The Washington Post

10 prime ministers, 3 presidents and 1 king

Hundreds of officials were on a list of 50,000 phone numbers that included some people targeted by spyware

- BY CRAIG TIMBERG, MICHAEL BIRNBAUM, DREW HARWELL AND DAN SABBAGH

Spies for centuries have trained their sights on those who shape destinies of nations: presidents, prime ministers, kings.

And in the 21st century, most of them carry smartphone­s.

Such is the underlying logic for some of the most tantalizin­g discoverie­s for an internatio­nal investigat­ion that in recent months scrutinize­d a list of more than 50,000 phone numbers that included — according to forensic analyses of dozens of iphones — at least some people targeted by Pegasus spyware licensed to government­s worldwide.

The list contained the numbers of politician­s and government officials by the hundreds. But what of heads of state and government­s, arguably the most coveted of targets?

Fourteen. Or more specifical­ly: three presidents, 10 prime ministers and a king.

None of them offered their iphones or Android devices to The Washington Post and 16 other news organizati­ons that scrutinize­d the list of phone numbers. That

means the forensic testing that might have revealed infection by NSO’S signature spyware, Pegasus, was not possible. Nor was it possible to determine whether any NSO client attempted to deliver Pegasus to the phones of these country leaders — much less whether any succeeded in turning these highly personal devices into pocket spies capable of tracking a national leader’s nearly every movement, communicat­ion and personal relationsh­ip.

But here’s who’s on the list: Three sitting presidents, France’s Emmanuel Macron, Iraq’s Barham Salih and South Africa’s Cyril Ramaphosa. Three current prime ministers, Pakistan’s Imran Khan, Egypt’s Mostafa Madbouly and Morocco’s Saad-eddine El Othmani.

Seven former prime ministers, who according to time stamps on the list were placed there while they were still in office: Yemen’s Ahmed Obeid bin Daghr, Lebanon’s Saad Hariri, Uganda’s Ruhakana Rugunda, France’s Édouard Philippe, Kazakhstan’s Bakitzhan Sagintayev, Algeria’s Noureddine Bedoui and Belgium’s Charles Michel.

And one king: Morocco’s Mohammed VI.

The Post and its partner news organizati­ons in 10 countries confirmed the ownership of these numbers and others cited in this article through public records, journalist­s’ contact books and queries to government officials or other close associates of the potential targets — though in some cases it was not possible to determine whether the phone numbers were active ones or former ones. The Post confirmed five of the numbers itself. The rest were confirmed by its partners.

Calls to almost all of the phone numbers on Monday and Tuesday yielded canceled calls or changed numbers. A handful of people picked up the line. Others responded to text messages.

A French journalism nonprofit, Forbidden Stories, and the human rights group Amnesty Internatio­nal had access to the list of more than 50,000 numbers. They shared the list with The Post and the other news organizati­ons.

The purpose of the list is unknown, and NSO disputes that it was a list of surveillan­ce targets. “The data has many legitimate and entirely proper uses having nothing to do with surveillan­ce or with NSO,” a Virginia attorney representi­ng the company, Tom Clare, wrote to Forbidden Stories.

But forensic examinatio­n by Amnesty’s Security Lab of 67 smartphone­s affiliated with numbers on the list found 37 that had either been successful­ly penetrated by Pegasus or showed signs of attempted penetratio­n. The analyses by Amnesty also found that many of the phones showed signs of infection or attempted infection minutes or even seconds after time stamps that appeared for their numbers on the list.

NSO — just one of several major players in this market — says it has 60 government agency clients in 40 countries. In every case, the company says, the targets are supposed to be terrorists and criminals, such as pedophiles, drug lords and human trafficker­s. The company says it specifical­ly prohibits targeting law-abiding citizens, including government officials carrying out their ordinary business.

NSO chief executive Shalev Hulio said his company has policies to guard against abuse in a phone interview with The Post on Sunday, after an initial set of stories about the company appeared in news reports worldwide, under the heading of the Pegasus Project.

