On Sunday, a group of seventeen media organizations launched the Pegasus Project, a series of articles investigating the Israeli surveillance company NSO Group. The consortium of journalists, which works in conjunction with Amnesty International and the French nonprofit Forbidden Stories, found that dissidents, human-rights workers, and opposition politicians around the world have been tracked by an NSO Group spyware tool called Pegasus. Among the thousands of people targeted were reporters at the Times, political opponents of the Indian Prime Minister, Narendra Modi, and the two women closest to the murdered Saudi dissident Jamal Khashoggi.
One of the newspapers involved in the Pegasus Project is the Guardian. Its lead reporter on the series is Stephanie Kirchgaessner, who has written extensively about surveillance as the paper’s U.S. investigations correspondent. We spoke, by phone, on Monday morning, after the first wave of stories was released. (They will continue to be published throughout the week.) During our conversation, which has been edited for length and clarity, we discussed how the story came together, why the spyware industry remains so unregulated, and what role the Israeli government played in allowing this to happen.
The Guardian story that you published says very clearly that authoritarian governments were behind this surveillance. Some of the other stories, from other news organizations, say that the spyware was sold to authoritarian governments, but don’t actually say they know who used it. How certain are you that this is the work of governments specifically?
We do know that the NSO Group only sells to governments, and there has been a body of research before this project that has identified the countries that we believe are clients. Some countries deny that they are clients, but we have overwhelming evidence from groups like Citizen Lab. So we have known since 2016, for example, that the U.A.E. is a client of the NSO Group. Saudi Arabia, as well. And then there are other countries in our coverage this week. Rwanda adamantly denies that they are a client of the NSO Group, but we see Rwandans all over the world who are being targeted with this technology. So we feel comfortable naming those countries as clients.
The NSO Group saying that it only sells to governments puts the group into a logical pickle, because it implies that the governments are the ones doing the spying. But do we feel certain that the NSO Group is being honest about this, and really only does sell to governments?
I would say there is one anomaly, which is Mexico, where we think there were various actors who might have had access to the technology. [In a statement to The New Yorker, NSO Group said it exclusively licenses its technology to “vetted governments.”] And there are countries where there are various clients within the country. It is as if the F.B.I. were one client and the C.I.A. were another. I am not saying they specifically are—we have…