We call on the Hungarian government and other implicated governments to immediately stop using the spyware and to provide transparency about its application so far. We also call on the NSO Group to take its corporate social responsibility more seriously and stop selling Pegasus to regimes with poor human rights and media freedom records, provide more transparency that will enable proper oversight and establish more stringent due diligence processes.

Forbidden Stories obtained leaked records of phone data, suggesting that various governments worldwide selected media workers, lawyers and activists as possible targets for invasive surveillance with the Pegasus spyware. The spyware has the potential to transform the targets’ phones into surveillance devices, allowing access to all data on the phone and enabling control over audio and video to make recordings surreptitiously. Inclusion of a phone number on the leaked list does not necessarily entail that the linked device was successfully hacked, but forensic analysis on dozens of phones so far effectively shows evidence of Pegasus activity in more than half of the cases. NSO Group has repeatedly said that its spyware, which they sold to some of the world’s most repressive regimes, is meant for use only against terrorists and serious criminals. Unsurprisingly, despite claims by NSO Group that they will cut off clients if they misuse the spyware, it appears that Pegasus has been used well beyond this stated intended target group by those clients, to potentially include anyone perceived as an opponent or threat to the regime.

In the European Union, forensic analysis of several devices has shown that the Hungarian government has deployed the spyware program against investigative journalists and the circle of one of the country’s last remaining independent media owners. At least five journalists figure in the leaked records and at least ten lawyers and an opposition politician. They include Szabolcs Panyi, a well-known reporter at investigative outlet Direkt36, who has been publicly attacked in the past by Prime Minister Viktor Orbán’s spokesperson Zoltán Kovács, who has accused him of “Orbánophobia”. Also analysis of his colleague András Szabó’s phone showed positive results for the use of Pegasus. Other Hungarian media workers selected for potential targeting include Dávid Dercényi, who edits a newspaper put out by the authority of an opposition-run district in Budapest; a photographer who worked as a fixer for visiting foreign journalists; and, a well-known investigative journalist. Furthermore, it appears also the circle of investor Zoltán Varga, who owns several independent media outlets and has been pressured in the past, was surveilled using the Pegasus software.

In a response quoted in The Guardian, the Hungarian government said that “state bodies authorised to use covert instruments are regularly monitored by governmental and non-governmental institutions.” The country has a very permissive legal framework for surveillance. In 2020, the justice minister approved 1,285 surveillance requests (not necessarily using Pegasus spyware).

The most recent revelations about Pegasus serve to highlight two things. On the one hand, they underscore the urgent need for meaningful reforms that will ensure powerful commercial technology is not abused by governments at the expense of civil liberties. They also show the essential role watchdog journalism plays in safeguarding the human rights that underpin democracy, by exposing violations and holding the perpetrators to account.