Our right to privacy and our ability to express ourselves freely online is more at risk than ever before. Governments use spyware to target human rights defenders and disruptive internet censorship systems that block entire websites that talk about human rights. In fact, Amnesty’s websites are completely blocked to people living in countries like Russia, Iran and China, just because we dare to confront human rights violations in those countries.

The Pegasus Project was a ground-breaking collaboration by more than 80 journalists from 17 media organizations in 10 countries coordinated by Forbidden Stories, a Paris-based media non-profit, in partnership Amnesty International’s Security Lab. The Security Lab conducted cutting-edge forensic tests on potentially targeted mobile devices which confirmed numerous new cases of Pegasus spyware attacks.

This forensic appendix outlines forensic evidence on the use of highly invasive spyware against two journalists from India. Our investigation confirms that the devices of both individuals were targeted with NSO Group’s Pegasus spyware between August and October 2023. More information about the context for these attacks is available in an accompanying press release.

Responding to the reports of Apple sending a new round of threat notifications globally, including to Indian opposition leaders and journalists, noting that their iPhones may have been targeted by “state-sponsored attackers”, Likhita Banerji, Amnesty International’s Researcher and Advisor on technology and human rights, said:

On 5 October 2023, a major global investigation – the “Predator Files” – was published exposing the proliferation of surveillance technologies around the world and the failure of governments and the European Union (EU) to properly regulate the industry. The Security Lab at Amnesty International is a technical partner in the “Predator Files”, a project coordinated by the European Investigative Collaborations (EIC) media network into the Intellexa alliance, the makers and marketers of the Predator spyware. As part of this collaboration, the Security Lab has reviewed technical documentation, marketing material and other records obtained by Der Spiegel and Mediapart – who are part of EIC – which shed light on the ecosystem of surveillance products offered by the Intellexa alliance.

Responding to today’s vote by Members of the European Parliament urging the European Union (EU) to more tightly regulate the use, manufacture and trade of spyware, Rebecca White, campaigner at Amnesty Tech’s Disrupting Surveillance Team, said: 

Ahead of today’s opening of RightsCon, a summit on human rights in the digital age, which takes place in San José, Costa Rica, Rasha Abdul Rahim, Director of Amnesty Tech, said:  

A joint investigation has revealed that at least twelve Armenian public figures and officials, including journalists and human rights defenders were targeted with NSO Group’s Pegasus spyware amid conflict in Nagorno-Karabakh, between October 2020 and December 2022.  Evidence from the investigation, conducted with Amnesty International’s Security Lab, Access Now, the Citizen Lab, CyberHUB-AM, and an independent mobile security researcher Ruben Muradyan suggests that the conflict may have been the reason for the targeting.

A high-profile woman journalist in the Dominican Republic has been targeted with NSO Group’s Pegasus spyware, in the first confirmed case in the country, Amnesty International reveals in a new investigation published on World Press Freedom Day.

Responding to a report by the Financial Times that India is searching for alternative spyware technology to replace NSO Group’s Pegasus surveillance software, Donncha Ó Cearbhaill, Head of the Security Lab at Amnesty International, said:  

A sophisticated hacking campaign by a mercenary spyware company targeting Google’s Android operating system has been exposed by Amnesty International’s Security Lab.

Thailand must thoroughly investigate the use of the invasive Pegasus spyware found on the phones of dozens of activists, Amnesty International said today, after a new report identified 30 people who were targeted or infected with the harmful software, the first time its use in the country has been confirmed through technical analysis.