FRONTLINE

>> Pegasus... Pegasue... Pegasue... >> NARRATOR: In collaboration with Forbidden films, a two-part investigation... >> This story would be huge... >> NSO was established with an ambition to make the world a safer place... >> NARRATOR: Into powerful spyware... >> It is a military weapon used against civilians.

>> NARRATOR: Used around the world... >> There is no control over how countries use it, and they have been using it in the worst way you could imagine.

>> NARRATOR: Now on FRONTLINE part two of Global Spyware Scandal: Exposing Pegasus."

(sirens blaring in distance) >> When you have your hands on a technology like this, the power must be quite intoxicating.

You can get into the phone of most people in the world.

And no one's looking over your shoulder.

(distant siren blaring) >> LAURENT (speaking French): (multiple international journalists saying "Pegasus") >> It's like a person over your shoulder, a person who will see what you are seeing, a person who will watch what you are watching, your emails, your encrypted communication, everything.

So once you are infected, you're trapped.

>> It was against so many people in civil society who clearly were not terrorists or criminals.

And you got a real sense that it was a free-for-all.

>> De acuerdo con la pesquisa acabada por "The Washington Post," "The Guardian," "Le Monde" y otros medios... >> A joint investigation by 17 news outlets and Forbidden Stories... >> Activists, lawyers and journalists are reportedly among those who've been targeted by the phone spyware... >> Phone numbers belonging to some big name politicians.

>> (speaking Mandarin): >> NSO says they sell the software to governments for legitimate purposes, fighting terrorism or violating local laws.

>> You have here a go-to spy service for tyrants.

(distant traffic) (indistinct phone chatter) >> When we started analyzing the list, we saw a lot of French numbers.

More than 1,000 potentially targeted by Morocco.

There were journalists, lawyers, activists, but not only.

We also saw members of the French government, and the president, Macron, himself.

We immediately realized that this story would be huge.

(speaking French) >> Oh!

>> We knew politicians were on the list.

And to prove that they're... actually been infected with Pegasus, we needed their phones.

But politicians wouldn't hand you their phone that easily, specifically, if you're an investigative journalist.

>> LELOUP (speaking French): >> (conversing in French) >> Mm-hmm.

(makes explosion sound) >> LELOUP: (train announcer speaking French) >> UNTERSINGER (speaking French): >> LELOUP: >> We don't know exactly who in Morocco was using Pegasus.

There were Moroccan dissidents on the list, even the king of Morocco himself was on the list.

But we do know that NSO only sells to governments and government agencies.

We were reaching out to another dimension of the project.

We were at this stage entering a space, a dangerous space, where we were talking about a country, a state, attacking another one.

>> Each time you look at how a client of NSO Group used the technology, it tells you something about that government.

In the UAE, Sheikh Mohammed bin Rashid Al Maktoum is prime minister, vice president and, of course, the ruler of Dubai.

Here is an autocratic leader.

Massively powerful.

Princess Latifa is the daughter of Sheikh Mohammed.

She had for a long time been, by her account, unhappy about her life in Dubai.

She had been... incarcerated, effectively, by her father's regime.

>> I'm making this video because it could be the last video I make, yeah.

(sighs) This video can help me because all my father cares about is his reputation.

He will kill people to protect his own reputation.

He, he only cares about himself and his ego.

The Princess Latifa concocted this extraordinary attempted escape that involved jet skis, a yacht, and a trip to the Indian Ocean.

I mean, it's an audacious thing to do.

Incredible, even, that she attempted it.

I think remarkable that it nearly succeeded.

The day after Princess Latifa went missing from Dubai, we saw her number entered in the list.

And in the days after that, as she was traveling toward India on this yacht, her friends, people she knew, people within her orbit, their phone numbers also appeared on the list.

If you look at the dates and times that her number and those of people close to her were entered into the system, you have something that has to be more than a coincidence.

Eight days after her escape, Indian special forces boarded the yacht, and then the princess was forcibly returned to Dubai.

We don't know exactly why the attempted escape didn't succeed, but NSO's technology was, it seems, from the evidence we've seen, one of the tools that was being used by the state in a desperate attempt to find Princess Latifa, kidnap her, and return her back to Dubai.

We tried hard to get hold of a phone Latifa had used but we couldn't.

So we contacted her friends and her associates to ask if we could check their phones to see if they'd been targeted with Pegasus.

