Original subtitles

This programme contains some strong language and some scenes which some viewers may find upsetting

IN FRENCH:

REPORTER: The biggest spying scandal in cyber history.

This investigation, which was actually done by Forbidden Stories,

which is kind of an investigative group based in Paris,

and shared with a number of different news outlets.

FRENCH REPORTER:

A joint investigation by 17 news outlets...

SPANISH REPORTER:

A massive data leak contained over 50,000 phone numbers.

A leak of 50,000 phone numbers

belonging to some big name politicians.

IN MANDARIN:

Pegasus.

Pegasus.

Pegasus. Pegasus.

Pegasus spyware.

Pegasus is like someone over your shoulder.

It can read everything you're reading,

it can watch everything you're watching.

And once the spyware

is taking the control of your device, basically you're trapped.

REPORTER: This software has the potential to use the microphone

and camera to listen to and even look at

the owners of iPhone and Android devices.

Hello, can you hear me?

I can hear you. I don't see you.

Hello. Hello, Paul. Hello?

Hi, Donna.

Hi, how are you? Hi, Donna.

Good, and you?

At that time, we quickly called the Washington Post,

the Suddeutsche Zeitung, and all the partners to tell them

that we were having access to a list.

We wanted to tell you about some information we have

and about a new project we are starting.

There is a lot that concerns India. Ah.

Some names in Mexico.

Information about Hungary.

Azerbaijan and Kazakhstan.

What we needed at that moment was to put together

the best possible team. We needed tech specialists.

We needed people with good knowledge of the spyware,

and journalists with contacts in the intelligence world.

TANNOY: Elephant and Castle. Change here...

Paul Lewis is the head of the investigative unit of the Guardian.

The Guardian has been working for years on Pegasus.

The moment they mentioned the numbers of phone numbers

that they had, the quantity of phone numbers,

tens of thousands,

I mean, my jaw just hit the floor.

Now, we had small pieces of the jigsaw of wrongdoing by NSO.

Never before had anyone been able to stitch that together

and tell the whole story, so if Forbidden Stories have got data

that can identify not just who the customers of NSO are,

but potentially point in the direction

of who the targets are as well, this is a game-changer.

Israel has become the world leader in this industry

and exports these tools all over the world

and, if you like, NSO Group was in many ways,

you know, the jewel in the crown.

Here was a company founded by three guys in 2010,

a tech start-up become a unicorn that was incredibly successful,

that claimed to have over 40 countries around the world

buying its technology.

We only sell it to government or to entities that we know

or we want to believe that they will not misuse the tools.

And this is how we check the customer,

this is how we diligence them.

We have all the mechanism to make sure

that they are not misusing the systems.

All of us suspected that if NSO Group was giving

authoritarian and repressive regimes

such a powerful instrument of surveillance -

you know, you can get into the phone of anyone in the world

and no-one's looking over your shoulder because NSO Group says,

"You have to sign this piece of paper to agree

"that this is just for criminal investigations

"and terrorist investigations,

"but we're not going to check how you use this technology."

So you have a carte blanche.

We had a kaleidoscope of potential victims.

But how do we prove that Pegasus was on the phones?

It's a piece of code that looks very similar to all the others

that you are running on your phone.

It's just designed to do something that it shouldn't.

An investigation on a spyware like this begins with a first case,

begins with a patient zero, so to speak,

and that opens up everything.

The very first cases, they left their infrastructure

that was connected to NSO.Group.com -

that was the first mistake.

And then from there you start saying,

"OK, I've seen this infrastructure.

"It's connected to the company, quite evidently."

These technologies just evolve continuously,

so it's a cat and mouse game by nature, meaning that,

but the unfortunate reality is that against capabilities like those

that Pegasus customers have, there's not much you can do

from a digital security perspective. You can't really stop them.

One of the very first things that we did after getting access

to the list was to cross-check the list with our own contact list,

and I did that with my personal contact list.

