The New Yorker Radio Hour - Ronan Farrow on the Threat of Modern Spyware

Episode Date: April 22, 2022

Ronan Farrow has published an investigation into a software called Pegasus and its maker, NSO Group. Pegasus is one of the most invasive spywares known; it allows users—including law-enforcement officials or government authorities—to hack into a target’s smartphone, gaining access to photos, messages, and the feeds from a camera or microphone. NSO markets Pegasus as a tool to catch terrorists and other violent criminals, but once a surveillance tool is on the market it can be very difficult to control. Farrow finds that Pegasus is being used to suppress political opposition in democratic nations, including Spain. The largest known cluster of Pegasus attacks has targeted people in Catalonia who support the independence movement, which the Spanish government views as a threat. “This is not just an information-gathering tool,” Farrow tells David Remnick; “It’s an intimidation tactic, and it works.” New Yorker Radio Hour listeners, we want to hear from you.  We have a few questions about the show and how you listen to it. The survey takes about twenty minutes, and your feedback will help us make our podcast better.  Take the survey here.

This is The New Yorker Radio Hour, a co-production of WNYC Studios and The New Yorker. Welcome to The New Yorker Radio Hour. I'm David Remnick. The software known as Pegasus is probably the most notorious spyware in the world. It allows users, law enforcement officials, or government authorities to hack into a target's smartphone. And that gains them access to photos, videos, and messages. Pegasus can also remotely control a phone's microphone and camera, all without your knowing it. The software is aimed at catching the worst of the worst,

terrorists and other violent criminals. But once a surveillance tool is on the market, it can be very difficult to control. Ronan Farrow has a new piece out on the New Yorker about Pegasus and the company that makes it, an Israeli firm called NSO Group. So one of the things that I think is distinctive about this story, against a backdrop of a lot of good reporting from a lot of good outlets,

about this kind of spyware, is I really got to spend time inside NSO group and their offices in Tel Aviv, talking to their software engineers who take evident pride in cracking encryption methods and opening up people's phones And, you know, in the conversations that I had with both the working level people at NSO and their executives, what comes out is, I think at times a sincere belief that this is a tool with a lot of power to assist law enforcement. You know, critics, particularly in the human rights world, I think would say that that's a dog and pony show. But I do emerge from the reporting seeing evidence that there are law enforcement agencies around the world. who perhaps otherwise would not have elaborate surveillance capabilities in-house.

I'm talking about, for instance, smaller European countries, and who now have a tremendously powerful surveillance tool in their hands. Now, do they have any banner headline crimes that this software has stopped? If they're advertising themselves, what do they announce to the world as their great successes? So this is part of the problem, and one of the challenges of reporting on this kind of spy. they say that confidentiality with their customers and the inherently confidential nature of law enforcement investigations prevents them from talking about specifics. Now, you know, people around this world have talked about various sort of European counterterrorism investigations where it's claimed that Pegasus

or other commercial spyware tools were helpful. Very hard to verify because it isn't people willing to put that on the record. So this decision. sends into the realm of sort of whispers and rumors very quickly. Just to be clear, what about encrypted apps like Signal or WhatsApp? Are those things immune from this kind of spyware? Because it seems like not. Not at all. Pegasus specifically focuses on commandeering wide control of your phone. It allows the phone to disgorge all of your texts, all of your photos, all of your calendar entries. It also affords the operator of the software

the ability to turn on your microphone and turn on your camera and get real-time surveillance. So the protections of N-10 encryption on a platform like WhatsApp or like Signal are meaningless if someone targets you with this kind of spyware. So, Ronan, I've got my cell phone right here in front of me. It's a beautiful little device,

and I've been to Russia, I've been to China, and many other places. Can I assume, as a journalist, that I've got spyware on my phone, now? Well, one of the things I did in the course of this reporting was to actually have my devices tested. I went in, for some legs of this reporting in some parts of the world, with only a burner phone, not my usual phone, because the risk of surveillance is so high, particularly when you're writing about surveillance issues in some of these places. And then I had all those

devices tested. So you can see for yourself, if you would like, David. And those are proprietary testing tools developed by places like Amnesty. the International and Citizen Lab. This is the New Yorker Radio Hour. More to come. So countries have deployed the software, not just against terrorists and criminals, as you've made plain, but also against journalists and human rights leaders.