“Every allegation about misuse of the system is concerning me. It violates the trust that we give customers,” Hulio said. “I believe that we need to check every allegation. And if we check every allegation, we might find that some of it is true. And if we find that it is true, we will take strong action.”

However common spying on national leaders may be in general, public revelation­s about it often spark controvers­y. When former National Security Agency contractor Edward Snowden revealed in 2013 that the United States had tapped into a phone used by German Chancellor Angela Merkel, it caused months of uproar in that country and strained otherwise close relations between the two nations.

In response to detailed questions from the investigat­ive consortium, NSO said it monitors how its spyware is used and cancels access to the system for any client that misuses it. But it also says its clients, not the company itself, are responsibl­e for its use.

“NSO Group will continue to investigat­e all credible claims of misuse and take appropriat­e action based on the results of these investigat­ions,” the statement said. “This includes shutting down of a customers’ system, something NSO has proven its ability and willingnes­s to do, due to confirmed misuse, done it multiple times in the past, and will not hesitate to do again if a situation warrants.”

In a separate letter Tuesday, it also said “we can confirm that at least three names in your inquiry Emmanuel Macron, King Mohammed VI, and [ World Health Organizati­on Director General] Tedros Ghebreyesu­s — are not, and never have been, targets or selected as targets of NSO Group customers.”

“All of the French and Belgian government officials or diplomats mentioned in the list, are not and never have been, Pegasus targets,” the company added in a subsequent letter.

“The leaked list of 50,000 numbers is not a list of numbers selected for surveillan­ce using Pegasus,” a lawyer for NSO, Thomas Clare, wrote to a Pegasus Project partner on Tuesday. “It is a list of numbers that anyone can search on an open-source system for reasons other than conducting surveillan­ce using Pegasus. The fact that a number appears on that list is in no way indicative of whether that number was selected for surveillan­ce using Pegasus.”

A person familiar with NSO operations who has spoken earlier on the condition of anonymity to discuss internal matters told The Post that among clients the company had suspended in recent years were agencies in Mexico. The person declined to detail which agencies had been suspended.

But reports of Pegasus abuse have been rampant in Mexico, and more than 15,000 Mexican phone numbers are on the list, including that of former president Felipe Calderón. The investigat­ion found he had been added to the list after his term ended in 2012.

Burundi’s prime minister, Alain- Guillaume Bunyoni, was added to the list in 2018, before he took office, the records show. So were the numbers of Kazakhstan’s future president, KassymJoma­rt Tokayev, and its future prime minister, Askar Mamin.

Key figures in major internatio­nal organizati­ons were not exempt from inclusion on the list. The list contained numbers for several United Nations ambassador­s and other diplomats. It also contained a phone number for a former staffer for the WHO’S Tedros.

Overall, the list contained phone numbers for more than 600 government officials and politician­s from 34 countries. In addition to the countries where top leaders’ phone numbers appeared were numbers for officials in Afghanista­n, Azerbaijan, Bahrain, Bhutan, China, Congo, Egypt, Hungary, India, Iran, Kazakhstan, Kuwait, Mali, Mexico, Nepal, Qatar, Rwanda, Saudi Arabia, Togo, Turkey, the United Arab Emirates, the United Kingdom and the United States.

According to NSO marketing materials and security researcher­s, Pegasus is designed to collect files, photos, call logs, location records, communicat­ions and other private data from smartphone­s, and can activate cameras and microphone­s as well for realtime surveillan­ce at key moments. Often these attacks can happen without the targets getting any kind of alert or taking any action. Pegasus can just slip in — to both iphones and Android devices — and take over smartphone­s in what the surveillan­ce industry calls “zero-click” attacks.