Immediately a phone number popping up.

That was the phone number of a friend of mine,

someone I know well for years.

She's a journalist in Azerbaijan and her name is Khadija Ismayilova.

REPORTER: Her name is Khadija Ismayilova.

She's an award-winning investigative reporter

and an outspoken critic of the government,

renowned for her exposes of corruption at the hands

of the country's president.

Khadija Ismayilova relentlessly kept on exposing the wrongdoing

and the corruption of the Aliyev regime.

The regime of Azerbaijan is basically controlling everything,

censoring everything. Human rights activists, press freedom,

everything is under the control of that ruling party.

And as soon as you start criticising them, you will end up in jail.

She showed how they were having their hands

into a big chunk of the Azerbaijani economy.

She was showing how they were taking money in a covert way,

how they were stealing money, basically, from the people.

IN AZERBAIJANI:

SHOUTING

MAN SHOUTS: Journalist! Journalist!

After all this investigative reporting,

Khadija became a prime target for the government in Baku

and for the Aliyevs.

In Azerbaijan, there is a culture of blackmailing people,

blackmailing political opponents,

blackmailing human rights activists and journalists.

They can take your personal pictures,

your personal video to blackmail you,

and in 2012, Khadija Ismayilova really paid the price for that.

I remember the day when Khadija called me and said,

"Paul, something terrible happened.

"I received this envelope with photos

"that are taken in my bedroom illegally.

"They probably had a hidden camera.

"And they're blackmailing me with these photos."

Right next to the picture, there was a small message saying to Khadija,

"You should stop your investigation,

"otherwise we will publish those videos."

But Khadija refused that deal

and she decided to continue her investigation.

CLAMOURING

REPORTER: She was sentenced to seven-and-a-half years in prison

for embezzlement and tax evasion,

but her supporters say the trial was politically motivated

and accused the president of cracking down on press freedoms.

I don't know how to proceed with Khadija

because I don't want to put Khadija in danger.

But we wanted to...

..to do some forensic of her device.

The thing that is quite difficult is how to get in touch with Khadija

without communicating on electronic device.

According to what we see, we see that Khadija is really

one of the top persons of interest for Azeri intelligence services,

which is not a surprise, of course.

This is very sensitive, right? Yeah.

This is very, very sensitive, especially for her,

because she's basically on probation.

So that's going to be a risk anyway.

One day we learned that Khadija was about to travel to Turkey

for medical reasons. So clearly, first, that was a kind of opening.

So what we did after that is that we decided to send one team

over there first to tell Khadija that we were having reasons

to believe that she was surveilled,

but as well that we found a phone number in the list.

Now I'm nervous.

LAUGHTER

I cannot stand still.

Khadija! Khadija!

How are you doing?

INDISTINCT CONVERSATION

Can we open the window?

We can take this off, right?

That's too long.

So, basically, what we have is list of

the phone numbers that were targeted in Azerbaijan.

That's so cool.

And...yeah, so we have about 1,000 numbers from Azerbaijan.

And you're among them.

Oh! And then we also have

some people who are your friends and your lawyers.

Mm-hm, OK.

And what does that program do?

So what the program does is,

it basically, without you knowing,

it installs things on your phone.

And then it allows...

Even if I didn't click on anything?

Yeah, so the secrecy of this, it's called Pegasus,

and the secrecy of it is that you don't actually see

or you don't do anything.

So before you had this, you had to click on something

to be infected. Yeah.

In this case, it all happens in the background and you have no

idea that you're infected.

And when you're infected, it's transmitting your messages,

your images, everything that's happened on your phone,

including the signal, because they have the phone itself.

And it's legal to sell it? Yes.

So what we know is that most likely

some time in 2018, the government got it.

OK. And we have a lot of data from 2019.

And, you know, that was a big year of protest,

you were on a hunger strike with other people. Yeah.

You guys had a woman march,

you were leading the march. Yeah.

Shoo...

