Around the world in (at least) eight court cases involving Pegasus and the press

A year ago this week, I wrote in this newsletter about a story that had recently appeared in Calcalist, a business newspaper in Israel. The story alleged that police in the country used Pegasus—a highly invasive, and terrifyingly discreet, spyware tool made by NSO Group, an Israeli firm—to warrantlessly surveil the cellphones of political figures including protesters, journalists, and press aides and relatives of Benjamin Netanyahu, the former (and, it would turn out, future) prime minister. Two weeks later, I appended an update to my newsletter: Israel’s justice ministry had just dismantled Calcalist’s reporting, claiming, on the basis of its own investigation, that Israeli police had not surveilled the vast majority of supposed targets named by Calcalist, and that it had targeted the remaining few with judicial approval. Calcalist said that it would review its reporting but stood by one core finding: police had surveilled Israeli civilians.

A few months earlier, the Pegasus Project, a journalistic collaboration led by the Paris-based group Forbidden Stories, had reported on a leaked list of fifty thousand phone numbers that government clients of NSO had selected for possible surveillance—at least some of which, including numbers belonging to journalists in twenty countries, were definitely hacked. The project kicked off a major global scandal that, among other things, saw the Biden administration place NSO Group on a trade blacklist (even though, as the New York Times reported a few weeks later, the FBI had itself purchased a version of Pegasus before deciding not to use it). Even in the short gap between my newsletter on the Calcalist story and my update to that newsletter, Pegasus made unrelated headlines around the world: European Union data officials called for the tool to be banned in the bloc; an investigation found that a journalist and two activists had been hacked in Bahrain. In the year since I wrote about the Calcalist affair, further Pegasus hacks have been confirmed in Jordan, Mexico, and Spain, where senior government ministers said they were targeted. The Spanish government was itself accused of hacking politicians in the autonomous region of Catalonia. Ronan Farrow wrote about Pegasus for The New Yorker. The leaders of the Pegasus Project wrote a book about it.

As well as being in the news a lot, NSO has been in court a lot in the past year. NSO itself sued Calcalist for defamation. And NSO has found itself on the receiving end of a number of high-profile court cases or judicial investigations, at least two of which—in the UK and Spain—kicked off in recent months. Several cases against NSO have been filed in the US, and there, too, there has been significant recent movement. Apple and WhatsApp, whose products have been compromised by Pegasus, are both suing NSO; last month, the Supreme Court effectively ruled that the latter case can proceed, tossing out NSO’s claim that it is an agent of a foreign government and thus immune from US prosecution. Late last year, the wife of the murdered Saudi journalist Jamal Khashoggi, who was herself hacked with Pegasus prior to Khashoggi’s death, said that she plans to sue NSO in a US court, alongside the governments of Saudi Arabia and the United Arab Emirates, which she holds responsible for the hack. Then, shortly before Christmas, fifteen staffers at El Faro, a news site in El Salvador, filed suit in a federal court in California—the first such case brought by journalists against NSO in the US.

Last week, the Knight First Amendment Institute at Columbia University, which brought the NSO suit on behalf of the El Faro journalists, convened a discussion of the case and the broader threat that spyware poses to the press, with panelists including Farrow and Carlos Dada, the cofounder and director of El Faro. The El Faro staffers discovered that they’d been hacked in 2021, after working with groups including Citizen Lab, a research center at the University of Toronto that analyzed the staffers’ devices, and Amnesty International, which verified the findings. (These groups, among others, have been involved in many of the revelations about Pegasus; NSO has claimed that their findings are unreliable.) The journalists believe, based on the pattern of the hacks, that they were targeted by the increasingly repressive regime of Nayib Bukele, the Salvadoran president. (El Salvador has denied being a client of NSO’s.) Last year, El Faro published a story about the hacks. It wasn’t until after that, Dada recalled at the Knight event, that the personal cost sunk in. “I felt so invaded that I went to take a shower,” he said.

Carrie DeCell, ​​a senior staff attorney at the Knight Institute, explained at the event that the group brought El Faro’s case in a US court because NSO offers its clients the ability to exploit vulnerabilities in US tech companies’ software and services; the institute has also noted that El Faro is widely read in the US and that one of the journalists who was targeted is a US citizen. DeCell hopes that the case will have a “significant deterrent effect” by showing NSO that its global sales are subject to US legal liability. NSO has long argued that it has no visibility into what its clients do with Pegasus, but it has also claimed that it’s careful to only sell to governments that use it for legitimate law-enforcement purposes, and that it has implemented new oversight measures—a “very basic inconsistency,” Farrow noted at the event. NSO has likened itself to an arms manufacturer, Farrow added, and has argued that if the product it’s selling isn’t regulated internationally, then that’s not the company’s fault. Case law is one way of achieving a degree of regulation, Farrow said, pointing to precedents involving the oil, tobacco, and opioid industries.

The US legal cases against NSO are still in their early stages; the company will surely try again to have them dismissed, and, even if it fails, the cases will likely move slowly through the courts. In the meantime, panelists at Knight’s event stressed that a coalition of other civil-society actors—not only journalists, but activists and academics—will have to continue to fight to hold NSO and other spyware makers accountable. But at some point, as super-invasive spyware continues to proliferate around the world, we’ll need a formal international framework of regulation to, at the very least, monitor and sanction abuses, including against members of the press. The US would likely be a prime mover in any such framework, and has already blacklisted Pegasus and at least one other Israeli spyware maker. Farrow said at the event, however, that he fears that the US will only engage with comprehensive international regulation of such tools when one triggers a major enough scandal on US soil to counteract the pro-spyware arguments of the security community.

