All language subtitles for Surveilled

So, you have agreed to talk,
but you want to make sure

your face isn't shown

and your voice
isn't identifiable.

We'll make sure that you're
protected in those ways.

So you're hacking these phones.

What kinds of
reactions did you get?

What was the pitch that you
were offering these governments?

What should the average citizen,
in any country in the world,

know about this company
and this technology?

Should people be concerned?

The software Pegasus

is perhaps the most
notorious spyware

in the world.

It allows law
enforcement officials

or government authorities

to secretly hack into
a target's smartphone.

And that gains you access to
photos, videos, messages...

Pegasus can also
remotely control

a phone's microphone and camera,

all without any
indication at all

that a hack has occurred.

New Yorker contributor Ronan
Farrow has a new piece out

about Pegasus and the
company that makes it.

So, Ronan, let's just
begin from the beginning.

What drew you to this story
above all other stories?

Well, as you know, I
tangled with some old-school

private investigation
tactics, uh, and surveillance.

And we reported on
that in the magazine.

I had worked on a series
of investigative stories

that pissed off people
with a lot of resources.

Some of what they threw
at me was traditional:

on-the-ground spies
following me around.

But there was also this digital
surveillance I ran into, like,

those spies used my phone's
GPS data to track me.

I realized that the bleeding
edge of surveillance

is these digital tools,

and that they are getting
way more powerful.

The most advanced spyware
can turn your smartphone

into a spy in your pocket.

It can copy everything,

your photos, your
texts, your emails,

even if you're using
encrypted apps.

It can turn on your
camera, your microphone,

it can record you without
you ever knowing...

And then just...
disappear without a trace.

Private commercial
spyware companies

are selling these tools
mostly to governments.

It's a booming,
multi-billion-dollar industry.

And a war is being waged

over the future of
this technology.

See, to infect your phone,

spyware has to go
through the apps on it.

So the Silicon Valley companies
that control those apps,

they're in this battle
to defend themselves

against incoming digital fire.

In May of 2019,

engineers at WhatsApp
discovered suspicious code

hidden within the instructions
that get sent to their servers

to initiate calls.

At the time, Claudiu Gheorghe

was the lead
engineer responsible

for WhatsApp voice
and video calling.

You were really on the
front lines of this hack.

What was on the line for you

as you launched
into this crisis?

I felt directly responsible, um,

because it's a product
that I built from scratch.

Someone had found a hole

in, essentially,
your work, right?

Yeah, and that
was really personal.

I was really
motivated to fix it.

And not just to fix it. I think
what was really important to me,

um, starting that day, was
understanding the attack.

So, when you're setting
up WhatsApp calls,

there's routine messages
that go back and forth

between the user
and your servers,

and in one of these messages...

there was something weird.

At that point, it wasn't
clear that this is

something intentional.

However, what we
ended up finding

was actually the
tip of the iceberg.

At what point was
there, kind of, a first,

all-hands-on-deck, emergency
meeting about this?

The first meeting that I had
was maybe around 10:00 a.m.

with the security team.

Everything was on
fire at that point,

and on high alert status.

It took just over a week

for WhatsApp to
patch its servers

and release an update for the
app, blocking the attacks.

Then they went public,

announcing that at least
1,400 WhatsApp users

had been targeted with
commercial spyware

made by the Israeli
company NSO Group.

WhatsApp is urging its one
and a half billion users

to update the app right now.

NSO Group
has been accused

of being responsible
for the hack.

They deny it.

NSO is the
most infamous vendor

in the growing spyware market.

The company says it
developed its Pegasus spyware

to help governments fight
crime and terrorism.

Famously, it's been reported
that it was used to capture

Mexican drug lord,
Joaquin "El Chapo" Guzmán.

But there have also been
years of allegations

that Pegasus has been used
to target journalists,

human rights activists,
and political dissidents.

Royalty and
heads of state are some

of the 50,000 people
around the world

who may have had their
smartphones hacked.

That's according to a new report

by 17 media organizations.

An investigation published
Sunday in the Washington Post

says the spyware at
play is called Pegasus

and was licensed to governments
by a private Israeli tech firm.

It was
used to track and target

Saudi journalist
Jamal Khashoggi,

who was critical

of Crown Prince
Mohammed bin Salman.

It was at the
Saudi consulate in Istanbul

that Jamal Khashoggi
met his brutal end.

He was strangled as soon
as he entered the building

by a team of Saudi assassins,

who then dismembered his body.

I can guarantee to you,

our technology was not used

on Jamal Khashoggi
or his relatives.

In November 2021,

I was reporting on all of this

and trying to get
answers out of NSO

and its chief
executive, Shalev Hulio.

That's when the Biden
administration placed NSO

on a Commerce
Department blacklist.

NSO's inclusion
on the U.S. blacklist

does make business a lot harder,

with other firms now maybe
needing to think twice

before doing business with them

for fear of violating
regulations.