SHE LAUGHS

It's kind of the most like you in the country.

Well, why they are so idle, I mean, that's...

Oh.

Mm.

So one way for us to verify that what exactly was done

in your case would be to do forensic on your phone.

So the question is whether you would allow us to make a backup

of your phone and basically check it for the traces of Pegasus.

Yeah, yeah.

Is there any way to avoid this surveillance?

Yes, we will set you up with a new device

that you will be able to use... On a phone.

Is there a balcony?

There must be some way to do it.

There are other ways to communicate... Yeah.

..securely.

It's like...

..it makes you to want to live in the...

..bubble.

But then...

..like, so no-one can enter, like, in some sort of...

This is her phone.

You don't need any cables?

No. OK.

Do you know if she still has a backup?

Yes, she does. Yes, she does. OK.

Well, right now, I'm trying to jailbreak the phone.

PHONE BEEPS

Hopefully it works.

So right now, I am...

..navigating through the phone.

I'm looking for things that might have executed network activity

that is connectable to the company,

any leftovers of malicious executions,

accounts that we know of.

Anything essentially that tells me the history of this phone.

That's interesting. That's not something I've seen before.

We see processes that we know are connected to Pegasus.

We'll see some message accounts that are connected to the attacks,

because this might indicate what was the entry point.

Oh, it was Apple Music? What the fuck?

Oh, really?

That's weird.

So they might have started using Apple Music to exploit it.

Erm...

..I have to do some more digging on this, as I need to look at

what specifically these applications are.

It's definitely among the ones most targeted.

No, Khadija's coming!

Hi, Claudio.

Hi.

So now tell me how bad it is.

OK.

There are definitely some records

that indicate various points

where the phone seemed to have been compromised.

Mm-hm.

So I started feeling like I played doctor in the 1300s,

you know, like, I'm basically kind of just keeping the death count...

March of 2019...

..I'm contributing to creating a trauma here

and I can see it in many cases.

Like, I can see it that they are... Right now,

they're going to a dramatic moment.

And I'm like that person in the room that is breaking it.

There are also some more recent records from even as recent as early

May of this year, so until a couple of weeks ago.

But all in all, it seems like this probably extended

between 2019 and 2020.

2020, at the very least.

I've been told that you will not know

what exactly had been monitored or recorded.

With these kinds of monitoring technology,

the point where they have that level of access to the device,

virtually everything is possible, so...

Yeah, thank you. Have a good day, bye-bye.

Bye. Bye.

That's not great news. No.

All night I've been thinking about, what did I do with my phone?

And I feel guilty.

I feel guilty, too, for the messages I've sent.

I feel guilty for the information sources who send me...

..thinking that some encrypted messaging ways are secure.

They did it and they didn't know that my phone was infected.

I mean, my family members are also victimised.

The sources are victimised.

Everyone. I mean, people I've been working with.

People who told me they had private secrets.

I victimised everyone.

I mean, it's not just me, I...

..I put so many people in danger.

And...

..and I'm angry.

Again, I'm angry, I'm angry with the government,

I'm angry with the companies that produce all these tools

and sell it to the bad guys...

..like Aliyev regime.

It's...

It's really... It's despicable,

it's heinous, I don't know...

Israel has the advantage of not only developing new technologies

and weaponry, but testing it live.

And this is something Israel knows it can use to sell outside.

When you want to control a huge population,

like we do with Palestinians,

you have to have assets everywhere,

so everyone can be a target,

because we don't want only the - I don't know -

terrorists from the Hamas, but also maybe his neighbour or his cousin

or the person who sells milk in the corner of the street.

If you want to recruit human agents,

you need to collect their weaknesses,

things that you can use to blackmail.

And so part of what 8200 does is to collect this blackmail

potential information about everybody.

If you're gay or if you have medical...special medical condition

or you have financial problems

or someone from your family has one of those,

then that's something we can use against you to blackmail you

and get you to cooperate.