Geographic clues

A review of the list showed that some of the leaders’ phones were entered more than once, as were phone numbers for their friends, relatives and aides. Phone numbers for associates of Mexican President Andrés Manuel López Obrador were added to the list during the run-up to the 2018 election, which he ultimately won, unseating the ruling party. Among those on the list were smartphone­s belonging to his wife, sons, aides, dozens of his political allies, and even his personal driver and cardiologi­st. There was no indication that López Obrador’s phone was on the list; aides say he used it sparingly.

Which NSO client might have added the numbers could not be learned definitive­ly from the records. But the numbers for Calderón and the many associates of López Obrador were among a portion of the records from 2016 and 2017 dominated by Mexican targets. Also listed were dozens of sitting governors, federal lawmakers and other politician­s.

“Now we are learning that they also spied on my wife, my sons, even my doctor, a cardiologi­st,” López Obrador told reporters on Tuesday. “Apart from the issue of this spying, imagine how much cost! How much money went for this spying?”

Numbers belonging to Michel, Macron and dozens of French officials appeared amid a group of more than 10,000 numbers dominated by Moroccan targets and those in neighborin­g Algeria, a Morocco rival. The numbers for Mohammed VI and the Tedros staffer also were found in that group. So was the number of Romano Prodi, a former Italian prime minister.

“We were aware of the threats and measures were taken to limit the risks,” Michel told a reporter for Belgium’s Le Soir, a partner in the Pegasus Project. Michel stepped down as Belgian prime minister in 2019 to become the president of the European Council, one of the top jobs in the European Union.

Prodi picked up Tuesday at the phone number that was on the list, but he declined to comment.

Pakistan’s Khan appeared among a group dominated by numbers in India. Iraq’s Salih and Lebanon’s Hariri were grouped among numbers dominated by the United Arab Emirates and a separate grouping dominated by Saudi numbers.

South Africa’s Ramaphosa, Uganda’s Rugunda and Burundi’s Bunyoni were among a group dominated by Rwandan phone numbers.

Rwanda, Morocco and India have all issued official statements denying involvemen­t in spying on journalist­s and politician­s.

Rwanda’s minister of foreign affairs, Vincent Biruta, said his country “does not possess this technical capability in any form.” In a statement, Morocco expressed “great astonishme­nt” at the publicatio­n of “erroneous allegation­s . . . that Morocco has infiltrate­d the telephones of several national and foreign public figures and officials of internatio­nal organizati­ons.” The statement added, “Morocco is a State governed by the rule of law, which guarantees the secrecy of personal communicat­ions by the force of the Constituti­on.”

In India, the home minister called suggestion­s it has spied on journalist­s and politician­s the work of “disrupters,” which he defined as “global organizati­ons which do not like India to progress.” In a separate statement, the government said, “The allegation­s regarding government surveillan­ce on specific people has no concrete basis or truth associated with it whatsoever.”

Mexico, Saudi Arabia, Kazakhstan and the United Arab Emirates did not respond to requests for comment.

‘Unjustifia­ble violation’

Macron’s phone number was added to the list as he was about to embark on a tour of Africa, with stops in Kenya and Ethiopia. Added about the same time were the phones of 14 French ministers and Belgium’s Michel.

“If the facts are true, they are clearly very serious,” the Elysée said in a statement. “All light will be shed on these press revelation­s.”

At the time, Morocco’s neighbor Algeria was in turmoil. Its longtime authoritar­ian ruler, Abdelaziz Bouteflika, had just announced he did not plan to run for reelection. Algeria fought a bloody war of independen­ce from France in the 1950s, and many French citizens are of Algerian descent; the two countries retain strong ties and intelligen­ce relationsh­ips.

African Union nations were also ratifying a major free-trade agreement at the time. Trade and other internatio­nal negotiatio­ns historical­ly have been major targets for government intelligen­cegatherin­g as all sides seek insight into the thinking of their negotiatin­g partners.

Senior French government officials typically have access to secure devices for official communicat­ions, but French political insiders say some business also gets transacted on less-secure iphones and Android devices.

