What can be done to protect our
country from commercial spyware,

the kind of threat that is now
being reported

at the top of the news
across the nation?

Right, how are we doing, guys?
One minute, one minute. Yeah?

The NSO Group is only one company
of many,

and if one company smells this bad,
what's happening with all the other?

They're not security products.

They're not providing any kind
of protection,

any kind of prophylactic.
They don't make vaccines.

The only thing they sell is the
virus. And this is the problem.

You know, these companies are
extremely predatory.

And their prey is us -
collective, the global we.

It doesn't matter who you are,
it doesn't matter what you do.

Your position isn't going
to protect you.

If you're Minister, Prime Minister,
guess what? You're on the list.

If you're a Supreme Court justice,
you're on the list.

If you're an ordinary person, guess
what? You're on the list too.

But we will not be safe
until we change the game.

If you want to protect yourself,
you have to change the game.

And the way we do that is by ending
this trade, because it's a trade

that ultimately is paid
for in lives.

There had been reporters
who've been doing stories

on Pegasus for years.

This sort of tipped the scale,
because it was in so many countries.

It was against so many people in
civil society

who clearly were not
terrorists or criminals.

I was infected on 3rd August 2020
with Pegasus

I believe at 3am in the morning.

The fact that you can be hacked

on British soil

and that they can do that,

it's frightening.
It really is.

My name is David Haigh
from Detained International.

And we founded the campaign to free
the Dubai princess,

Princess Latifa, in 2018.

Hello, my name is Latifa al-Maktum,
and I'm making this video

because it could be the
last video I make.

Yeah.

This video can help me

because all my father cares
about is his reputation.

He will kill people

to protect his own reputation.

He...

He only cares about himself

and his ego.

Here is an autocratic leader,
massively powerful.

And, as it turned out, Pegasus
was used to spy on his personal

family, his relatives.

His ex-wife, at a minimum,
possibly more people.

But Princess Latifa has for
a long time been, by her account,

unhappy about her life in Dubai.

She had been incarcerated,
effectively, by her father's regime.

The day after Princess Latifa
went missing from Dubai,

we saw her number emerge
in the list.

And in the days after that,
as she was travelling toward India

on this yacht, her friends, people
she knew, people within her orbit,

their phone numbers also
appeared on the list.

NSO's technology was, it seems,
one of the tools

that was being used by the state
in a desperate attempt to find

Princess Latifa, kidnap her
and return her back to Dubai.

Now, however they found her,
that's what happened.

Given how much David Haigh
was working on the Latifa case,

it wasn't a surprise when
we discovered that there was

Pegasus activity on his phone.

We had recorded a lot of videos
and a lot of evidence Latifa had

that could be used to tell
the world about her predicament -

the fact that she was being held
hostage, what was happening to her.

It was effectively dynamite
evidence on that phone.

The fact that they know
your location.

Someone could be listening to us
now and seeing what we're doing.

And it's that, sitting in the back
of your head every day.

One day, NSO were attending the
International Security Conference

in London, and then I had
a slightly mad idea -

to think, "Well, actually
I might go and visit them."

So I applied for a pass,

not thinking I'd get
one because it is the

International Security Conference.
So you would have imagined they

would check the name in the press,
but they didn't. So I got a pass.

I was very excited.

So I got a camera on a pen
and then went up to NSO.

Hi, I wonder if you could help.

My name's David Haigh, and that's
the report from Amnesty

saying Pegasus is on my phone.

And I wondered if you could take it
off for me?

Or tell me how to take it off?
First, we cannot.

HE LAUGHS

The meeting was strange
because people were laughing.

They weren't taking it seriously.

I mean, I think it was because
I went there very politely

rather than shouting with banners.

I would be very happy to
help check that...

Yeah. ..for you and be in touch.

Can you give me your details,

and someone from that...?
Yeah, yeah.

I will make sure they contact you
in the next few days.

Yeah, if you could, please.

With credit to them, they
did contact me.

But then I think what I did see is
they've effectively ghosted me now.

And still, now,
nothing has been done.

No-one's been brought to justice.

And everybody just looks
the other way.

This is a whole industry gone rogue

in a deadly alliance with the worst
dictators of this world,

making human rights
work impossible.

And, Mr Commissioner, you had many
nice words and strategies.

First of all, it's about
enforcement.

Second of all, this whole thing has
a foreign policy and human rights

dimension you haven't even
spoken about.

We need a global ban on the export
of these kinds of spyware.

And we need to ask the tough
questions to other governments,

including those in Israel
and Saudi Arabia.

Thank you.