It's this kind of approach that you see again in other countries

used by the clients of NSO.

One of the very first things that we have been able to see

reading the list was the very high number of phone numbers

coming from Mexico.

But actually that was not so surprising,

because we knew for years

that Mexico was one of

the very first customers

of the NSO Group.

And we know as well since 2017

that 19 people from the civil society in Mexico

were targeted by Pegasus, including one very famous journalist

called Carmen Aristegui, a journalist who does work for CNN,

who is extremely popular in the country.

PHONE RINGS

Carmen Aristegui was already a known victim of the spyware.

So we asked her to join us to investigate

the Mexican part of the Pegasus Project,

and what we first asked her was to help us to identify

the thousands of Mexican numbers appearing on the list.

Right...

There's a lot of evidence to suggest that NSO Group

had the direct backing and support of Bibi Netanyahu's government.

In order to sell its product to governments around the world,

it required permits,

effectively licences from the Israeli Defence Ministry.

I decided several years ago to turn Israel

into one of the five cyber powers of the world.

In order for the companies to develop,

they need to make...

What do they need to make?

Money!

They need to make money.

Now, the easiest way to make sure that they don't make money is,

one, high taxes, right?

What's the other one?

Regulations.

Have you ever heard of regulations?

We have a problem with regulations.

So the policy we have is keep taxes low

and keep regulations low.

Minimise regulations.

There is no industry more susceptible

and more inviting of regulations than cybersecurity.

It's like weapons.

It is a weapon!

Around us is a sea of dictators and autocrats

and kings and sultans.

This is the neighbourhood we have. We didn't choose it.

But at the end of the day, Iran is the biggest threat

on Arabs and Israelis.

Netanyahu wanted to forge a camp,

a united front against Iran,

and he would use many, many tools in order to do that.

One of the tools is giving Israeli technology.

NSO has a very attractive tool.

AMITAI SIGHS

# Do-do, do-do-do-do-do-do. #

Jamal Khashoggi's murder, really,

in the history of the Post,

stands out.

Jamal Khashoggi was an opinion writer for the Washington Post.

Very gentle, soft-spoken man,

willing to share his opinions.

His voice became very important

because he was the single most important dissident

writing about the Saudi regime.

Jamal, let me start with you.

You've compared your Crown Prince to Putin,

to Iran's supreme leader.

You've said he's creating, quote,

"an interesting form of dictatorship".

How so?

I still see him as a reformer,

but he is gathering all power within his hand.

As we speak today, there are Saudi intellectuals

and journalists jailed.

His murder was so cold-blooded.

Jamal Khashoggi went to the consulate in Istanbul

and then he disappeared.

His close friends and family are still trying to figure out

what the situation is.

They're waiting on an official statement.

I spoke to his fiancee, who was also here

and told us that they came here to issue a number of documents

so they could marry.

Turkish officials believe he was killed by agents

of his own government inside the consulate.

They dispatched an assassination team

that landed in a plane in the airport

and came in cars with tools to hack him up,

hack his bones,

and carry him out in a suitcase, or suitcases.

Uh!

The word is that you sold Pegasus to them,

and then they turned it around to get Khashoggi.

Khashoggi murder is horrible - really horrible.

And therefore, when I first heard their accusations

that our technology been used on Jamal Khashoggi,

or on his relatives, I started an immediate check about it.

And I can tell you very clear.

We had nothing to do with this horrible murder.

When Forbidden Stories first contacted me,

the minute we found out about this list,

the first thing we all did was to check for any numbers

related to Jamal Khashoggi.

And right away, we found two numbers associated with the two women

closest to him in his life.

His fiancee Hatice,

who we'd all gotten to know on television,

because she was outside the consulate

when he didn't reappear.

I'm hoping that they will let us do forensics on her phone

to see for certain whether she was targeted.

And maybe, if we get lucky,

whether we can see what they took out of her phone.

They killed my future.

They killed my life.