The next day, NSO's
spokesperson called me

and asked me to meet
with Shalev in New York.

Will you have your
phone on in the meeting?

- I'll try. I'll ask.
- Okay.

- This is my colleague, Unjin.
- Hi.

- Nice to meet you.
- Hi, nice to meet you.

Hello there.

I'm in a bar, Ronan.

I thought you were closing
the magazine or something.

I was just meeting with
a Justice Department official.

But I cut the interview
off early, so...

So that you could hear from
one of your wayward reporters

about what he's up to?

So I talked to, uh, Shalev

for two and a half hours.

Wow.

Tell me about the conversation.

They're still reeling from
this announcement yesterday

that they're on this
export blacklist.

- And...
- Were they worried?

They weren't worried
in the substance

of their answers so much as...

There was a lot of
reference to, you know,

"Better schedule that
trip to Tel Aviv quick.

We might not exist
as a company."

Which I think is a joke.

I don't know that
their bottom line

is that vulnerable,
but I do think

that it's a serious moment
of-of worry for them.

So the kind of, the high-level
philosophical picture

that he paints is,

"This is a technology
that's blossoming

around the world anyway.

If we're not doing it,
someone else is gonna be."

So his case is kind of like,

"Hey, there's all these
people doing this.

This is the new reality."

The digital Wild West.

Yeah, and he acknowledges

there's a potential for abuse,

but he says, "We are,
relative to the competition,

the ones willing to subject
ourselves to more scrutiny

and answer more questions in
the press and be regulated."

They, as of now, are saying that
they'll go fully on the record

and actually allow me to
bring cameras in, in Tel Aviv.

That's great. It sounds
like a great meeting.

It's great you made it happen.

- I-I have to go...
- Oh, you have to run, right.

Go, go, go. Thank
you for making time.

Thank you. Bye.

Israel is at the center
of surveillance innovation.

There's a pipeline of expertise

from the country's military
and intelligence services

into tech start-ups.

And the Israeli state
uses some of that tech,

including in the conflict over
the Palestinian territories.

According to an Amnesty
International report

released in the fall of 2021,

six Palestinian human
rights activists

had their phones
hacked using Pegasus.

Knesset member Sami Abu Shehadeh

says that's part of a long
history of surveillance

of Palestinian citizens.

So, it was reported
a few months ago

that Pegasus, from NSO Group,
was found on the phones

of six Palestinian
human rights activists.

The defense minister claimed...

these were, uh, subjects
of terrorism investigation.

Yeah, yeah, yeah. So Israel...

unfortunately,

has been doing this
for its citizens.

Mainly for the
Arab Palestinians.

I think what-what-what-what is
making Israel so... important

in this destruction industry

is that they have a huge
laboratory to work in,

and they are using
the Palestinian people

to do their, uh, tests.

Then they sell it to
the rest of the world.

Israel says
it uses surveillance

for self-defense and
national security.

I started talking
to NSO in 2019.

It wasn't until 2022

that they agreed to let
me do some reporting

inside their
headquarters in Tel Aviv.

Most companies that do this
work are pretty secretive.

But NSO has always
courted the press...

up to a point.

Hi there.

Ronan Farrow.

Uh, you have
an appointment?

Yes. With NSO.

They were opening
their doors to me

but also trying to
keep a tight leash.

I'd be talking to everyone
from software engineers

to salespeople,

and I realized quickly,

NSO's PR team was
gonna be hovering.

Hey. Ronan.

Come, let's, uh, take
some coffee, tea.

I may take pictures as
I go, if that's okay.

- Yeah.
- So I can write about it,

you know, for color.

Want to get a sense of the digs.

It's a swanky office space.

It's very American
tech start-up vibes.

- Fancy cafeteria.
- Thank you!

You want some coffee? Tea?

- What do you want to drink?
- Coffee sounds great. Thank you.

I just wanted to start
with introducing our team.

Yes! I'm very much looking
forward to talking to all of you

and hear about the working
level experiences you have.

So this is great.
Should we get started?

What made you want this job?

What specifically do you think
people have gotten wrong?

You have been involved
in relationships

where there's been
some kind of a finding,

or at least a suspicion,

that there was
inappropriate targeting.

What would you
say to the targets

of that kind of misuse
of your technologies?

How-How
have you navigated

the sort of moral questions

being raised about your
work in such a public way?

You know,
what happens in a case

where maybe the government
thinks these are criminals,

but outside observers say,
"Hey, those are activists"?

I'm a tech guy and I'm an
intelligence guy, okay?

I know how to create
investigation systems

and now I can know how
to make it technically

the best way possible. Okay?

The question you're asking
now, this is for the big guys.

Big questions.

NSO claims that
potential customers

are thoroughly vetted,

and it emphasizes that each
sale needs to be approved

by the Israeli
Department of Defense.