This was a very big story last summer. Pegasus was allegedly used to monitor phones belonging to people around the well-known Saudi journalist, Jamal Khashoggi, before his murder by Saudi-dispatched thugs. in 2018. And in your reporting, you've narrowed in on a series of Pegasus attacks on people involved in the Catalan independence movement in Spain. So why was that used against those people?

It's worth noting that on the Khashoggi murder, NSO group is adamant that they had nothing to do with it. Their technology had nothing to do with it. There's been a lot of back and forth, whether it was in fact found on the phone of his wife. But it does seem like the preponderance of evidence suggests that this software was found on the devices of a number of Khashoggi's associates. And that is consistent with a pattern that we've seen around the world

of this being found either on the devices of a person who comes in harm's way, who's run afoul of a regime using this software, or people around them. And that's exactly what we see on a massive scale in Catalonia. This is the largest forensically documented cluster of attacks and infections through Pegasus that has ever been revealed. That we know of. That we know of.

So this presumably has to do with the independence movement, which the Spanish government views as a very serious threat. There was an independence referendum in Catalonia in 2017 that Madrid considered illegal, people were sent to jail and eventually it all descended into violence. Who was targeted with Pegasus? It appears that just about, I'm speaking figuratively, but just about

everyone and their mother. Of the main figures. What was hacked, right, of the kind of central political movement. And in fact, part of the arc of the story is there's a Catalonian investigator who is

analyzing phones and realizing how vast this campaign is. And by the end of the story, he's realized it's not just these politicians. He's vetting his own parents have been hacked again and again. There's a feeling of a lack of safety. I mean, there is...

Which is sometimes as much the point as the actual information that's being accrued. Yes, that's a really important and good point. This is not just an information gathering tool for repressive regimes, or as we're learning increasingly in this piece, Western democracies using the technology. It's an intimidation tactic, and it works.

One of the people you talk to is Jordi Kuschart. Who is Jordi Khrushart? And why was he such a important source for you? Jordi is a local businessman in Catalonia. His company makes packaging machinery, and it's distributed all over the world. And more importantly, he was the president of an organization called Omnion Cultural.

Omnum Cultural is one of the most important civil organization in Europe. We have around 200,000 members. And that group is about the cultural independence of Catalonia, and it backs the independence movement. And what we are doing is to defend the civil rights and also the human rights, so that means the right of Catalonia and the Catalan countries to decide. on future. What's interesting about Catalonia is this isn't surveillance without stakes. A number of activists in this community, including Jordi, have gone to jail. Was there a specific trigger that

prompted your arrest? Obviously, it was your leadership in the community and so forth, but what was the actual catalyst? Yeah, what the court said is that we, personally me, as a president of of Omnum Cultural, I had a lot of capacity and power to mobilize the society. And it was the reason why they decided to put me in jail. Kouchard's lawyer and also his wife were targeted as well. When I learned that my telephone was infected, I was visiting Jordi in the prison, living alone with one baby, but I was pregnant from the other baby. His wife's name is Chelbonnet.

It's like you never know what it's going. going to happen with you and the information that they have about you if it's going to be twist for create invented news or invented facts. It's very difficult for us to defend ourselves if the prosecutor knows exactly which is our strategy of defense. And do you think that was the objective to spy on your legal strategy and not only this also to know exactly what, what we were preparing in order to protest against the decision to sentence us from this higher years of prison. It's been fascinating to spend time with people and communities who are in receipt of this level of widespread surveillance. One of the things that it creates, I think, is just an atmosphere of paranoia and mistrust.

For example, yesterday we went to dinner together, okay? Yesterday night. But what we said is to keep the mobile phones in the jackets and talk between us without the mobile phones. Why? Far from us. The mobile phones far from us. Because you feel that all the times there is a micro here who is listening.

And if we want to discuss about personal issues or whatever, I want to feel sure that nobody is listening to me, no? It's something that I think. think has a profound destructive effect on families, on people's personal lives, on all of these individuals I talk to who now have to wonder whether any personal photo is going to be weaponized against them, any text message, you know, if they've been discussing politically sensitive things, is that going to be the basis for an arrest warrant if you're in a place like Catalonia? I think that this is one thing that, from my point of view, all the people who is infected or

who was infected or who will be infected, it's important to not to keep calm, calm down. If not, then appears the paranoia and then you imagine that you have micros at home, somebody's following you, and be careful, step by step, because if not then, the emotional shock arrives, and then it's difficult to manage. So, Ronan, were you able to confirm these hacks with NSO or the Spanish government? So we have a former NSO employee saying that the company doesn't, indeed have an account in Spain. Citizen Lab, the watchdog group, has undertaken analysis that suggests that there is a Pegasus

account being operated in Spain. And, you know, the Spanish government for their part won't answer questions about this. Certainly they didn't respond to our request for comment about it. Catalan politicians are convinced that Spanish law enforcement or intelligence entities are behind this campaign and are in this story demanding transparency. So what does NSO say about all this? So I spent a lot of time with NSO group's CEO, Shalev Julio, and he makes a number of arguments in defense of the company and the technology.