I lost everything - just the one day.

I felt inside me something changed and broke, you know?

I remember the first days after the murder.

A lot of times, they try to hack my email.

Hmm.

Do you feel like your phone is doing anything strange?

Do you think it could be hacked?

We can test it.

So we could do that if you wanted to do it.

We... OK, you can do that.

OK, that'd be great.

Well, we just need to plug your phone into our computer.

OK. So maybe we do that.

Great.

Hello?

Claudio?

Hi.

It's Dana.

Hi, how are you?

I don't know. You tell me.

So I checked both the uploads.

Er...

The new one seems clean to me.

The old one, however, has some traces

on 6th October 2018.

Seems to have been a first compromise,

which was followed by some additional traces

on the 9th and then on the 12th.

There's also an additional record in June of 2019,

but that seems to be probably a failed attempt.

And I don't see anything following that.

OK.

And then we find out the date,

which is four days after his murder...

..when she's still outside the embassy,

trying to figure out what's happening.

And it just seemed like such a ballsy move

on the Saudis' part,

to surveil the person who has become the public face

of his disappearance.

We learnt that Jamal had a complicated personal life.

The other phone number that we discovered

was a woman named Hanan El-Atr.

Hanan Atr is probably the least-known character

in Jamal Khashoggi's life.

She's actually his wife,

and most people have not heard of her.

He actually had secretly married in the United States

in an Islamic ceremony.

It took me a long time to find Hanan.

And what I discovered is Hanan is living in hiding

in the United States while she waits for her political asylum case.

She was a flight attendant for Emirates Airlines.

And so she flew all over the world

and she was communicating with him on foreign phones.

He was so happy, and they were so happy as well.

This is on his birthday in a restaurant in Washington,

and his friend Maggie behind us -

she made the birthday party.

There's all of his friends around us.

This last birthday in his life.

He was careful, but he didn't realise maybe, my device,

it is much dangerous.

And I didn't know as well.

He suspect but he's not sure - and I am not sure as well.

She allowed me to download her phone...

..to send a copy to Bill Marczak at Citizen Lab,

who also conducts forensic analysis of phones.

So we've set up a meeting with Hanan and her lawyer, Randa Fahmy,

and Bill's going to Zoom in from California, where he's working.

What I did is I analysed,

erm, all the available data on two Android phones

and one laptop belonging to Hanan.

On one of the phones,

it appears that there were two separate links

to the Pegasus spyware that were actually opened.

There are a number...

In fact, there are seven text messages

from a period of November 8th to November 26th 2017.

We have the smoking gun from Hanan's phone.

There was no other member of Jamal's family

that was spied on prior to the murder.

He was telling me what he's doing and what his connection,

what is his movement, what is his state of mind.

So you were communicating with him. A lot.

They tracked my husband through me a long time back

before they killed him.

Because he was telling me, only me, everything.

I didn't know this much - they track him through me all the time.

Mm-hm. Yeah.

Why is this all coming in my life?

They did track Jamal and kill him through me.

Long time back.

This is a very crucial information, because we know for years

that NSO Group has always say that if we learn one day

about any kind of misuse from our spyware,

used against dissidents, used against journalists,

used against the human rights activists,

we will then, of course, investigate the case.

But in that case we're talking about, that's extremely serious.

We're talking about someone who has been dismembered

within the consulate, who has been killed within the consulate

and we know that the relatives of that person

have been targeted by Pegasus.

It's important to rectify this story,

which is that these technologies are necessary

and exclusively used for good purposes

and for fighting evil and for fighting crime

and terrorism and all that.

This is a bunch of lies for the most part,

on the part of this industry who has a vested interest

in exploiting as much as possible out of this to make money.

When we started analysing the list,

we immediately saw a lot of French numbers,

more than 1,000 potentially targeted by Morocco.

There were journalists, lawyers, activists, but not only.

We also saw 15 members of the French government

and the President Macron himself.