Given how much David Haigh was working on the Latifa case, it wasn't a surprise when we discovered that there was Pegasus activity on his phone.

>> I was infected on 3rd of August 2020 with Pegasus, I believe at 3:00 a.m. in the morning and the next day as well.

The fact that you can be hacked... on British soil, and that they can do that, it's, it's frightening.

It really is.

(waves crashing) My name is David Haigh, from Detained International.

We founded the campaign to free the Dubai princess, Princess Latifa, in 2018.

>> David Haigh was actually imprisoned in Dubai for alleged fraud, and it was after his release that he became a human rights campaigner.

Princess Latifa began to message him after her failed attempt at escape.

>> This is a picture that Latifa drew of the jail villa, Villa 96 in Jumeirah, Dubai, near the Burj al-Arab.

Um, and you can see here, "beach in this direction" where she was held captive.

>> (on laptop): This villa has been converted into a jail.

All the windows are barred shut, I can't open any window.

Uh, there's five policemen outside, and two policemen inside the house.

I don't know what can happen to me and how long this will last and if they decide to release me, like, how my life will be?

But, um, I'm not safe at all.

>> That week before I was hacked, our secret contact with Latifa had stopped suddenly.

The seven hours became a day and then two days.

And then we start to worry because that was not normal.

We had recorded a lot of videos and a lot of evidence Latifa had that could be used to tell the world about her predicament, the fact she'd been held hostage.

At the time I was hacked, we were in London with the videos that Latifa recorded, the evidence, to meet media to decide if we were going to use it at that time or not.

It was effectively dynamite evidence on that phone.

The fact that they know your location... ...someone could be listening to us now, and seeing what we're doing.

And it's that, sitting in the back of your head every day.

We can't let NSO and the governments that abuse their system, get away with what they've done.

Because if we do, and if nothing happens, and people are not brought to justice, people are not put in jail and people are not taken to court, the next company and the next company, and the next company, wherever they may be, will do exactly the same.

And it will just carry on, but get worse.

(brakes screeching) >> AMITAI (speaking Hebrew): >> (voice distorted): Israel has this advantage of not only developing new technologies and weaponry, but testing it live.

And this is something Israel knows it can use to sell outside.

When you want to control a huge population like we do with Palestinians, you have to have assets everywhere.

So everyone can be a target, because you don't want only the, I don't know, terrorist from the Hamas, but also maybe his neighbor or the... his cousin, or the person who sells milk in the corner of the street.

If you want to recruit human agents, you need to collect their weaknesses, things that you can use to blackmail.

And so part of what 8200 does is to collect this blackmail, potential information about everybody.

If you're gay, or if you have medical, a special medical condition, or you have financial problems, or someone from your family has one of those, then that's something we can use against you to blackmail you and get you to cooperate.

>> Israeli intelligence has a strategic view of how their employees should be used after they leave their employ.

They promote them.

They want them to start these companies.

And they see a deep communications, a continued relationship between the government and their former employees as valuable to Israel's national security interest.

(siren blaring) >> There's a lot of evidence to suggest that NSO Group had the direct backing in support of Bibi Netanyahu's government.

In order to sell its product to governments around the world, it required permits, effectively licenses from the Israeli Defense Ministry.

>> I decided several years ago to turn Israel into one of the five cyber powers of the world.

In order for the companies to develop, they need to make-- what do they need to make?

>> (distant): Money.

>> Money!

They need to make money.

Now the easiest way to make sure that they don't make money is one, high taxes, right?

What's the other one?

Regulations!

Have you ever heard of regulations?

We have a problem with regulations.

So the policy we have is keep taxes low and keep regulations low.

Minimize regulations.

There is no industry more susceptible and more inviting of regulations than cybersecurity.

It's like weapons-- it is a weapon.

>> (speaking Hebrew) The timeline for Hungary is that the visit was in July 2017, and the operation of Hungary, we know almost the exact date by the database of Forbidden Stories.

It's February 2018.

So, similarities.

(speaking Hebrew) (audience applauds) >> Going through all the numbers on the list was a huge job.

More than 15,000 of the numbers were in Mexico.

And one of those numbers belonged to a journalist who was murdered just weeks after he was put on the list.

Was Pegasus used in that case to spy on a journalist, or to geolocate him?