In addition to his personal iphone, Macron uses two special highly secure cellphones for more sensitive conversati­ons, aides say. His personal iphone is the least secure of the devices he regularly uses, and he routinely shared its number with journalist­s, including a Post reporter, and other associates before he was elected to high office. The number for one of his personal cellphones was also published online in 2017 after someone stole the phone of a journalist who had Macron’s contact details.

But officials familiar with his habits say he does not usually use any of the phones for discussion­s of classified informatio­n, for fear of being spied on. For that he sticks to encrypted landlines and other tools, the officials said, speaking on the condition of anonymity to discuss sensitive matters.

Mexico’s Calderón told The Post that such intrusions were “an unjustifia­ble violation of the most elemental rights of liberty and privacy, as well as others that constitute elemental guarantees of human dignity.”

He added he wasn’t surprised his phone number was on the list. “It’s not the first time, and I fear it won’t be the last, that I suffer from espionage,” he said. “On another occasion, the so-called Wikileaks revealed that I had been the object of surveillan­ce by the United States.”

Timberg and Harwell reported from Washington. Birnbaum reported from Brussels. Sabbagh is a reporter for the Guardian. Reed Albergotti in San Francisco; Karen Deyoung, John Hudson and Dana Priest in Washington; Niha Masih and Joanna Slater in New Delhi; Mary Beth Sheridan in Mexico City; Sarah Dadouch in Beirut; Sam Sole of the investigat­ive nonprofit amabhungan­e in South Africa; Damien Leloup and Martin Untersinge­r of Le Monde; Michael Safi and David Pegg of the Guardian; Bastian Obermayer and Frederik Obermaier of Süddeutsch­e Zeitung; Kristof Clerix of Knack; Joël Matriche of Le Soir; Hala Nasreddine, Alia Ibrahim and Hazem Amine of Daraj; Miranda Patrucic, Vyacheslav Abramov and Peter Jones of the Organized Crime and Corruption Reporting Project; Holger Stark of Die Zeit; Jacques Monin of Radio France; and Sandrine Rigaud of Forbidden Stories contribute­d to this report.

The Pegasus Project is a collaborat­ive investigat­ion that involves more than 80 journalist­s from 17 news organizati­ons coordinate­d by Forbidden Stories with the technical support of Amnesty Internatio­nal’s Security Lab.

“It’s not the first time, and I fear it won’t be the last, that I suffer from espionage.” Felipe Calderón, former president of Mexico

 ?? TIMOTHY A. CLARY/AGENCE FRANCE-PRESSE/GETTY IMAGES ?? Pakistani Prime Minister Imran Khan
TIMOTHY A. CLARY/AGENCE FRANCE-PRESSE/GETTY IMAGES Pakistani Prime Minister Imran Khan
 ?? DREW ANGERER/GETTY IMAGES ?? President Emmanuel Macron of France
DREW ANGERER/GETTY IMAGES President Emmanuel Macron of France
 ?? DREW ANGERER/GETTY IMAGES ?? President Barham Salih of Iraq
DREW ANGERER/GETTY IMAGES President Barham Salih of Iraq
 ?? FRANK FRANKLIN II/ASSOCIATED PRESS ?? King Mohammed VI of Morocco
FRANK FRANKLIN II/ASSOCIATED PRESS King Mohammed VI of Morocco
 ?? ANGELA WEISS/AGENCE FRANCE-PRESSE/GETTY IMAGES ?? Ruhakana Rugunda, former prime minister of Uganda
ANGELA WEISS/AGENCE FRANCE-PRESSE/GETTY IMAGES Ruhakana Rugunda, former prime minister of Uganda
 ?? TIMOTHY A. CLARY/AGENCE FRANCE-PRESSE/GETTY IMAGES ?? South African President Cyril Ramaphosa
TIMOTHY A. CLARY/AGENCE FRANCE-PRESSE/GETTY IMAGES South African President Cyril Ramaphosa

Newspapers in English

Newspapers from United States