At that moment, we immediately realised

that this was going to be a bomb.

Mm-hm.

The last phase was very, very intense.

This is precisely the moment where you knock on the door

of the NSO Group and you told them

we were investigating you for months.

We know about your businesses

and we have plenty of questions to ask you.

And so we were thinking that we should get some answers

in the next hours following the email, but nothing was happening.

PHONE RINGS OUT

Hello. This is Laurent Richard from Forbidden Stories.

How are you doing?

Yeah, I'm good.

Yeah. Thank you for taking the time to answer.

I was just wondering if you are planning to answer our question.

Well, you can see it in your email now.

EMAIL NOTIFICATION

OK. I see it.

Thank you. OK. Bye. Thank you. Bye. Bye.

So, at the end, what we got was a very, very short email,

very brief, where NSO Group were telling us that

all your questions, all your information, everything is wrong.

But what we can tell you that we are here just to save life,

just to fight terrorism, and that's it.

"Furthermore, as NSO has previously stated,

"our technology was not associated in any way

"with the heinous murder of Jamal Khashoggi.

"This includes listening, monitoring,

"tracking or collecting information..."

At that time, here, there was a kind of calm,

but the calm, you know, that is preceding the storm.

But we discovered the day after that, NSO sent letters,

letters from lawyers to most of the partners

at the same time on all continents,

to threaten them and to tell them that if you publish anything,

we will sue you.

Here was a company valued at over a billion dollars.

The NSO Group and its clients,

these governments, were not going to put their hands up

and confess to this activity.

They were fighting it as hard as they possibly could.

It's a bit tense here, if I'm honest. Yeah. Yeah.

Erm...

We've had a provisional response from NSO to the Washington Post,

and we will have the formal...

..another response from them to us in about...

..15, 20 minutes, so we're going to keep this call really quick.

Erm...

VOICEOVER: The stakes are really high

when you do this kind of reporting.

..discussions around the public interest and exactly what it is...

I mean, this was a story of global significance

and the repercussions were about to be ignited.

All going well, if we're proceeding with this project,

I think the crunch point, really, is going to be in the next 12 hours.

What do you mean, in the sense of IF we are proceeding, Paul?

Yeah.

Is that in doubt?

Well, it's always... It's never...

It's never confirmed until it's confirmed, right?

EMAIL NOTIFICATION

So, Paul, just to be 100% clear, you guys are ready to hit the button

on a version of the story in...42 minutes?

Of the heads of state story. Heads of state only.

We're not ready now, but in 42 minutes we will be ready.

LAUGHTER

Here we were, simultaneously publishing

17 different media outlets,

all over the world in several different languages,

all at the same time - on the same minute of the same day -

after months of investigating.

OK, so one other thing, I think I have made some...

That's OK. I'll just say...

We've done it.

So the story is now live.

REPORTERS: A joint investigation by 17 news outlets, including...

Activists, lawyers and journalists

are reportedly among those who've been targeted...

What can be done to protect our country from commercial spyware,

the kind of threat that is now being reported

at the top of the news across the nation?

Right, how are we doing, guys? One minute, one minute. Yeah?

The NSO Group is only one company of many,

and if one company smells this bad, what's happening with all the other?

They're not security products.

They're not providing any kind of protection,

any kind of prophylactic. They don't make vaccines.

The only thing they sell is the virus. And this is the problem.

You know, these companies are extremely predatory.

And their prey is us - collective, the global we.

It doesn't matter who you are, it doesn't matter what you do.

Your position isn't going to protect you.

If you're Minister, Prime Minister, guess what? You're on the list.

If you're a Supreme Court justice, you're on the list.

If you're an ordinary person, guess what? You're on the list too.

But we will not be safe until we change the game.

If you want to protect yourself, you have to change the game.

And the way we do that is by ending this trade, because it's a trade

that ultimately is paid for in lives.

There had been reporters who've been doing stories

on Pegasus for years.