General Counsel Shmuel Sunray

is in charge of that
compliance process

and of the internal
investigations

the company says it conducts

when there's an
allegation of abuse.

- Hello.
- Hi.

- Pleasure to have you here.
- Yes, it's good to be here.

It's an interesting
time to be here.

You're up against a pretty
widespread perception

that this talk of
compliance efforts

and internal investigations

is-is viewed as being
non-substantive.

First of all, the efforts
are truly substantive.

Unfortunately, I think one
of the main problems we have

on the perception side

is that all the good
work that we do,

um, cannot be published
in its details.

I mean, it cannot be...
we cannot share, like,

when we disqualify
a certain customer

for a due diligence reason,

or we shut down a
system for a misuse.

Even if we would have wanted to,
we are prohibited from doing so.

As you might imagine in the
course of this reporting,

I'm gonna be talking
to quite a few targets

of NSO's technology,

some of whom, you
know, really feel

that this was destructive
in their life.

What would you say
to targets of Pegasus

and other NSO software?

Anyone who
feels he's a target,

I would really
appeal for them to go

and go through our process.

I think that our record
has proved itself.

We, you know, don't
want our technology

to go and be used in such a way.

And if it was our
technology that was used,

we feel very bad about it

and we'll make our
utmost to make sure

that no other targets
will be in that situation.

I asked
Sunray repeatedly

to give me specifics
about these investigations

or proof that contracts had
been canceled as a result.

He declined.

- Should we break for lunch?
- Yeah, yeah...

Okay, great.

Oh, so this
is the Shalev suite.

Okay.

I convinced Shalev
Hulio, the CEO,

to go on the record for
my New Yorker article,

but he refused to
appear on camera.

When I pressed him about
the allegations of abuse,

he also wouldn't
provide specifics

about the company's
internal investigations,

citing the privacy
of NSO's clients.

Both he and Sunray

compared their company
to an arms dealer,

just in a field that
doesn't yet have regulations

like the Geneva Conventions.

I needed to find
unvarnished takes

on how NSO really operates.

One of the calls I made

was to Israeli journalist,
Chaim Levinson.

What has the experience
of reporting on NSO

been like for you?

At the beginning they
were very closed,

didn't talk to journalists,
"You all are against us,

you don't understand,

it's a security
issue," et cetera.

But lately, in the last year,
they've become very friendly.

Do you buy
what NSO is selling

to journalists and
governments around the world

when they say, you know, "Yes,
there have been some missteps,

but we want to be, and we
are now, the good guys"?

I think they understand they are
in a very, very bad PR situation

and the previous
policy didn't work.

And now they're thinking if
they explain to the people

what exactly they are
doing, it will help them.

If you ask me, the head of
the problem is not the PR.

The problem is the issue.

NSO can hack your phone
with zero-click technology.

And this is a tool
that, until NSO,

only very industrial
countries had...

United States, security
services of Israel.

But for countries like Angola,

it's impossible to
develop such a technology.

They don't have the
human resources to breach

Apple and Google engineers.

What makes NSO special?

They are willing to
sell to countries

with huge democracy and
human rights problems.

Other companies are not
willing to sell, and NSO are.

Chaim introduced
me to something rare...

a former employee who
had firsthand knowledge

of NSO's sales efforts
and was willing to speak

without the company's
permission...

if I promised to
conceal their identity.

Is there anything specific
that makes you fearful

of how they would react

if they did see your
face and your identity?

So tell me from your
standpoint why you think

it's important to have
this conversation.

What's the most objectionable
thing that you saw

in your time at the company?

So you sold Pegasus to
these different governments?

Pre-sold.

You pitched Pegasus to
governments around the world?

What were the-the main customers

that you saw the
company deal with?

Um, they claim

most Western European
countries use them.

Is that true?

Um...

Some examples?

And beyond Europe. Any examples

that were sort of
significant in your mind

or that gave you pause?

Mm-hmm.

Any African? Oman.

Yeah, yeah, yeah.

What was the price tag on this?

What was NSO
charging for Pegasus?

Does NSO know

that some of its customers
that it's selling to

for those big-ticket
prices you mentioned

are abusing this technology?

Hi, Oded.

More importantly, how are you?

Yeah. As
you can imagine, uh,

I'm-I'm gonna call
everyone around the story.

Um, I think it's been a
fairly short list of formers.

But, you know, if there's anyone
you suggest I add to that list,

I welcome it.

Mm-hmm.

Yeah. Oded, you know, I'm always
an open book on this stuff.

We've talked about
this at length.

I have been very glad to see
that I think you're savvy

about knowing that
more transparency

is a good thing for
NSO at this point.

I know it's been a,
kind of, a hard time

with a lot of controversy.

Any time you have a
concern, you know, raise it.

And I'll answer honestly.

Okay.

Okay.

- Bye.
- Bye.

