Library

EU action needed to tackle spyware abuses after Pegasus…

EU action needed to tackle spyware abuses after Pegasus revelations

As the European Parliament today debates the Pegasus spyware scandal, the undersigned partners of the Media Freedom Rapid Response (MFRR) call for an immediate investigation into the alleged use of the spyware against journalists by Hungarian authorities and urge the strong implementation of new EU rules on the export of cyber-surveillance technology around the world.

 

Revelations by the Pegasus Project that at least 180 journalists in 20 countries had their phones infected by the NSO Group’s spyware underscored the need for urgent action by the international community to tackle the unregulated spread of such technology and to create safeguards for the protection of human rights, including the freedom of the press.

Within the European Union, credible allegations indicate that Pegasus was illegally deployed by Hungarian intelligence or national security services in 2018 and 2019 against at least five journalists, including András Szabó and Szabolcs Panyi from Direkt36, one of Hungary’s last remaining independent media outlets. Fresh revelations surfaced last week when Hungarian media reported that Zoltán Páva, the publisher of the news portal Ezalenyeg.hu and former Member of the European Parliament, had been surveilled using Pegasus as recently as May this year.

Last week it was also revealed that the German Federal Criminal Police Office (BKA) secretly purchased the technology from NSO in 2019. In France, prosecutors are probing allegations that journalists from media outlets including Le Monde, Agence France-Presse and FRANCE 24 were surveilled by Moroccan intelligence services using Pegasus.

The failure to control the acquisition, trade and use of such intrusive technology inside the bloc means that the number of EU member states to have bought Pegasus or other similar cyber-surveillance technology remains unknown. Current estimations may represent the tip of the iceberg. This opacity poses significant threats to journalistic sources, privacy and safety, undermines media freedom and constitutes a clear failure by the EU to close the gaps in its regulatory framework.

As Parliament debates the matter, our organisations again urge the European Commission to conduct an independent and impartial investigation into alleged abuses by the Hungarian authorities against journalists and others. The Commission must establish the extent of Hungary’s use of Pegasus, identify what safeguards have been implemented and react to any abuses. Until such an investigation is carried out, the Pegasus revelations will continue to undermine journalists’ safety and have a chilling effect on what remains of independent media within the country. Robust and effective legal protection must be guaranteed within EU member states against unlawful surveillance by domestic intelligence, national security and law enforcement agencies to guard against human rights violations, including the right to freedom of expression and the right to privacy as protected under domestic, European and international law.

At the same time, the EU needs to protect journalists from illegal surveillance outside as well as inside its borders. Reports by NSO that suggest that EU member states Cyprus and Bulgaria granted export licenses for its technology are also deeply disturbing. While Cypriot authorities have denied to the Commission that it has any export links with NSO, the assurances remain unsatisfying. Meanwhile, the response from the Bulgarian authorities has yet to be disclosed. The Commission must renew its engagement with the relevant authorities in Sofia to seek immediate clarity. If confirmed, immediate action must be taken to revoke the export license and establish how and when it was granted.

EU member states themselves have a role to play. On September 9, after a decade of negotiation, new EU export controls came into force with the Recast Dual-Use Regulation, which among other things aims to strengthen controls on the international trade of so-called “dual-use” cyber-surveillance tools. The MFRR urges all 27 member states to swiftly implement this landmark regulation and to collaborate in a transparent manner with the Commission on the sharing of information involving the export of such surveillance tools from the customs union.

The subsequent annual report prepared by the Commission under this regulation should act as a much-needed tool for holding the national authorities authorising the sale of this technology to account. It will also lift the veil on the potential sale of spyware tools by commercial actors based in EU member states to authoritarian regimes around the world. For too long the industry has been able to escape proper oversight and regulation. The Commission should closely monitor and enforce states’ adherence to the new rules. Moving forward, more frequent compilation of information and updates about the buying and selling of advanced surveillance tools may be required to address a fast-changing market.

Despite the modest advances in rights protection in relation to the licensing of these technologies for export from the EU subsequent to the entry into force of the recast dual-use regulation, there evidently remains the need for an internationally applicable regulatory framework that can prevent, mitigate and redress the negative human rights impact of surveillance technology. Until this is in place, we continue to call for a global moratorium on the sale and transfer of spyware technology. The European Union should lead the way on pushing for international agreements on the freeze of sales of these cyberweapons around the world.

Signed by:

  • ARTICLE 19
  • European Centre for Press and Media Freedom (ECPMF)
  • European Federation of Journalists (EFJ)
  • Free Press Unlimited (FPU)
  • International Press Institute (IPI)
  • OBC Transeuropa (OBCT)
Library

Hungary: MFRR highly alarmed by Pegasus surveillance revelations

Hungary: MFRR highly alarmed by Pegasus surveillance revelations

The Media Freedom Rapid Response (MFRR) is highly alarmed by the revelations by a consortium led by French NGO Forbidden Stories about the surveillance of journalists, human rights defenders, lawyers and others through the Pegasus spyware program developed by Israeli company NSO Group. The leak, which revealed the involvement of the Hungarian government among others, raises significant implications for journalists’ security and the protection of their sources as well as raising concerns through the chilling effect such applications have on journalists beyond those immediately affected and ultimately, on everyone’s right to information.

We call on the Hungarian government and other implicated governments to immediately stop using the spyware and to provide transparency about its application so far. We also call on the NSO Group to take its corporate social responsibility more seriously and stop selling Pegasus to regimes with poor human rights and media freedom records, provide more transparency that will enable proper oversight and establish more stringent due diligence processes.