He's also very cagey and careful when it comes to identifying customers. You know, he always gives the caveat of I am declining to identify any of the countries that we work with. But that said, he did very clearly talk about some of the countries that we now know use his technology, including Spain. And in that case, he said, you know, Spain is a democracy. If they decide to use these tools. That's on them. That's on them.

I assume you talk with their general counsel. We talk to their general counsel at length, Schmoul Sunray. First of all, anyone who feels he's a target, I would really appeal for them to go and go through our process. He says that if people suspect there's been abuse of the software, they should report it to NSO. Because we are going to take this every complaint seriously, investigate it to its fullest, and to take the appropriate measures that are derivative from. So the obvious response there that I imagine a lot of dissidents who feel they've been subject to illegal, repressive activity from a regime they're under, and they feel that your company is involved in a relationship with that regime is going to be, those are the last people we would call. How can we trust that we'll be safe in that process? How can we trust that a company that is, of course, self-interested in business terms, is going to have a thorough process of due diligence?

what's your response to that? I think that our record has proved itself that we take these issues seriously. We will continue to take them seriously. Well, all I can say that if it was our technology that was used, we feel very bad about it and we'll make our utmost to make sure that no other targets will be in that situation.

Their central argument is that there is a Geneva Convention for conventional forms of warfare. There are all sorts of treaties on conventional weaponry, and they are a weapons manufacturer, but in a space that doesn't yet have adequate regulation. They freely admit this, and they say, well, we're the lesser of evils. We're at least the guys, you know, letting an investigative reporter into the offices, answering questions, you know, trying to put on a show of legitimacy. So you think they were trying to use you as a way to show what swell guys they are? I think everyone is always trying to use us, David. Yes, look, I'm under no illusions, but I did think that it afforded us a new and closer look at this company

and an opportunity to inspect their arguments, which are now playing out in court. They're being sued by a number of the biggest tech companies in the world, Facebook. So that's the pot calling the kettle. lack a little bit, no? I mean, certainly Shalev Julio, the CEO of NSO group, cries hypocrisy on Facebook's case.

But the Facebook dynamic is interesting because, you know, yes, Facebook has played this very destructive role in our society, but they also are the guardians of the security of a huge population of people who use their messaging platforms

around the world. WhatsApp is, you know, a Facebook property. and that is the most popular messaging platform in the world. And all kinds of sensitive communication by dissidents, by journalists, happens on that platform. So what has to happen in order for this to be reformed? Well, right now, it's now a fight that is in the hands of coders, that is in the hands of the courts. And it's not enough, I think, in the domain of international and domestic law. and I think we're at the beginning of a period where that is starting to change.

One of the things that we break for the first time in this story is that the White House is actively pursuing a U.S. government-wide ban on purchasing this kind of commercial spyware. And I think there's an increasing understanding that this is both technology that has an incredibly destructive footprint in the world in terms of the effect on these journalists and activists and dissidents. and also that it's technology we can't fully control. It's like monsters. The mobile phone is like monsters. And unfortunately, we don't know exactly today who is using these softwares. Of course, the mobile phones help the humanity

to move forward and to improve and to be a better society, for sure. But many times probably it's the most important criminal arm that we have in the pocket. So it's important to manage these two, of the same device. Right. Whatever the progress gained through them, what's the cost?

They are monsters in our pockets. Yeah, yeah. Yeah. Definitely. Definitely. This is not technology that's going away, and we've just got a hope that some of these regulatory efforts can rein in the most destructive effects of it.

Ronan Farrow, thank you so much. Thank you. You can read Rodin Farrow's story How Democracies Spy on Their Citizens at New Yorker.com. I'm David Remnick, and that's our program. I want to thank you for joining us. See you soon. The New Yorker Radio Hour is a co-production of WNYC Studios and The New Yorker.

Our theme music was composed and performed by Merrill Garbus of Tune Arts, with additional music by Alexis Quadrato. The New Yorker Radio Hour is supported in part by the Cherina Endowment Fund. Thank you.