Skip to main content

What is in the Pegasus project data?

Quick Guide

What is in the Pegasus project data?

What is in the data leak?

The data leak is a list of more than 50,000 phone numbers that, since 2016, are believed to have been selected as those of people of interest by government clients of NSO Group, which sells surveillance software. The data also contains the time and date that numbers were selected, or entered on to a system. Forbidden Stories, a Paris-based nonprofit journalism organisation, and Amnesty International initially had access to the list and shared access with 16 media organisations including the Guardian. More than 80 journalists have worked together over several months as part of the Pegasus project. Amnesty’s Security Lab, a technical partner on the project, did the forensic analyses.

What does the leak indicate?

The consortium believes the data indicates the potential targets NSO’s government clients identified in advance of possible surveillance. While the data is an indication of intent, the presence of a number in the data does not reveal whether there was an attempt to infect the phone with spyware such as Pegasus, the company’s signature surveillance tool, or whether any attempt succeeded. The presence in the data of a very small number of landlines and US numbers, which NSO says are “technically impossible” to access with its tools, reveals some targets were selected by NSO clients even though they could not be infected with Pegasus. However, forensic examinations of a small sample of mobile phones with numbers on the list found tight correlations between the time and date of a number in the data and the start of Pegasus activity – in some cases as little as a few seconds.

What did forensic analysis reveal?

Amnesty examined 67 smartphones where attacks were suspected. Of those, 23 were successfully infected and 14 showed signs of attempted penetration. For the remaining 30, the tests were inconclusive, in several cases because the handsets had been replaced. Fifteen of the phones were Android devices, none of which showed evidence of successful infection. However, unlike iPhones, phones that use Android do not log the kinds of information required for Amnesty’s detective work. Three Android phones showed signs of targeting, such as Pegasus-linked SMS messages.

Amnesty shared “backup copies” of four iPhones with Citizen Lab, a research group at the University of Toronto that specialises in studying Pegasus, which confirmed that they showed signs of Pegasus infection. Citizen Lab also conducted a peer review of Amnesty’s forensic methods, and found them to be sound.

Which NSO clients were selecting numbers?

While the data is organised into clusters, indicative of individual NSO clients, it does not say which NSO client was responsible for selecting any given number. NSO claims to sell its tools to 60 clients in 40 countries, but refuses to identify them. By closely examining the pattern of targeting by individual clients in the leaked data, media partners were able to identify 10 governments believed to be responsible for selecting the targets: Azerbaijan, Bahrain, Kazakhstan, Mexico, Morocco, Rwanda, Saudi Arabia, Hungary, India, and the United Arab Emirates. Citizen Lab has also found evidence of all 10 being clients of NSO.

What does NSO Group say?

You can read NSO Group’s full statement here. The company has always said it does not have access to the data of its customers’ targets. Through its lawyers, NSO said the consortium had made “incorrect assumptions” about which clients use the company’s technology. It said the 50,000 number was “exaggerated” and the list could not be a list of numbers “targeted by governments using Pegasus”. The lawyers said NSO had reason to believe the list accessed by the consortium “is not a list of numbers targeted by governments using Pegasus, but instead, may be part of a larger list of numbers that might have been used by NSO Group customers for other purposes”. After further questions, the lawyers said the consortium was basing its findings “on misleading interpretation of leaked data from accessible and overt basic information, such as HLR Lookup services, which have no bearing on the list of the customers' targets of Pegasus or any other NSO products ... we still do not see any correlation of these lists to anything related to use of NSO Group technologies”.

What is HLR lookup data?

The term HLR, or home location register, refers to a database that is essential to operating mobile phone networks. Such registers keep records on the networks of phone users and their general locations, along with other identifying information that is used routinely in routing calls and texts. Telecoms and surveillance experts say HLR data can sometimes be used in the early phase of a surveillance attempt, when identifying whether it is possible to connect to a phone. The consortium understands NSO clients have the capability through an interface on the Pegasus system to conduct HLR lookup inquiries. It is unclear whether Pegasus operators are required to conduct HRL lookup inquiries via its interface to use its software; an NSO source stressed its clients may have different reasons – unrelated to Pegasus – for conducting HLR lookups via an NSO system.

Comments

Popular posts from this blog

Menon meets Karzai, discusses security of Indians

Kabul/New Delhi/Washington, March 5 (IANS) India Friday said that the Feb 26 terror attack in Kabul will not deter it from helping rebuild Afghanistan as National Security Adviser Shivshankar Menon met Afghan President Hamid Karzai in Kabul to review the security of around 4,000 Indians working in that country. Menon, who arrived here Friday morning on a two-day visit, discussed with Karzai some proposals to bolster security of Indians engaged in a wide array of reconstruction activities, ranging from building roads, bridges and power stations to social sector projects. The Indian government is contemplating a slew of steps to secure Indians in Afghanistan, including setting up protected venues where the Indians working on various reconstruction projects will be based. Deploying dedicated security personnel at places where Indians work is also being considered. Menon also met his Afghan counterpart Rangin Dadfar Spanta and enquired about the progress in the probe into the Kabul atta

Iran is losing the game to regional actors in its strategic depth

Rethink before It’s Too Late http://www.irdiplomacy.ir/index.php?Lang=en&Page=21&TypeId=15&ArticleId=7108&BranchId=19&Action=ArticleBodyView Iran is losing the game to regional actors in its strategic depth –Afghanistan. By Houman Dolati It is no more a surprise to see Iran absent in Afghanistan affairs. Nowadays, the Bonn Conference and Iran’s contributions to Afghanistan look more like a fading memory. Iran, which had promised of loans and credit worth five-hundred million dollars for Afghanistan, and tried to serve a key role, more than many other countries, for reconstruction and stabilization of Afghanistan, is now trying to efface that memory, saying it is a wrong path, even for the international community. Iran’s empty seat in the Rome Conference was another step backward for Afghanistan’s influential neighbor. Many other countries were surprised with Iran’s absence. Finding out the vanity of its efforts to justify absence in Rome, Iran tried to start its

Pakistani firm whose chemicals were used to kill US troops seeks subsidy for Indiana plant

By Jennifer Griffin, Justin Fishel Published March 22, 2013   A Pakistani fertilizer maker whose chemicals have been used in 80 percent of the roadside bombs that have killed and maimed American troops in Afghanistan is now seeking U.S. taxpayer subsidies in order to open a factory in Indiana.  The request appears to be on hold pending further review, but the situation has stirred outrage in Congress, where some accuse the Pakistani government of halting efforts to clamp down on the bomb-making.  For the past seven years, the U.S. government has known that the raw material calcium ammonium nitrate, or CAN, is making its way across the border into Afghanistan where the Taliban use it to fuel their most deadly weapons, namely the improvised explosive device. IEDs have long been the number one killer of U.S. and coalition troops.  The material largely comes from Pakistani fertilizer maker the Fatima Group. But the Pakistani government has stymied attempts by the Pentagon to stop the