Though NSO was
wary of me speaking

to its former employees,

the company was
willing to let me speak

to one of its current
Western European clients.

Hello.

He's going to be
ten minutes late.

He's on his way to
his laptop right now.

How many other outlets, uh,

has, uh, our friend
who's about to come on,

uh, spoken to in this way?

- No one.
- No one?

I was assuming that
he was the source

of the Wall Street
Journal article.

I think that was also a Western
European law enforcement.

We have several
customers from Western Europe,

but we don't have
a lot of customers

that are willing to
speak with journalists.

I will need to know
his-his full name

and identity and everything.

Only for your... But
only for your knowledge.

Yes. You don't have to worry.

If I verbally agree

that a source is an
unidentified background source,

uh, you know, described as a
European intelligence official

then-then that is, uh,
that's the ground rule.

Yes, you can even say, you know,

West European law
enforcement agency,

I mean, whatever
that will not...

will not expose the name
of the country, the agency,

or, of course, his name.

Tal, is he joining?

He's connecting right now.

Okay, great.

Hello!

Thank you for doing this.

I appreciate your
taking the time.

So when did your, uh, agency
first become a customer of NSO?

How much did you pay
for the software?

Tens of millions of euros?

What's the... what's the...

Okay. Understood.

And what type of product
did you purchase?

Is this Pegasus, primarily?

And what is the
software being used for?

Do you think it
would be a scandal

if it was known widely

that you were using Pegasus?

Do you have to get a
warrant to use Pegasus?

And how many people
have you targeted, uh,

since 2015, with, uh, Pegasus?

Roughly. Roughly.

Mm-hmm.

Okay. So, um...

Very helpful.

- All right. Take care.
- Thank you.

Okay.

Are we all, uh, dispersing now?

- And sorry for the mistake.
- Oh yeah, I saw.

So it's two-two
journalists he talked to.

Do you remember which ones?

He was the Wall
Street Journal source?

It was... it was one
of the Wall Street Journal

and one is Israeli TV.

An Israeli
one. Okay. Got it.

Okay. Um, this is
very helpful to know.

Thank you again, everyone.

- Enjoy.
- Okay. Take care.

I don't doubt these law
enforcement officials

when they tell me
they love having

such a powerful
surveillance tool...

and that they sincerely want
to use it to ensnare criminals.

But there's evidence that
Pegasus is being used

in at least 45 countries.

And it's mostly happening

under a veil of secrecy,

without public
input or oversight.

Pegasus might have
lived up to the promise

that it's undetectable...

if it weren't for a group
of researchers in Canada.

The vast majority of what
we know about NSO abuse

comes from researchers

at the University of
Toronto's Citizen Lab.

They have found examples
of the spyware being used

to conduct surveillance

on dissidents, human
rights activists,

and journalists
around the world.

- Hey!
- Ronan, how you doing?

- It's great to finally meet you.
- Great to meet you too.

Thanks for letting us
into the inner sanctum.

Of course.

For more than a decade,

Ron Deibert and the
team at Citizen Lab

have been studying the
pieces of malicious code,

known as exploits,

that target vulnerabilities
in your phone's apps

or operating system
to install spyware.

We're really lucky
to have this space.

This is, uh, the lab.

These are the spaces where
most of the work gets done.

Got it.

So what are they doing in there?

We have a
person who suspects

that they've been
targeted with spyware.

And so what they will be
doing is walking them through

how to gather the
data that we need

to do forensic
analysis of a phone.

How difficult has it been
to catch these exploits?

'Cause many of them,
including Pegasus,

are designed to clean
up after themselves.

We've been fortunate
now, uh, to capture

several different vendors'
spyware in the wild,

usually from targets.

Um, the one that really
stands out for me

is the case of the Saudi
women's rights activist,

whose phone was
hacked with Pegasus.

Which is why that excuse
that NSO Group and others use

is so specious.

You know, "Don't worry.
Nothing to see here,

because we only sell
it to governments

to be used for
crime or terrorism."

It's not a-a good way to think

about the limits of
this type of technology.

How do you see the industry
evolving from here?

If we succeed, you could imagine

a much different environment
ten years from now,

where there is robust
oversight mechanisms,

and much more transparency.

That would be my ideal world.

The way things
are going, though,

frankly, frightens me

because we live in a time
where there is obvious,

well-documented
democratic backsliding.

Authoritarian practices
are spreading worldwide.

I firmly believe the
surveillance industry,

unchecked as it is,

is one of the major contributing
factors to those trends.

A lot of the coverage
of the dangers of spyware

has focused on the way
autocrats and dictators

outside the Western
world use it.

But Citizen Lab's work shows

that Western democracies
are abusing spyware too.

They tipped me off
to an investigation

they were conducting
in Catalonia,

a region of Spain,

where they suspected
Pegasus was being used

to surveil local
politicians and activists

on a massive scale.

- Hey!
- Hi.