>> Sabes que Cecilio Pineda es tambin en la lista?

>> S, el que fue asesinado?

>> S, es en la lista, s.

>> Uf, qu fuerte.

En Mxico es muy grave que se haya usado Pegasus como se us.

Me remito al caso de Cecilio Pineda.

Y The Pegasus Project lo mostr pblicamente que su telfono fue ingresado, das antes o semanas antes de haber sido cometido al asesinato.

El estado de Guerrero es una de las entidades ms impactadas por el crimen organizado.

Hay lugares en donde literalmente el estado ya no tiene dominio.

Las autoridades en realidad estn pues mezcladas con el crimen organizado y hay pues actividad del narcotrfico, hay actividad diversa, delincuencial.

(dog barking) >> De acuerdo con el reporte de la polica varios sujetos armados llegaron a un autolavado donde el periodista Cecilio Pineda esperaba que le entregaran su camioneta y le dispararon.

(dog barking) >> No me sorprende que Cecilio Pineda estuviera en esa lista porque el tema que se estaba tocando era serio.

>> Pues calentando, ya estamos cansados de violencia.

Pero nadie, eh, tiene segura su vida.

La mera verdad, vivimos en una regin donde estamos solos.

En una regin en donde todas las autoridades pues no te... no te apoyan.

Y aqu uno tiene que defenderse con sus propias uas.

Mm.

Buenas tardes, amigos de Tierra Caliente, pues aqu ya de regreso despus de estar en dos municipios de la regin y pues nos encontramos con esto.

>> Cecilio haba hecho un video.

Vena en camino y quiso dar un mensaje anticipado de lo que iba a presentar despus.

l dijo que unas horas despus iba a mostrar el video de la relacin que haba entre el gobierno del Estado y el grupo del Tequilero.

Despus de eso ya no present nada, a l lo asesinaron.

>> Ese da, este... Y al llegar a la clnica, este, yo quise pasar a verlo.

Entonces me dice la seorita, dice: < No, lo estn atendiendo >.

Entonces yo pens pues que iba a estar bien.

Dije, no, pues nada ms fue, pues algo...

Ya como a los tres minutos sale el doctor, dice, < No >, dice, < pues ya... ya falleci >.

Y es la nica vez en mi vida que me he desmayado.

Cuando volv, pues estaba toda aturdida.

Dije, pues no saba que... Y pues ya, fue cuando me volvi a decir pues que haba fallecido Que, este... Que ya haba llegado prcticamente casi muerto pues.

>> You can only prove infection if you do forensics on the phone and find traces of Pegasus, but in many cases, the phone was not findable.

That was the case of Cecilio Pineda.

>> No se puede afirmar categricamente que lo que se obtuvo de el posible espionaje haya sido lo que provoc el asesinato.

Pero tampoco podemos ser ingenuos.

(bird caws) >> We were able to set up a date where we all agreed that will be the day of the publication.

In 2021, July 18.

And we knew that the most dangerous phase was those two weeks before the publication, when you knock on the door of the NSO group to say "We are Forbidden Stories, we are 80 reporters, we investigate your businesses and we have evidence of a global misuse that is threatening democracy.

(speaking French) They can come blackmail the source, they can hack me, one of the person of the team, they can follow us.

They can come into our offices.

>> By now the members of the consortium had managed to do forensics on over 60 phones connected to numbers on the list, and we had forensic proof that at least 37 phones had been targeted or infected with Pegasus.

The more publication day was approaching, the more paranoid we all became.

Before publication we already had that habit to switching off the phones or even our computers before having any conversation about the investigation, so most of the day were living and working without our phones, or even our computers.

So we had different ways of working, we had other devices we could work on.

>> LAURENT: I remember that day clicking on the button "send."

I was sending the official request for comment from the 80 reporters with dozens of questions inside.

We were giving a deadline to the NSO group, and to all the state actors.

And we were expecting some answers.

(phone beeps) >> (on phone): Hello?

>> This is Laurent Richard from Forbidden Stories.

How are you doing?

>> (on phone): Yeah, I am good.

>> Yeah, thank you for taking the time to answer.

I was just wondering if you, um, are planning to answer our questions.

>> (on phone): Well, you can see it in your email now.

Yes?

>> Okay, I see it.

>> Thank you.

>> Okay, thank you, bye.

>> Bye.

(phone beeps) >> Okay.