Forbidden Stories obtained leaked records of phone data, suggesting that various governments worldwide selected media workers, lawyers and activists as possible targets for invasive surveillance with the Pegasus spyware. The spyware has the potential to transform the targets’ phones into surveillance devices, allowing access to all data on the phone and enabling control over audio and video to make recordings surreptitiously. Inclusion of a phone number on the leaked list does not necessarily entail that the linked device was successfully hacked, but forensic analysis on dozens of phones so far effectively shows evidence of Pegasus activity in more than half of the cases. NSO Group has repeatedly said that its spyware, which they sold to some of the world’s most repressive regimes, is meant for use only against terrorists and serious criminals. Unsurprisingly, despite claims by NSO Group that they will cut off clients if they misuse the spyware, it appears that Pegasus has been used well beyond this stated intended target group by those clients, to potentially include anyone perceived as an opponent or threat to the regime.

In the European Union, forensic analysis of several devices has shown that the Hungarian government has deployed the spyware program against investigative journalists and the circle of one of the country’s last remaining independent media owners. At least five journalists figure in the leaked records and at least ten lawyers and an opposition politician. They include Szabolcs Panyi, a well-known reporter at investigative outlet Direkt36, who has been publicly attacked in the past by Prime Minister Viktor Orbán’s spokesperson Zoltán Kovács, who has accused him of “Orbánophobia”. Also analysis of his colleague András Szabó’s phone showed positive results for the use of Pegasus. Other Hungarian media workers selected for potential targeting include Dávid Dercényi, who edits a newspaper put out by the authority of an opposition-run district in Budapest; a photographer who worked as a fixer for visiting foreign journalists; and, a well-known investigative journalist. Furthermore, it appears also the circle of investor Zoltán Varga, who owns several independent media outlets and has been pressured in the past, was surveilled using the Pegasus software.

In a response quoted in The Guardian, the Hungarian government said that “state bodies authorised to use covert instruments are regularly monitored by governmental and non-governmental institutions.” The country has a very permissive legal framework for surveillance. In 2020, the justice minister approved 1,285 surveillance requests (not necessarily using Pegasus spyware).

The most recent revelations about Pegasus serve to highlight two things. On the one hand, they underscore the urgent need for meaningful reforms that will ensure powerful commercial technology is not abused by governments at the expense of civil liberties. They also show the essential role watchdog journalism plays in safeguarding the human rights that underpin democracy, by exposing violations and holding the perpetrators to account.

Signed by:

  • Article 19
  • European Centre for Press and Media Freedom (ECPMF)
  • European Federation of Journalists (EFJ)
  • Free Press Unlimited (FPU)
  • International Press Institute (IPI)
  • Osservatorio Balcani e Caucaso Transeuropa (OBCT)
Logo of Klubradio Library

IPI welcomes EU infringement proceedings against Hungary over silencing…

IPI welcomes EU infringement proceedings against Hungary over silencing of Klubrádió

The International Press Institute (IPI) today welcomed the long overdue launch of infringement proceedings by the European Commission against Hungary over the silencing of the country’s last remaining major independent radio station.

On Wednesday the Commission, the EU’s powerful executive body, announced that it would open the procedure against Budapest over a decision by the government-controlled Media Council to reject Klubrádió’s application to return to the radio waves.

“We welcome today’s announcement by the Commission, which confirms what IPI has long argued: the decision by the Hungarian Media Council to deny Klubrádió’s application was arbitrary, discriminatory and clearly intended to silence the station’s critical voice”, IPI Deputy Director Scott Griffen said. “IPI has long urged the Commission to take concrete steps to defend the rule of law and put a halt to the systematic and ongoing state-led erosion of media freedom and pluralism in Hungary over the last decade.

“While this is a significant step and while we hope this will ensure one of the country’s last remaining independent broadcasters is not silenced ahead of elections next year, infringement proceedings and sanctions on Budapest should have started years ago. Going forward, the case of Klubrádió demonstrates the clear need for an ambitious Media Freedom Act which will give the EU a stronger toolbox for intervening in politically motivated regulatory decisions and defending press freedom wherever it is threatened.”

Klubrádió was forced off air in February after the media regulator, which has long been filled with figures appointed by the ruling Fidesz party of Viktor Orbán, rejected the automatic extension for the renewal of its license for the 92.9 MHz frequency in Budapest.

In March, the Hungarian Media Council then rejected Klubrádió’s fresh application for the tender and ruled its bid invalid, blocking it from returning to the frequency it had broadcast on for two decades and muzzling one of the country’s last critical broadcasters.

IPI said the regulator’s decision-making panel had provided several groundless and discriminatory justifications for its judgment, in which it accused Klubrádió of “illegal management” and cited miniscule material programming errors and unjustified concerns over its business plan.

Announcing the infringement proceedings, the Commission said the decision by the Hungarian Media Council not to grant the license was made on “highly questionable grounds” and breached EU law on proportionality, transparency and non-discrimination.

It said Hungary violated EU telecoms rules regarding powers to grant, prolong, renew or revoke use of licenses on the radio spectrum, adding that it believed that the Hungarian national media law had been applied in a “discriminatory” manner.

EU Commissioner for Values on Transparency Vera Jourová said that the Commission had warned Hungarian authorities and urged them to find a solution so that Klubrádió could continue broadcasting, but that it had not received a satisfactory response. The Hungarian authorities now have two months to respond.

Meanwhile, Klubrádió remains in a legal battle with the Media Council over its decision, which the station appealed. In spite on the ongoing legal dispute, the Media Council allocated a six-month provisional license for the 92.9 MHz to Spirit FM, a broadcaster operated by a company affiliated with an evangelical church close to the ruling party. Klubrádió continues to broadcast online.