- How are you?
- Thank you for coming.

Yeah! I'm looking forward to it.

It's also stunning here.

I was not fully expecting that.

Elies Campo was born here.

He's worked in Silicon Valley
for WhatsApp and for Telegram.

And now, he's Citizen
Lab's investigator

on the ground in Catalonia.

A few people from Catalonia
messaged me and said,

"Hey, I just received
this message on WhatsApp

about being, uh, targeted or
being hacked at some point,

um, and I don't know if
it's, um, it's real or not."

I contacted my
ex-colleagues at WhatsApp.

They told me that they couldn't
communicate anything with me

because of privacy issues but
I should contact Citizen Lab

and see if they could help. So
I reached out to Citizen Lab.

The conversation went that
these cases from WhatsApp

were probably just the
tip of the iceberg, um,

and that we... if we
organized a little bit

and had some kind of strategy,
we'd probably find more.

Why should people
around the world care

about the hacking that
you're documenting

here in Catalonia?

This is gonna be
one of the first cases

where there's such a large and
vast number of affected people

and from a vast and
different type of categories

of, um, of society.

So we've had the Parliament
of Catalonia targeted.

We've had the government
of Catalonia targeted.

We've had lawyers targeted.

We've had, uh, civil leaders

of org... cultural organizations
of Catalonia targeted.

This is not some
future Orwellian scenario.

It really... It happened here.

- It's happening here.
- It's happening here.

Citizen Lab suspects
that people in Catalonia

are being targeted
for political reasons.

Catalonia is a semi-autonomous
region in Spain,

with Barcelona as its capital.

There's a significant segment
of the population there

that wants Catalonia to
be an independent country.

In 2017, Catalan
leaders organized a referendum

where they asked
voters to decide

if the region should
be independent.

The Spanish government in Madrid

declared the referendum illegal

and even raided polling
sites on Election Day.

Tensions are still
pretty high today

between Catalonia and Madrid.

And there's a lot of
Catalan politicians

that still favor independence.

I joined Elies in the
Parliament of Catalonia,

where he was testing
politicians' phones.

Walk me through what
you've been doing

and what you're finding
with these ones.

- Yeah, so we analyze the device.
- Yeah.

And we try to find traces

that there was the malware

at some point in
that... in that device.

And how we do that is through
some analysis on the device.

We extract the file, and
uploading it to the cloud,

and the cloud is
doing the analysis

of, uh, of trying
to find traces.

What's next? You have members
of Parliament coming in, right?

Yeah, a European member
of the Parliament

that's currently in Barcelona,

and, uh, his name is Jordi Sole,

and, uh, we're gonna talk to him

and look at his device now.

Great.

Hola, que tal?

Hola. Laura.

Uh-huh.

Mm-hmm.

When does it look like
you were infected?

I have to
check, uh, the date.

But around that day,
I was appointed, um,

member of the
European Parliament.

How do you feel knowing

that you may have been
compromised in this way?

Well, I feel surprised and angry
at the same... at the same time.

Uh, and it's, uh,
somehow it's ironic

because next week, in
the European Parliament,

we are gonna vote to set up an
inquiry committee on Pegasus.

Um, so it's...

it's-it's only...
it's only ironic

that just a few days
before, I learn,

as member of the
European Parliament,

that I've been
infected by Pegasus.

What about you, Elies?

What goes through your
mind each time you see

a positive result pop
up on that screen?

I think about the
gravity of the situation.

Especially these cases where

there are members of
the European Parliament

'cause it affects, uh,
450 million people,

citizens, and the
violation of their rights.

Um... Yeah, each
time we discover one

is-is, um, similarly intense

in terms of realizing, uh,

the importance of it
and the gravity of it.

Why do you think
you were hacked?

Well, I've been hacked
for sure because I am, uh,

pro-independence.

So I'm sure that
there is the will here

to keep under control

politicians representing,
uh, the will for independence

in Catalonia in
several institutions.

Are you looking at
any legal remedies?

Do you think that you'll
bring suit in some way?

I'll defend my
rights until the end.

Jordi wasn't alone.

Elies was steadily uncovering
more and more infections

on the phones of activists
and lawyers and politicians.

And it also wasn't just Pegasus.

These tests were
turning up evidence

that the Catalans were
also being targeted

with other forms of spyware
from competing companies.

One day, Citizen Lab found
evidence of something rare.

A local activist had
a spyware infection

on his personal laptop

that was still live

and in the middle of its attack.

- Hello, Joan.
- Hello. Hi.

It's great to finally
meet in person.

Thank you for doing this.

Joan Matamala
is an activist

connected to
separatist politicians.

His laptop was
infected by spyware

made by another Israeli
company called Candiru.

Elies worked to try to
exfiltrate the software

and study it before
it self-destructed.

This is where
you were, uh, sitting

when the, uh... when you
learned about the hack?