REPORTER: A US appeals court is
allowing WhatsApp messaging service

to move forward with a lawsuit
against NSO Group

over allegedly targeting some
of its servers in California

to infect about 1,400 mobile devices
with malware,

a violation of state
and federal law.

All we've seen NSO Group is,
deny, deny, deny,

and that's shown up entirely
through the legal process as well.

There's an argument, and, at times,
a lot of companies,

they fix a security vulnerability
and they move on

because they don't want to
draw attention

to what could be a negative story
about their product.

But over the last three years,
more companies invest more resources

in finding and fixing
vulnerabilities,

take action against NSO Group,
such as through lawsuits,

where we had a number of
technology companies,

in addition to civil society,
join our lawsuit with amicus briefs

in support of our position,
which is very helpful.

The way I think about it

is tech companies can and should do
everything they can

to make their software
as secure as possible,

but at the end of the day,
if there's no consequences

for people who try
to break that software

to commit human rights abuses,

then there will always be people
trying to do it.

In Europe, the NSO scandal
bounced back in December 2021

because we were discovering
new victims of the spyware

and because new countries
were accused of using Pegasus

to spy on their opponents.

REPORTER: Pegasus spyware is once
again back in the spotlight,

this time for targeting
pro-independence supporters

in Spain's Catalonia.

In Spain, more than 60 victims
of Pegasus were identified,

including the Prime Minister,
Pedro Sanchez,

and Catalan European MPs,

and, in Poland, Pegasus was
suspected of being used

by the ruling party

to spy on its political opponents
during the 2019 election campaign.

REPORTER: Several members
of Poland's opposition

have produced evidence they were
hacked by Pegasus Software.

REPORTER: This scandal is being
dubbed the Polish Watergate.

Thank you, Mr Chairman.

On behalf of NSO,
I want to thank the members

of the committee of inquiry
for having us here today.

Before we begin, we should note
that there are limits

to the information we can share
with the committee and others.

As you know,
NSO is a private company

providing expert controlled
cyber intelligence technologies

only in exclusive
to government agencies

for the purpose of preventing
and investigating terrorism

and other serious crimes.

As a result, we are unable to share
details about our customers

as well as the crimes prevented
and criminals tracked

and apprehended using
our technologies

or trade secrets of the technology.

I would like now to dispel a number
of misconceptions

that have surfaced
in press and public debate

with respect to our company's
activities and technologies.

It is not true that NSO Group
operates Pegasus

and collects information
about individuals.

It is not true that NSO Group sells
its technology to private companies.

The issues that came up
about Jamal Khashoggi,

about President Macron -

the system was not used
on those numbers.

I will go immediately into the Q&A
session of today's meeting.

We already have about 15 members
who've asked for the floor.

Have United Arab Emirates
and Saudi Arabia

ever gone through your due diligence
check, and have they passed it?

As I said, I'm not going to respond
to questions

regarding specific
potential customers.

Given that UAE and Saudi Arabia
have been using Pegasus software,

who are legitimate actors to issue
warrants in these countries

according to your checks?

Again, I repeat it again,

I'm not going to respond
to questions

regarding specific customers.

I cannot - and, again, I repeat,

I cannot, because of various
confidentiality and secrecy issues,

I cannot get into specific questions

regarding specific customers
or specific cases.

First of all, every customer
that we sell to

goes through the due diligence
review in advance,

and if...and very often
if concerns are raised

regarding the rule of law,

because what we're looking at
is also a rule of law,

and any country that we've
decided to sell to

has been approved in this manner.

Please, stop -
stop the storytelling.

I'm going to continue in Hungarian.

Good question.

Again, I said...

Not again, it was a new question.

So, please.

I have not said... We have not said
that we have determined recently

that Hungary is or is not
a secure country.

You did consider it secure,

because you sold the stuff to them.

Excuse me... I said now...

Let's keep a little bit of order
in the meeting as well.

I understand there is frustration,
but it doesn't help us

if we all start posing
questions in a chaotic fashion.

So, you have the concrete question.

We have a concrete answer.

And, please. Can you, as the chair,

can you ask Mr Gelfand to either say

that he is refusing
to answer the questions,

or answer the questions? Because you
keep repeating the same thing,

and there seems to be a complete
disconnect between reality

and between what you're saying.

This is like... You know, it's an
insult to our intelligence. Sorry.

In some ways, we can talk
about the impact on the company

and say it's been really profound.

A more pessimistic view would be to
look at the entire industry,

which remains unreformed,
pretty wild, unregulated.

NSO may vanish,

but I feel no more secure
talking in front of my phone now

than I did when we first published.

I don't think these issues
have gone away.