As Farrow and other panelists noted—and as the Times reported in some depth recently—the problem of unregulated spyware cuts much deeper than Pegasus. Indeed, with NSO blacklisted in the US and having increasingly pivoted its under-fire business toward clients in Western Europe, other firms have stepped into “the void”; last year, for instance, Predator, a spyware tool developed by a former Israeli general based in Greece, sparked a scandal in the latter country after it was used to surveil a journalist and opposition politicians. Despite blacklisting Pegasus, meanwhile, the US Drug Enforcement Administration is using spyware from another Israeli firm. When it comes to spyware, the US has “played both arsonist and firefighter,” the Times noted.

If the Pegasus and broader spyware stories are increasingly global, they still have deep roots in Israel, and have continued to play out there since the Calcalist episode a year ago. In August, the country’s justice ministry issued its final report into the matter; it reiterated the ministry’s prior conclusions that Calcalist’s initial reporting was greatly overblown, though, as Yuval Shany, a law professor, has written, the report also “confirmed some important parts of the Calcalist story: most significantly, that [Israeli police] uses NSO spyware against Israelis without a clear legal basis.” The Calcalist story may ultimately have fizzled out, but it nonetheless raised important questions within the Israeli legal establishment, Shany wrote, “about the proper reaction to new privacy-infringing technology in an age of legal stagnation—where the political stalemate in Israel renders it difficult to update privacy and surveillance laws.”

A year ago, thanks to the Calcalist story, Pegasus was dragged into that political stalemate, and into yet another court case: after the paper reported that a witness in a long-running corruption case against Netanyahu—a case that has, to a significant extent, restructured Israeli politics—was among those surveilled using Pegasus, Netanyahu’s allies called for the case to be thrown out, characterizing it as a witch hunt against him. Paradoxically, the Times has reported that Netanyahu, as prime minister, juiced sales of Pegasus, which have to be licensed by the Israeli government, to gain diplomatic leverage abroad. Last year, the Financial Times reported that NSO was banking on Netanyahu returning to power to boost its ailing business—including, perhaps, in Saudi Arabia—with its cofounder reportedly telling associates, “Don’t worry, Netanyahu is coming back.” (Netanyahu and NSO have denied these respective stories.)

In December, Netanyahu did return as prime minister. So far, spyware has not been a driving storyline of his new, far-right administration, which is prioritizing widely criticized judicial reforms. But press freedom has been on the agenda. Last month, a Netanyahu-allied lawmaker—himself a former journalist—proposed a bill that would bar the publication of recordings that feature “sensitive information” about a person without their explicit consent. Journalists from across the political spectrum condemned the bill as a violation of the media’s ability to expose wrongdoing, but the lawmaker denied that this was his rationale. “The technological ability to record conversations should be primarily used to preserve information for private purposes,” he said.

Other notable stories:

• On Thursday, in response to a request from a coalition of news organizations, a judge in Fulton County, Georgia, will publish parts of a report compiled by a special grand jury that has been investigating the legality of Donald Trump’s efforts to overturn the results of the 2020 election in the state. The judge “said that the special grand jury’s introduction and conclusion as well as concerns the panel had about witnesses lying under oath” can be published, CNN reports—though some of that information may be redacted, and other parts of the report, including charging recommendations, will remain withheld.
• NPR’s David Folkenflik investigated a pattern of political pressure at West Virginia Public Broadcasting after Amelia Ferrell Knisely, a reporter at the station, was let go following a series of stories alleging the abuse of people with disabilities in state facilities. “Since 2017, politicians have sought to eliminate state funding” for WVPB, per Folkenflik. “The governor appointed partisans hostile to public broadcasting to key oversight positions. And the station’s chief executive has intervened repeatedly in journalistic decisions.”
• In media-jobs news, Yamiche Alcindor will step down as the moderator of Washington Week, on PBS, to focus on a memoir and her work for NBC News. Elsewhere, Darren Samuelsohn, who was ousted as DC bureau chief at Insider last year, is launching a Substack called love, journalism (just in time for Valentine’s Day). And Nicholas Schmidle, of The New Yorker, is writing a musical with the guitarist Jon Gutwillig.
• Recently, the theater magazine Playbill published a story about a rising trend of audience members behaving poorly toward theater workers. The story was widely shared, but it soon disappeared from Playbill’s website. Now Lachlan Cartwright reports, for the Daily Beast, that Philip Birsh, Playbill’s CEO, ordered the article removed. “We want people to go to the theater,” Birsh said. “This piece exaggerated the issue.”
• And in Germany, Marco Goecke, the director of a prestigious ballet company, reportedly confronted Wiebke Hüster, a critic for the newspaper Frankfurter Allgemeine Zeitung, and smeared dog excrement in her face. Goecke was suspended from his role and is now under police investigation. Hüster had recently written that one of Goecke’s shows left her alternating “between a state of feeling insane and being killed by boredom.”

ICYMI: The Uncertainty Files