This sort of tipped the scale, because it was in so many countries.

It was against so many people in civil society

who clearly were not terrorists or criminals.

I was infected on 3rd August 2020 with Pegasus

I believe at 3am in the morning.

The fact that you can be hacked

on British soil

and that they can do that,

it's frightening. It really is.

My name is David Haigh from Detained International.

And we founded the campaign to free the Dubai princess,

Princess Latifa, in 2018.

Hello, my name is Latifa al-Maktum, and I'm making this video

because it could be the last video I make.

Yeah.

This video can help me

because all my father cares about is his reputation.

He will kill people

to protect his own reputation.

He...

He only cares about himself

and his ego.

Here is an autocratic leader, massively powerful.

And, as it turned out, Pegasus was used to spy on his personal

family, his relatives.

His ex-wife, at a minimum, possibly more people.

But Princess Latifa has for a long time been, by her account,

unhappy about her life in Dubai.

She had been incarcerated, effectively, by her father's regime.

The day after Princess Latifa went missing from Dubai,

we saw her number emerge in the list.

And in the days after that, as she was travelling toward India

on this yacht, her friends, people she knew, people within her orbit,

their phone numbers also appeared on the list.

NSO's technology was, it seems, one of the tools

that was being used by the state in a desperate attempt to find

Princess Latifa, kidnap her and return her back to Dubai.

Now, however they found her, that's what happened.

Given how much David Haigh was working on the Latifa case,

it wasn't a surprise when we discovered that there was

Pegasus activity on his phone.

We had recorded a lot of videos and a lot of evidence Latifa had

that could be used to tell the world about her predicament -

the fact that she was being held hostage, what was happening to her.

It was effectively dynamite evidence on that phone.

The fact that they know your location.

Someone could be listening to us now and seeing what we're doing.

And it's that, sitting in the back of your head every day.

One day, NSO were attending the International Security Conference

in London, and then I had a slightly mad idea -

to think, "Well, actually I might go and visit them."

So I applied for a pass,

not thinking I'd get one because it is the

International Security Conference. So you would have imagined they

would check the name in the press, but they didn't. So I got a pass.

I was very excited.

So I got a camera on a pen and then went up to NSO.

Hi, I wonder if you could help.

My name's David Haigh, and that's the report from Amnesty

saying Pegasus is on my phone.

And I wondered if you could take it off for me?

Or tell me how to take it off? First, we cannot.

HE LAUGHS

The meeting was strange because people were laughing.

They weren't taking it seriously.

I mean, I think it was because I went there very politely

rather than shouting with banners.

I would be very happy to help check that...

Yeah. ..for you and be in touch.

Can you give me your details,

and someone from that...? Yeah, yeah.

I will make sure they contact you in the next few days.

Yeah, if you could, please.

With credit to them, they did contact me.

But then I think what I did see is they've effectively ghosted me now.

And still, now, nothing has been done.

No-one's been brought to justice.

And everybody just looks the other way.

This is a whole industry gone rogue

in a deadly alliance with the worst dictators of this world,

making human rights work impossible.

And, Mr Commissioner, you had many nice words and strategies.

First of all, it's about enforcement.

Second of all, this whole thing has a foreign policy and human rights

dimension you haven't even spoken about.

We need a global ban on the export of these kinds of spyware.

And we need to ask the tough questions to other governments,

including those in Israel and Saudi Arabia.

Thank you.

REPORTER: A US appeals court is allowing WhatsApp messaging service

to move forward with a lawsuit against NSO Group

over allegedly targeting some of its servers in California

to infect about 1,400 mobile devices with malware,

a violation of state and federal law.

All we've seen NSO Group is, deny, deny, deny,

and that's shown up entirely through the legal process as well.

There's an argument, and, at times, a lot of companies,

they fix a security vulnerability and they move on

because they don't want to draw attention

to what could be a negative story about their product.

