The manufacturer of the spyware, NSO Group, claims to sell Pegasus exclusively to foreign governments and state agencies to fight terrorism and organized crime. However, according to an international investigation led by Forbidden Stories, a leaked database of 50,000 phone numbers apparently selected for surveillance includes those belonging to almost 200 journalists worldwide, from Azerbaijan to India to Mexico.

The list also includes four journalists from Hungary: Szabolcs Panyi and András Szabó, reporters with investigative centre Direkt36; Brigitta Csikász, who was working with the investigative website Átlátszó at the time of her surveillance; and former hvg.hu journalist Dávid Dercsényi, according to reports by Direkt36, the Hungarian partner of the international investigation.

While being on the list does not necessarily mean that the target was actually attacked with Pegasus, in the case of Csikász, Panyi, and Szabó, forensic analysis of their phones identified clear traces of the Israeli spyware. The journalists cover a wide range of topics connected to abuses of power and suspected corruption by Hungarian politicians and authorities. During the surveillance, Csikász wrote about the misuse of EU funds, while Panyi and Szabó worked on an article about Russian-led International Investment Bank, among others.

Surveillance of journalists: a new level

The space for independent journalism has gradually been shrinking in Hungary since the current governing party, Fidesz, came to power in 2010, with the country falling from 23^rd to 92^nd in the World Press Freedom Index published by Reporters without Borders. In 2019, almost 78 percent of media were pro-government according to an analysis by media monitor Mérték, while accessing information has become increasingly difficult for independent journalists.

Still, the high-tech surveillance of journalists marks a “new level” in Hungary’s media environment, according to Péter Pető, chief editor of one of the most popular independent news websites, 24.hu. Although the website’s owner, Zoltán Varga – whose phone number also appeared on the Pegasus lists – had already suggested earlier that he might be under surveillance, Pető said that their journalists were both shocked and surprised when the news broke.

“Obviously, we have been under no illusion. But now, even our minimal sense of security has been shattered”, Pető said, adding that the scandal will make journalistic work even more difficult by increasing the potential costs of media owners, journalists, and sources alike. “It’s not only that media companies will have to spend more if they want to ensure their workers’ security. The potential surveillance might also discourage sources from sharing confidential information, and young students from becoming journalists.”

Under the assumption of being watched

At the same time, several journalists told IPI that the Pegasus scandal will not bring dramatic changes in their everyday operations, as they have already been working with the awareness that their communication might be intercepted and have taken security measures accordingly to protect their sources.

“Personally, I was not very surprised by the news”, Szabolcs Dull, one of the editors-in-chief of the news site Telex, founded after mass resignations over Dull’s dismissal from his previous workplace, Index. Dull recalled that in an attempt to discredit him, his list of phone calls was leaked to pro-government media last summer, and, as a political reporter, he has also seen high-level sources deeply worried about surveillance. “There was even a senior Fidesz politician who was wary of meeting me in person. He feared that our matching cell tower information would give us away”, Dull explained.

One of the surveilled journalists, Brigitta Csikász, told Direkt36 that she had received one of the first “friendly warnings” in 2010: “I was told that they are eavesdropping on my phone. From that time on, I was aware that it comes with my job that they are watching what I’m doing.”

Regarding security measures, Péter Erdélyi, senior editor of 444.hu, pointed out that in 2017, they made it compulsory for all of their journalists to use two-factor authentication (2FA) as an extra layer of security for e-mails. For certain projects, they moved their meetings outside of the offices to minimize the risk of surveillance. Similarly, at investigative website Átlátszó, encrypted messaging, storing data on encrypted drives, using VPN and 2FA have been common practices, editor-in-chief Tamás Bodoky said, adding that they are aware that these measures cannot provide perfect security either.

Tools like Signal and other encrypted messaging apps still provide reasonable security, as spywares like Pegasus are currently too expensive to be used on a mass scale, as Szabolcs Panyi, one of the journalists whose phone was compromised, pointed out in a radio show last week. “However, such tools are becoming cheaper and cheaper”, he warned.

Permissive legal framework without remedies

Almost three weeks into the scandal, the Orbán government has not provided a substantive reply to questions about the monitoring of journalists. First, it gave an answer to journalists’ detailed questions that was later described by Edward Snowden – the former CIA employee who blew the whistle about the United States’s spy program in 2013 – as “the most incriminating” he had ever seen. A Hungarian government spokesperson said that they were “not aware of any alleged data collection claimed by the request” followed by a counter-question asking journalists whether “there was any intelligence service to help them formulate the questions”.

In the following days, government officials labelled the Pegasus scandal as an unjust attack on the Orbán administration and avoided answering questions about whether surveillance was carried out by Hungarian state actors – and if so, who authorized it, when, and on what grounds. Most recently, Foreign Minister Péter Szijjártó stated that even journalists, regardless of their profession, could be surveilled in secret if they “pose a threat to the security and interests of the Hungarian nation”.

The gathering of secret information, however, is so loosely regulated in Hungary that virtually anyone can be put under surveillance, with the order “taking place entirely within the realm of the executive and without an assessment of strict necessity” and “without effective remedial measures,” as observed by a judgement of the European Court of Human Rights already back in 2016. Five years later, however, the Hungarian government only claimed that the “examination of the requirements stemming from the judgment in terms of legislative amendments, which is currently underway, is expected to take some time”.

In the wake of the Pegasus scandal, opposition parties called for the resignation of the government and organized a protest one week after the story broke, with the participation of 1,000 Hungarians – some of whom expressed disappointment over the low public interest in the event. According to a recent poll, while almost two-thirds of Hungarians have heard about the Pegasus scandal and more than half of the respondents thinks it is a serious issue, 58 percent were sceptical about whether it will have any effects on next year’s parliamentary elections.

Disclaimer: IPI contributor Blanka Zöldi is a journalist with Direkt36, an investigative centre that participated in the Pegasus investigation and whose colleagues are among the journalists targeted with the spyware.