Report: Russian exiled journalists, Belarusian opposition among Pegasus spyware targets
An undetermined Pegasus customer, or customers, targeted at least seven exiled journalists, opposition figures, and civil society members in Europe with Pegasus spyware, according to a new report from Access Now and Citizen Lab released today.
- Russian and Belarusian journalists and opposition figures in Latvia, Lithuania, and Poland were targeted with Pegasus spyware, per NGO report;
- Researchers suggest at least three of the infections appear to have been linked to a Pegasus customer operating in the EU;
- Alleged victims include Europe-based staff of independent Russian newspaper Novaya Gazeta.
By Phineas Rueckert
May 30th, 2024
Credit: Gilles Pointeau / Forbidden Stories)
New research, jointly conducted by the University of Toronto’s Citizen Lab and the global NGO Access Now, has found evidence of Pegasus spyware targeting Russian and Belarusian-speaking independent journalists and opposition activists in Latvia, Lithuania, and Poland. The findings, released today, come months after these same groups revealed the phone of Galina Timchenko, an award-winning exiled Russian investigative journalist, had been infected with Pegasus, in February 2023, while she was in Berlin, Germany.
Forbidden Stories and Le Monde obtained access to an embargoed copy of the report, and are publishing its findings jointly. According to the report, the highly-invasive spyware tool sold by the Israeli NSO Group–which has the capacity to remotely infect mobile devices, giving operators access to contacts, phone records and even the ability to remotely activate the phone’s microphone and camera–was used to infect the phones of journalists and opposition figures, including several exiled Russian journalists, between August 2020 and January 2023. While researchers did not identify a specific client, their analysis suggests that a single NSO Group customer may have been behind the targeting of at least three, and possibly all five of the confirmed victims.
“If it is indeed a European country, a democracy that is targeting these people, it is a very alarming sign that there are some serious problems with the rule of law,” Natalia Krapiva, a Senior Tech-Legal Counsel at Access Now and one of the authors of the report, told Forbidden Stories and Le Monde. “Using such powerful spyware tools against journalists and activists poses really serious questions,” Krapiva said.
Among the targets were at least three Russian journalists living abroad, including Israeli-Russian radio reporter Evgeny Erlikh, general director of Novaya Gazeta Europe Maria Epifanova, and an exiled Russian journalist who requested anonymity.
Epifanova’s phone was infected in August 2020–the earliest known infection of a Russian civil society member with Pegasus. At the time, Epifanova directed Novaya Gazeta Baltija, the Baltic offshoot of Novaya Gazeta, a newspaper known for its critical reporting on Russia. The newspaper, founded in 1993, was forced to shut down its Russia operations after the Russian invasion of Ukraine and relocate to Riga, the capital of Latvia. Several Novaya Gazeta journalists have been murdered, while others have been imprisoned for their work.
In a May 2024 phone interview, Epifanova explained to Forbidden Stories that in the summer of 2020, when her phone was infected, she was working from her flat in Riga, the capital of Latvia. The timing surprised Epifanova, who like many was living under quarantine and mostly editing Covid-related stories. “The timing of the attack is probably the weirdest thing in this story for me,” she told Forbidden Stories. “At that time we had pretty hard restrictions, everything was still closed: that means no restaurants, no cafes, nothing. Basically what I was doing was sitting in my flat and working remotely and communicating with the rest of the team.”
While she did not know why a Pegasus operator may have been interested in her or what data was taken from her device, she noted that the spying coincided with a request for accreditation to cover an in-person speech by Belarusian opposition leader Svetlana Tikhanovskaya in neighboring Vilnius, the capital of Lithuania, amidst widespread protests against Belarusian president Alexander Lukashenko. Tikhanovskaya, 41, ran an unsuccessful campaign for president in 2020 after her husband, also a Belarusian politician, was arrested. Epifanova noted that numerous exiled Belarusian journalists and other critical media were in attendance, which may have put a target on her back.
“I am a journalist, I am a Russian citizen, I was the editor of a Russian-speaking outlet, probably they wanted to check something” about me, Epifanova said. “The most worrying part is that there could have been some sensitive information about other people,” she added, referring to sources, information about employees, and other types of data she keeps in her phone. “If such things could have been accessed by my device then it means that other people could have suffered from the attack on my device.”
Protect your stories
Are you a journalist under threat because of your reporting? Secure your information with Forbidden Stories.
In September 2023, Apple notified Epifanova that her phone may have been targeted by a state-sponsored hacker, alongside two other Latvian journalists. However, Citizen Lab and Access Now did not find any evidence that the phone was successfully infected after August 2020.
According to the new report, the phone of Evgeny Pavlov, a Latvian journalist who also reported for Novaya Gazeta Baltija, was also targeted in November 2022 and April 2024, but researchers were unable to determine whether those hacking attempts were successful.
Other infections coincided with journalists attending opposition-focused events. In December 2022, Natallia Radzina, the editor-in-chief of independent Belarusian media website Charter97.org, attended an anti-war conference in Vilnius. The day after, her phone was infected with Pegasus spyware. The phone of the Russian journalist who asked to remain anonymous was targeted on June 15, 2023, the day before attending a workshop for Russian exiled journalists organized by several NGOs in Riga, Latvia.
Journalists were not the only victims of the spate of Pegasus attacks. The phone of Andrei Sannikov, a Belarusian opposition figure who previously ran for president and has been arrested by intelligence services, was infected in September 2021. Another Belarusian civil society member, who requested anonymity, was targeted in March of that year in Vilnius.
Researchers did not publicly name a suspected customer but noted that various Baltic countries reportedly have access to Pegasus, including Latvia and Estonia. Russia, Belarus, and Lithuania have not been linked to Pegasus use.
To Krapiva, at Access Now, one reason behind the targeting could be keeping track of communities of exiled journalists. “A few of the victims in this report, from Russia and Belarus, are similar in that they are sort of pillars or hubs for their respective communities,” she said. They help organizations and independent media who are freshly exiled, she said. “So this could be a reason why their phones were hacked, because of their connections that they have with their phones, the conversations, the contacts.”
Another reason, she added, could be to seek out potential Russian spies or agents in Europe. Regardless, “we do think this is a disproportionate use of this powerful technology,” she added. “Hacking people’s entire phones and their entire digital lives being exposed in such a way is really not proportionate to what it looks like they are trying to do.”