But over the last three years, more companies invest more resources

in finding and fixing vulnerabilities,

take action against NSO Group, such as through lawsuits,

where we had a number of technology companies,

in addition to civil society, join our lawsuit with amicus briefs

in support of our position, which is very helpful.

The way I think about it

is tech companies can and should do everything they can

to make their software as secure as possible,

but at the end of the day, if there's no consequences

for people who try to break that software

to commit human rights abuses,

then there will always be people trying to do it.

In Europe, the NSO scandal bounced back in December 2021

because we were discovering new victims of the spyware

and because new countries were accused of using Pegasus

to spy on their opponents.

REPORTER: Pegasus spyware is once again back in the spotlight,

this time for targeting pro-independence supporters

in Spain's Catalonia.

In Spain, more than 60 victims of Pegasus were identified,

including the Prime Minister, Pedro Sanchez,

and Catalan European MPs,

and, in Poland, Pegasus was suspected of being used

by the ruling party

to spy on its political opponents during the 2019 election campaign.

REPORTER: Several members of Poland's opposition

have produced evidence they were hacked by Pegasus Software.

REPORTER: This scandal is being dubbed the Polish Watergate.

Thank you, Mr Chairman.

On behalf of NSO, I want to thank the members

of the committee of inquiry for having us here today.

Before we begin, we should note that there are limits

to the information we can share with the committee and others.

As you know, NSO is a private company

providing expert controlled cyber intelligence technologies

only in exclusive to government agencies

for the purpose of preventing and investigating terrorism

and other serious crimes.

As a result, we are unable to share details about our customers

as well as the crimes prevented and criminals tracked

and apprehended using our technologies

or trade secrets of the technology.

I would like now to dispel a number of misconceptions

that have surfaced in press and public debate

with respect to our company's activities and technologies.

It is not true that NSO Group operates Pegasus

and collects information about individuals.

It is not true that NSO Group sells its technology to private companies.

The issues that came up about Jamal Khashoggi,

about President Macron -

the system was not used on those numbers.

I will go immediately into the Q&A session of today's meeting.

We already have about 15 members who've asked for the floor.

Have United Arab Emirates and Saudi Arabia

ever gone through your due diligence check, and have they passed it?

As I said, I'm not going to respond to questions

regarding specific potential customers.

Given that UAE and Saudi Arabia have been using Pegasus software,

who are legitimate actors to issue warrants in these countries

according to your checks?

Again, I repeat it again,

I'm not going to respond to questions

regarding specific customers.

I cannot - and, again, I repeat,

I cannot, because of various confidentiality and secrecy issues,

I cannot get into specific questions

regarding specific customers or specific cases.

First of all, every customer that we sell to

goes through the due diligence review in advance,

and if...and very often if concerns are raised

regarding the rule of law,

because what we're looking at is also a rule of law,

and any country that we've decided to sell to

has been approved in this manner.

Please, stop - stop the storytelling.

I'm going to continue in Hungarian.

Good question.

Again, I said...

Not again, it was a new question.

So, please.

I have not said... We have not said that we have determined recently

that Hungary is or is not a secure country.

You did consider it secure,

because you sold the stuff to them.

Excuse me... I said now...

Let's keep a little bit of order in the meeting as well.

I understand there is frustration, but it doesn't help us

if we all start posing questions in a chaotic fashion.

So, you have the concrete question.

We have a concrete answer.

And, please. Can you, as the chair,

can you ask Mr Gelfand to either say

that he is refusing to answer the questions,

or answer the questions? Because you keep repeating the same thing,

and there seems to be a complete disconnect between reality

and between what you're saying.

This is like... You know, it's an insult to our intelligence. Sorry.

In some ways, we can talk about the impact on the company

and say it's been really profound.

A more pessimistic view would be to look at the entire industry,

which remains unreformed, pretty wild, unregulated.

NSO may vanish,

but I feel no more secure talking in front of my phone now

than I did when we first published.

I don't think these issues have gone away.