What we got is an email from the NSO Group, saying that, "All you think is wrong, thank you, best regards."

"NSO Group firmly denies false claims made in your report which many of them are uncorroborated theories "that raise serious doubts about the reliability of your sources, as well as the basis of your story."

>> But then, when I woke up in the next morning, I opened my phone.

And I saw that NSO sent letters from lawyers to most of the partners at the same time, on all continents, to threaten them, and to tell them that if you publish anything, we will sue you.

>> It's a bit tense here, if I'm honest.

>> Yeah?

>> Yeah.

Um, we've had a provisional response from NSO to "The Washington Post," um, and we will have the formal, another response from them to us in about... 15, 20 minutes.

So we're gonna keep this call really quick.

(voiceover): Um, the stakes are really high when you do this kind of reporting.

Here was a company valued at over a billion dollars.

And the NSO Group and its clients, these governments, were not going to put their hands up and confess to this activity.

They were fighting as hard as they possibly could.

All going well if we're proceeding with this project.

I think the crunch point, really, is going to be in the next 12 hours.

>> In the sense of, if we are proceeding, Paul?

>> Yeah.

>> Is that in doubt?

Well, it's always-- it's never confirmed, until it's confirmed, right?

(typing on keyboard) (computer chimes) We can confirm at least-- (speaking French): (door beeps) >> ELODIE (speaking French): >> (on phone): So Paul, just to be 100% clear, you guys are ready to hit the button on a version of the story in 42 minutes?

>> Of the heads of states story.

>> Heads of state only.

>> We're not ready now, but in 42 minutes we will be ready.

(laughs) >> Here we were simultaneously publishing 17 different media outlets all over the world in several different languages, all at the same time, at the same minute, the same day after months of investigating.

>> The investigation into the NSO... >> (speaking French) >> That's okay... >> (speaking French) >> We've done it.

>> A tiff!

(chattering in French) >> So the story is now live.

>> An explosive investigation from the "Washington Post," and a consortium of media partners.

>> Activists, lawyers, and journalists... (overlapping news reports in multiple languages) >> De la utilizacin de Pegasus en el mundo.

>> (speaking French) >> (speaking French) >> What can be done to protect our country from commercial spyware?

The kind of threat that is now being reported at the top of the news across the nation.

>> There had been reporters who've been doing stories on Pegasus for years.

This sort of tipped the scale, because it was in so many countries, it was against so many people in civil society who clearly were not terrorists or criminals.

And you got a real sense that it was an... it was a free-for-all.

We even found out afterwards that the FBI considered using a version of Pegasus that could hack into US phones.

But that fell apart and the Biden administration actually blacklisted NSO Group.

They've made a bigger deal than I would have expected against not just an Israeli company, but really they're criticizing the Israeli government for allowing this to happen, because it actually could not happen without the Israeli government's permission.

>> You have here a go-to spy service for tyrants.

What the executives of these companies and the engineers are hoping for most is to make a whole lot of money, and do it in a way where there's minimal regulation and minimal oversight.

>> A U.S. appeals court is allowing WhatsApp messaging service to move forward with a lawsuit against NSO group over allegedly targeting... >> Silicon valley has a big role to play.

Company like WhatsApp, company like Apple, they are suing NSO.

They are the ones with money.

They are the ones who promise you safety and security.

>> All we've seen NSO Group is deny, deny, deny.

And that's showed up entirely through the legal process as well.

The way I think about it is tech companies can and should do everything they can to make their software as secure as possible.

But at the end of the day, if there's no consequences for people who try to break that software to commit human rights abuses, then there will always be people trying to do it.

It's just like the only solution to stopping bank robbery is not to have the best technology in banks.

Yes, you do that too.

It's also that bank robbers get caught and have consequences for trying to rob banks.

And we need that for the spyware industry.

>> Pegasus spyware is once again back in the spotlight.

This time for targeting pro-independence supporters in Spain... >> Several members of Poland's opposition have produced evidence they were hacked by Pegasus software... >> This scandal is being dubbed the Polish Watergate.

>> In Europe, we were discovering new victims of the spyware, and new countries were accused of using Pegasus to spy on their opponents.

At the European parliament, representatives from NSO agreed to answer questions from politicians.

It was the first time they'd done this.

>> (speaking German): We know that NSO is now on the market.