He was working over there
when he received the call

that he currently
had a live infection.

And what date
and time was this?

February 2021.

Tell me what
you did from there.

Yeah. So he took some
time to get that aluminum foil.

He wrapped two computers.

What's the goal
of the tin foil wrapping?

You're creating what's
called a Faraday cage, right?

By wrapping it and-and
creating a Faraday cage,

uh, we're actually
protecting the device

from receiving
outside instructions

to have the software delete
itself or self-destruct

in order to, uh, remove
or potentially remove

the evidence of... that
software was there.

It's particularly important
to be able to capture

the software live or
active in the computer

so we can understand
how it works, uh,

how it compromises
the operating system.

So he was really doing something
that's a service to researchers

on these kinds of technologies.

Yeah, his action
actually helped Microsoft

understand how this
particular software,

Candiru, was affecting
this operating system.

And a few months later,

Microsoft actually
developed a patch

that, uh, resolved
the vulnerability

that this, uh, software
was actually exploiting.

It's surprising
that just tin foil can work.

- Yeah, it's physics.
- Yeah, yeah. It makes sense.

A little tinfoil
went a long way.

The proliferation of
spyware around the world

has left governments
scrambling to respond.

And that includes
the United States.

Even though NSO claims
that it blocks its spyware

from targeting
American phone numbers,

U.S. government employees
working overseas

have had their foreign
phones hacked using Pegasus.

Apple is warning at least
11 United States diplomats

that their iPhones were hacked
in the last several months.

The hackers reportedly
used the spyware technology

called Pegasus.

But the U.S. government

is also a buyer of
commercial spyware,

including Pegasus.

Internal documents obtained
by the New York Times reveal

some FBI officials
made a push to deploy

Israel's Pegasus hacking tool.

So I understand that you
did purchase a program

and you tested it.
Is that accurate?

We had a limited license
for testing and evaluation.

We've tested and evaluated,
and that's... that's over.

It hasn't been used in any
investigation of anyone.

It's been reported
that NSO also pitched

American police departments

on a Pegasus-like software

designed to be
used on U.S. soil.

Lawmakers are grappling
with both sides of this...

how to protect Americans
against these attacks

and how to control America's
use of this technology.

Jim Himes is the ranking member

of the House
Intelligence Committee,

which oversees U.S.
intelligence agencies,

including the FBI and the CIA.

- Hey, Ronan.
- Hey.

- How are ya?
- Thanks so much for doing this.

Yeah. Good to see you in person.
I know we talked on the phone,

but I don't think we've
ever met in person.

What is your feeling
on how much ability

the U.S. government should have
to purchase this kind of tech?

First of all, it would
be a very serious mistake

to simply prohibit the
purchase of the technology.

We need our experts to
know what is out there.

I have no objection to the FBI

purchasing the technology
to understand it.

Then comes the more
complicated question of,

"Do we want the FBI
to be able to use it?"

Do you think the answer is

a ban on the operational use

of foreign commercial spyware
by the U.S. government?

No.

No, abs-absolutely not.

The answer is,

do the hard work of assuring

that law enforcement uses it

consistent with our
civil liberties.

We're using a lot of
abstractions here right now.

I have two daughters.

What if one of my
daughters were kidnapped?

I want that tool.
I want that tool.

And it would be profoundly
irresponsible of me to say,

"There's this amazing
tool out there

that could fall into the
hands of the Iranians,

the North Koreans,
the Chinese...

and we're not gonna
let the FBI use it."

We're going to let
the FBI use it.

We're going to make sure that
they use it in the context

of our civil liberties, and,
well, will it be perfect?

No, it will not.

It will, from time
to time, be abused.

But the notion that, for the
first time in our history,

we're gonna say we're gonna let
all the bad guys have technology

that we're not going to use,
um, that's a novel concept.

And-And when you really
think it through, uh,

a little bit of a scary concept.

A lot would have to change
for it to be transparent

and have an approvals process
that-that meets that threshold.

That's not the space
we're operating in now

when this technology is
used by the U.S. government.

That's correct. And
this is why I say

one of the urgent things we
would need... we should do,

we should be doing, is
building the protections

around how U.S. law enforcement
might use this technology.

In terms of the hacking
of American officials,

are American officials
abroad, and maybe in general,

subject to more attacks
using this kind of technology

than the public is aware of?

Yes.

- And...
- Significantly more.

Significantly more.

And are you aware of
infections of this type

that have played
out on U.S. soil?

Maybe the best way to answer
that is that this technology

knows no borders.

I don't happen to know of
the deliberate targeting

of Americans on U.S. soil.

I'm also...

I have no confidence
that it hasn't happened.

The White House told me
they were still investigating

how spyware affects
national security.

And then they told me
something I'd be making public

for the first time...

that the Biden
administration was planning

an executive order banning
government agencies

from buying or using

at least some types
of foreign spyware.

