Controversial spyware used to track activist, report says

OTTAWA — A new report suggests a controversial commercial spyware was used to infect the cellphone of a prominent Saudi political refugee and activist in Quebec shortly before Saudi authorities arrested the man’s brothers and friends back home. The explosive allegation follows an investigation by internet watchdog Citizen Lab at the University of Toronto’s Munk School of Global Affairs, which has been raising alarms about the spyware known as Pegasus. Pegasus is an Israeli-made surveillance program, one of several marketed to governments as a tool against terrorists and criminals, but which Citizen Lab says have been used by repressive regimes against human-rights workers, journalists and others.

The suspected target is Omar Abdulaziz, who was granted asylum in Canada in 2014, has a massive following on social media, and says Saudi authorities have been waging an intimidation campaign against him for his criticism of the government in Riyadh. That campaign included the arrest of his two brothers and several friends in August — during which time Citizen Lab believes his phone was infected with Pegasus and being monitored from Saudi Arabia. Abdulaziz, who has still not heard from his brothers and friends, says he is now considering legal action against the company behind Pegasus, NSO Group, which has previously disputed Citizen Lab’s findings, as well as the Saudi government. And he hopes the Canadian government, which has been locked in a diplomatic spat with Saudi Arabia after criticizing the kingdom’s human-rights record, also takes action.

“Spying on someone on Canadian soil, on Canadian ground, that violates Canadian sovereignty,” Abdulaziz said in an interview from Sherbrooke, Que., where he is studying at Bishop’s University. “So Canada should do something because some of their citizens, some of their people might be harmed or might be exposed because of what happened.”

Citizen Lab has tracked the growing use of commercial spyware such as Pegasus by repressive regimes for years by reverse engineering such intrusive technology and through sophisticated internet scanning. “What we have found in our research is that when you look at cyberwarfare and cyberespionage as it’s practised, the principle victims are civil society: journalists, human-rights defenders, activists, lawyers,” said Citizen Lab director Ron Deibert.