So maybe they are trying to polish their image.

That would be interesting to see.

(indistinct chatter) (chiming) >> Thank you, Mr. Chairman.

On behalf of NSO, I want to thank the members of the committee of inquiry for having us here today.

Before we begin we should note there are limits to the information we can share with the committee and others.

As you know, NSO is a private company providing export-controlled cyber intelligence technologies only and exclusive to government agencies for the purpose of preventing and investigating terrorism and other serious crimes.

As a result, we are unable to share details about our customers, as well as the crimes prevented and criminals tracked and apprehended using our technologies or trade secrets of the technology.

It is not true that NSO group operates Pegasus and collects information about individuals.

It is not true that NSO Group sells its technology to private companies.

The issues that came up about Jamal Khashoggi, about President Macron, the system was not used on those numbers.

>> I will go immediately into the Q&A session of today's meeting, we already have 15 members who have asked for the floor.

>> Have you ever terminated a contract with an EU member state?

>> We have terminated a contract with EU member states, but to get into, again, the exact numbers... >> That's fine, thank you-- next question.

If a country does not give you a permission to audit, is that a reason for you to terminate a contract?

Yes or no?

>> As stated before, if they do not allow us to do the audit and do not participate and provide us with information needed in our investigation, yes, that is a reason to terminate a contract.

I can state that we've terminated eight customers over the past several years.

>> Have the United Arab Emirates and Saudi Arabia ever gone through your due diligence check and have they passed it?

(person coughs) >> As I said, I'm not going to respond to questions regarding specific potential customers.

>> Given that UAE and Saudi Arabia have been using Pegasus software, who are legitimate actors to issue warrants in these countries according to your checks?

>> Again, I repeat it again, I'm not going to respond to questions regarding specific customers.

>> (speaking Polish) >> I cannot and again, I repeat, I cannot because of various confidentiality and secrecy issues, I cannot get into specific questions regarding specific customers or specific cases.

>> (speaking Hungarian): >> First of all, every customer that we sell to goes through the due diligence review in advance, and if, and very often if the concerns are raised regarding the rule of law-- 'cause what we're looking at is also the rule of law.

And any country that we've decided to sell to has been approved in this manner.

>> Please, stop the, stop the storytelling.

I'm going to continue in Hungarian.

(speaking Hungarian): >> (quietly): Good question.

>> Again, as I said, >> Not "again," it was a new question, so please.

>> (clears throat) I have not said... we have not said that we have determined recently that Hungary is or is not a secure country.

>> You did consider it secure because you sold the stuff to them!

>> Excuse me, colleague... >> I said, now we will, >> Let's keep a little bit of order in the meeting as well.

I understand there is frustration, but you have the concrete question, we have a concrete answer, and, uh, please.

>> You keep repeating the same thing, and there seems to be a complete disconnect between reality and between what you're saying.

This is like, you know, it's an insult to our intelligence, sorry.

(horn honks) >> (speaking Hebrew) >> (speaking Hebrew): >> AMARAI (speaking Hebrew): (indistinct chatter) >> (speaking Hebrew): >> The bottom line is nobody regulates these companies.

That's the bottom line.

Technology is just so far ahead of government regulation and even of public understanding of what's happening out there.

>> It's a wild west.

And this is where we are when you have a private security company meeting state actors with no regulation in the cyber civilian space, and when it's possible to use military weapons against civilians.

>> In some ways, we can talk about the impact on the company and say it's been really profound.

A more pessimistic view would be to look at the entire industry, which remains unreformed, pretty wild, unregulated... and NSO may vanish.

But I feel no more secure talking in front of my phone now than I did when we first published.

You know, I don't think these issues have gone away.

>> Go to pbs.org/frontline for a Q&A with the journalists at Forbidden Stories who led the Pegasus investigation.

>> And once on the phone it can extract and access everything from the device.

>> Everything, so once you are infected, you're trapped.

>> And an archive of stories with our reporting partners on the Pegasus project.

Connect with FRONTLINE on Facebook, Instagram and Twitter, and stream anytime on the PBS App, YouTube or pbs.org/frontline.

Captioned by Media Access Group at WGBH access.wgbh.org.

>> For more on this and other Frontline programs visit our website at pbs.org/frontline.

Frontline's "Global Spyware Scandal: Exposing Pegasus" is available on Amazon Prime Video.