I'd been reporting on
this for a few years,

and I really hadn't
found any governments

that provide
meaningful transparency

about how they use these tools.

Uh, this is... this is Ariella,

the comms person at NSO,

sending me a thumbs up that
she is going to get me a...

I'm gonna say,
"Much appreciated."

She's gonna get me a last
statement that they have.

There's a dozen countries that
are mentioned in this piece

and each of them had to
be approached for comment.

Some of them wanted to
comment, some didn't.

Some wanted to only
comment in secret,

but not on the record.

There's just a lot to
juggle with this one,

and I've got to hustle and
redline the rest of this piece.

Avey, are we in here?

- We're in here.
- We're in here. Okay.

Yeah.

- Good to see you.
- You too.

- Hello.
- We're ready? Okay, good.

- Yes.
- All right.

Avey. Great.

Um...

All right.

- Thanks a lot.
- Thank you.

Okay.

- Are you all closed up?
- Mmm...

Yes, but, like, checkers
still laying in odds and ends.

It's Thursday, and
the magazine closes today.

- Yeah.
- Like completement.

Yeah.

- That's it.
- Yeah.

- That's it.
- Okay.

I think it's...
it reads really well.

Okay, so we're just gonna power
through this pretty standard.

You know what you're
doing. Here we go.

In your reporting,
you've narrowed in

on a series of Pegasus
attacks on people involved

in the Catalan independence
movement in Spain.

Were you able to confirm
these hacks with NSO

or the Spanish government?

NSO Group
CEO, Shalev Hulio,

did very clearly talk
about some of the countries

that we now know use his
technology, including Spain.

And in that case,
he said, you know,

Spain is a democracy.

Uh, if they decide
to use these tools...

- That's on them.
- That's on them!

And the Spanish
government, for their part,

didn't respond to our
requests for comment about it.

Do you think it's
possible to have a world

where such a thing exists
and it's used responsibly?

Well, we're
watching the fights

that will dictate the
answer to that question

play out right now.

And one of the
things that we break

for the first time in this
story is-is that the White House

is actively pursuing a
U.S.-government-wide ban

on purchasing this kind
of commercial spyware.

Because they have their own?

Well, certainly certain U.S.
agencies have their own.

But, you know, in the past,

other U.S. government offices

have also purchased
these kinds of tools.

And I think there's an
increasing understanding

that this is both, uh,
technology that has

an incredibly destructive
footprint in the world,

and we've just got to hope

that some of these
regulatory efforts

can rein in the most
destructive effects of it.

In his latest investigation,
the journalist Ronan Farrow

has dug into the
spyware industry.

In explosive new reporting in
The New Yorker, Ronan Farrow

details the two years
he spent digging

into the vast spyware industry.

Ronan, my friend, this
is scary stuff! Um,

first of all, just break down,
for those who are unaware

of what it is, what is
Pegasus and who makes it?

The fundamental is,
it can crack a phone.

It feels like the cat's
out of the bag, isn't it?

How do you control this?

To your point, once data
has been exfiltrated,

the damage has, in
a sense, been done.

The article is called
"How Democracies Spy

on Their Citizens"
by Ronan Farrow.

Ronan, thanks so
much for joining us.

The article in The
New Yorker and the results

of the Citizen Lab
investigation led by Elies

had enormous
repercussions in Spain

and finally helped shed light
on who was behind all this.

After initially
denying the report,

the Spanish government in Madrid

acknowledged spying on
some of the Catalans.

The head of Spain's
intelligence agency

was fired amidst
the controversy.

The scandal became known

as "CatalanGate."

On the list of
targeted individuals

was Elies's own family.

Is your family okay?

Yeah, my family is okay.
They were surprised.

Surprised that they
got hacked too?

Yeah. So I was having a
dinner with my parents,

uh, just a few weeks
before publication.

I told my father, "We're
gonna publish this report.

It's probably gonna
have some impact

in Spain because
it's pretty serious."

And so we checked his phone,

and, a few hours later,
we got the results back

and, um, we got a confirmation.

The next day, we tested my mom

and, uh, we found that she
had also been targeted.

So they were following
you and trying

to get your communications
through your parents.

Presumably they failed
in targeting my device,

because I have an
American, uh, phone number,

and they targeted my family

in-in order to try to
get to the information

that they were looking for.

What do your parents
do for a living?

They specialized
in, uh, in pathology

and, uh, vascular diseases,

and they work at the
University of Barcelona

and the hospitals of Barcelona,
the research centers.

So, whoever had access
to those devices,

they actually had access
to, uh, potentially,

hundreds of conversations
or hundreds of data points

of emails, messages,
photographs,

of patients all
around the world.

Not only
did they have access

to his parents'
patients' records,

they also potentially
had the ability to record

audio or video of Elies

whenever he was in the room
with his parents' phones.

So, Elies started testing

the rest of his family
members' phones,

including his sister's.

