Dozens of Al Jazeera journalists allegedly hacked using Israeli firm's spyware
Dozens of journalists at Qatari-funded Al Jazeera were targeted by advanced spyware in an attack likely linked to the governments of Saudi Arabia and the United Arab Emirates, weeks before the Trump administration announced the normalisation of ties between Israel and the UAE.
Citizen Lab at the University of Toronto said it traced malware that infected the personal phones of 36 journalists, producers, anchors and executives at Al Jazeera back to the Israeli-based NSO Group, which has been widely condemned for selling spyware to repressive governments.
New MEE newsletter: Jerusalem Dispatch
Sign up to get the latest insights and analysis on Israel-Palestine, alongside Turkey Unpacked and other MEE newsletters
Most unnerving to the investigators was that iMessages, used between Apple devices, were infecting targeted cellphones without the users taking any action - what's known as a zero-click vulnerability.
Through push notifications alone, the malware instructed the phones to upload their content to servers linked to the NSO Group, Citizen Lab said, turning journalists' iPhones into powerful surveillance tools without even luring users to click on suspicious links or threatening texts.
The coordinated attacks on Al Jazeera, which Citizen Lab described as the largest concentration of phone hacks targeting a single organisation, occurred in July, just weeks before the normalisation deal.
Citizen Lab say normalisation likely will lead to stronger cooperation in digital surveillance between Israel and Gulf monarchies.
Gulf feud
Citizen Lab, which has been tracking NSO spyware for four years, tied the attacks "with medium confidence" to Emirati and Saudi governments, based on their past targeting of dissidents at home and abroad with the same spyware.
The two countries are embroiled in a bitter geopolitical dispute with Qatar in which hacking and cyber surveillance have increasingly become favoured tools.
In 2017, the two Gulf nations and their allies imposed a blockade on Qatar and served the tiny country with a list of demands, among them shutting down its influential Arabic-language TV network, which the UAE and Saudi Arabia see as promoting a political agenda at odds with their own.
The feud continues to fester, although officials recently have made encouraging signs that a resolution may be within reach.
Emirati and Saudi authorities did not respond to requests for comment.
Malware
The NSO Group cast doubt on Citizen Lab's accusations in a statement but said it was "unable to comment on a report that we have not yet seen."
The firm said it provides technology for the sole purpose of enabling "governmental law enforcement agencies to tackle serious organised crime and counterterrorism."
Prior to Sunday's report, NSO's spyware has repeatedly been found deployed to hack journalists, lawyers, human rights defenders and dissidents. Nevertheless, it added, "when we receive credible evidence of misuse… we take all necessary steps in accordance with our product misuse investigation procedure in order to review the allegations." NSO does not identify its customers.
Most notably, the spyware was implicated in the gruesome killing of Saudi journalist Jamal Khashoggi, who was dismembered in the Saudi consulate in Istanbul in 2018 and whose body has never been found.
'It's not only very scary, but it’s the holy grail of phone hacking... you can be using your phone normally, completely unaware that someone else is looking at everything you’re doing'
- Bill Marczak, Citizen Lab
Several alleged targets of the spyware, including a close friend of Khashoggi and several Mexican civil society figures, sued NSO in an Israeli court over the hacking.
The NSO Group's surveillance software, known as Pegasus, is designed to bypass detection and mask its activity.
The malware infiltrates phones to vacuum up personal and location data and surreptitiously control the smartphone's microphones and cameras, allowing hackers to spy on reporters' face-to-face meetings with sources.
Apple said it was aware of the Citizen Lab report and said the latest version of its mobile operating system, iOS 14, "delivered new protections against these kinds of attacks."
It sought to reassure users that NSO doesn't target the average iPhone owner, but rather sells its software to foreign governments to target a limited group. Apple has not been able to independently verify Citizen Lab's analysis.
'Holy grail of phone hacking'
Bill Marczak, a senior researcher at Citizen Lab, said: "It's not only very scary, but it's the holy grail of phone hacking." He added: "You can be using your phone normally, completely unaware that someone else is looking at everything you're doing."
The Citizen Lab researchers connected the hacks to previously identified Pegasus operators in attacks attributed to Saudi Arabia and the UAE over the last four years.
The zero-click vulnerability is increasingly being used to hack cellphones without a trace, said Marczak.
Last year, WhatsApp and its parent company Facebook filed an unprecedented lawsuit against the NSO Group, accusing the Israeli firm of targeting some 1,400 users of its encrypted messaging service with highly sophisticated spyware through missed calls.
Earlier this month, an Al Jazeera anchor filed another lawsuit in the US, alleging that the NSO Group hacked her phone through WhatsApp over her reporting on Saudi Arabia’s powerful Crown Prince Mohammed bin Salman.
With the UAE and Bahrain normalising ties with Israel, the use of Israeli spyware in the region may accelerate, Marczak added, encompassing a "much wider range of government agencies and customers across the Gulf."
Middle East Eye delivers independent and unrivalled coverage and analysis of the Middle East, North Africa and beyond. To learn more about republishing this content and the associated fees, please fill out this form. More about MEE can be found here.