Including
Elies's family,

Citizen Lab found that
around 70 people in Catalonia

were targeted with spyware.

Since the publication of
those findings in Spain,

Citizen Lab has documented
Pegasus being used

against government officials
in the United Kingdom,

activists in Armenia,

journalists in Mexico,

and pro-democracy
demonstrators in Thailand.

In the summer of 2022,

Shalev Hulio stepped down

as CEO of NSO Group.

He went on to establish
a new start-up

in the cybersecurity space.

Meanwhile, in March of 2023,

the White House followed through

on the plans they'd revealed
in my New Yorker article.

Just a few hours ago,

President Biden issued
an executive order

that, for the first time,

will prohibit our
government's use

of commercial spyware that poses
a risk to our national security

or that's been misused
by foreign actors

to enable human rights
abuses overseas.

The executive order
banned federal agencies

from buying spyware that's been
abused by other governments,

used to target Americans,

or otherwise threatened
national security.

But it's not a blanket ban

on the purchase of all spyware.

And in fact, just days later,

the United States and
36 other countries,

including Spain,

released a statement outlining

how they believe governments
can use commercial spyware

and still respect human rights.

I went back to DC to press
Biden administration officials

about this.

Nathaniel Fick is
the first Ambassador

for the newly created

Bureau of Cyberspace
and Digital Policy.

What do you wish

this executive order
contained that it doesn't?

What do you think the
soft point is in it?

I think part of the reality is
we don't know that yet. Right?

You-You-You craft something

and you throw it
out in the world.

And the world is
a dynamic place.

Our adversaries are innovative
and smart and well-resourced.

So we'll adjust as required.

I'm struck by the fact
that it contains so little

about what we do
do with spyware.

There's no suggestion of,

once a spyware
vendor passes muster

through the lens of
this executive order,

what does that look like?

What can we then do
with that technology?

Why?

The United States uses
every tool of national power

in pursuit of our interests,

uh, grounded in our values.

And so, we do believe,
and openly acknowledge,

that there are legitimate
law enforcement

and national security uses
of these technologies.

There were a number of joint
statements circulating around...

Spain signed on to one
of these statements.

Obviously, the administration
in Madrid has been implicated

in one of the largest spying
operations domestically

in their country, in the world.

Uh, how do you feel about
them being a signatory?

I think that getting countries

to publicly align
with the principles

is always a good thing.

Even if it's hypocritical?

And then we have
to continue to hold

their feet to the fire,
just as we do ourselves,

to make sure that we're living
up to the implementation.

I've had conversations with
foreign officials who say,

"Well, you want us to have
more transparency about this.

You want us to have clearer
routes for judicial oversight

for-for these-these
kinds of tools.

Uh, where is that from
the United States?"

I think the Executive
Order is a statement that

everything that came
before was not adequate.

And-And this is a
very strong attempt

to put those
guardrails in place.

My perception, digging into
this issue, has been that

inevitably we're gonna
have the first big scandal

where this is used to
scale on American soil.

Do you think it's headed down
a path of more domestic impact?

I think we can't put

the technology genie
back in the bottle.

That's kind of an unfortunate
reality of these things.

So once they're out
there in the world, um,

any nefarious use
that we can imagine,

we're probably going to see.

And so we would be well-served

to think forward in time,

um, and anticipate
that kind of thing.

Spyware is here to stay.

The industry is still growing.

It's gonna keep getting
more sophisticated,

more intrusive,

and easier to hide,

especially as we witness
the dawning of a new era

of artificial intelligence.

This is still a largely
unregulated category

of technology,

one that will always
be seductively useful

for law enforcement

and always pose a
threat to democracy

and human rights.

Technology is reorganizing
the life of the world.

President Biden likes to
say that, in many ways,

we're at an inflection point,

where the decisions
that we're making now

and in the next few years

are likely to shape
the next decades.

Commercial spyware
is going to continue

to shape conflicts
around the world.

Questions remain about the
role these surveillance tools

have played in the
Israel-Gaza war.

Since Hamas's attack
on October 7th, 2023,

sources close to
NSO have claimed

the Israeli government
is using Pegasus

to try and track down hostages.

And additional investigations
have been opened in Poland

and in Jordan.

Governments and legislators

will be struggling to catch
up to this technology.

Tech companies are gonna
have to fight harder

to defend themselves

against a teeming
international landscape

of unseen adversaries.

The message is that
unchecked spyware

is a national security risk

for free societies.

More ordinary
civilians are being ensnared,

their most private data stolen

and potentially exploited.

There will be more
families and communities

upended by this.

There will be more urgent need

for the work of
activists and researchers

bringing this out
of the shadows.

This is an important issue.

I think things are gonna get
worse before they get better.

In spite of the measures
that have been taken,

the industry is only
going to continue to grow.

Otherwise, the
only path towards privacy

might be living
without our phones.