'Like nothing happened': Protesters slam NSO Group's presence at UK-backed fair

Human rights advocates protested outside a major UK government-supported security show in London on Tuesday as an Israeli firm whose spyware was allegedly used to hack British citizens promoted its goods inside.

Despite this, campaigners celebrated that the NSO Group would not be promoting its Pegasus software after they put pressure on organisers of the two-day International Security Expo, held in London's Olympia exhibition centre.

'When they hacked me and arrested people, they tortured them and sexually harassed them. They faced something that is almost worse than murder'

- Yahya Assiri, Saudi activist

Meanwhile, David Haigh, one of the alleged hacking victims, bought a £99 ticket to the trade show to see in person if NSO could address his problem. 

The company and its spyware have been at the centre of controversy in recent months after a group of media outlets started publishing stories, based on leaks, revealing how 50,000 people, including politicians, journalists, and dissidents, were potentially targeted by NSO's government clients.

In addition to leaders in more than a dozen countries, those suspected to have been hacked in the UK include a member of the House of Lords, human rights lawyers, academics, and activists. 

Around 400 UK mobile telephones appeared on a list identified by governments using Pegasus.

The NSO Group has repeatedly denied wrongdoing and said that it vets all its government clients before selling spyware to them.

On Tuesday the company was promoting its goods alongside other private and government exhibitors at the trade fair as around 25 demonstrators protested outside, including Yahya Assiri, who is believed to have been hacked by Pegasus. 

"The issue is more than what's happening to me," said Assiri, the former Saudi air force officer who left his life in the kingdom to start the human rights group Al-Qst. "When they hacked me and arrested people [in Saudi Arabia], they tortured them and sexually harassed them. They faced something that is almost worse than murder."

"And still people here," he said gesturing to the expo across the way, "are still accepting they have NSO with them and dealing with NSO like nothing happened."

'Pegasus is on my phone'

Inside the expo, David Haigh, a British human rights campaigner and lawyer, was approaching the NSO exhibit.

Earlier this year, Haigh - who had been fighting to free Dubai's Princess Latifa - learned that his phone had been hacked by Pegasus.

'We're very pleased that zero-click spyware isn't being advertised at the fair,"

- Oliver Feeley-Sprague, Amnesty International

"I wonder if you can help?" Haigh can be heard in a recording shared with MEE on Tuesday. "Pegasus is on my phone and I wonder if you can take it off for me."

After Haigh explained that he had been told by Amnesty International that he was hacked - and says he shared an Amnesty report - one of the NSO employees at the booth took down his details and said the company would be able to check if he was hacked.

"We are taking very seriously every allegation and every concern as such and we have a mechanism where we can actually check it," an employee can be heard telling Haigh.

"She was perfectly nice," Haigh later told MEE. "I was not expecting that. I was expecting them to walk away from the stand or [for me] to be removed by security. Or the two."

But, he said, he would not be taking NSO up on its offer to check if he had been hacked. His local police are investigating the alleged hack and will need the phone as evidence. "And I would never in a world of Sundays give a spy company my phone of all the silly things," Haigh added.

Pegasus: UK law firm may sue NSO Group, investors and governments over alleged targeting

Read More »

Ahead of the expo, campaigners had called on Nineteen Group Limited, the organisers of the event, to withdraw NSO's invitation in order to prevent the firm from showcasing Pegasus.

The organisers, Amnesty said, wrote back with a statement to say that NSO would not present or promote Pegasus during the event. Forty-eight hours later, just ahead of the event, Amnesty said it received a second statement from the organisers saying that NSO had "never intended" to do that anyway.

"We're very pleased that zero-click spyware isn't being advertised at the fair," said Oliver Feeley-Sprague, Amnesty UK's programme head covering military, security, and policing.

"However we got there, that's a good result. You can make your own mind up about the sequence of events but it's highly coincidental, let's just say."

But Amnesty would like to make sure that it's difficult for any spyware like Pegasus to be marketed or sold at a UK event while regulators play catch up and put controls on the fast-moving sector.

Currently in the UK, a buyer or seller of what is called "intrusion software" must have a license, but not so for its marketing, Feeley-Sprague said. 

So Amnesty has called on the UK Department of International Trade (DIT) to reclassify spyware within the current trade controls system such that it could not be offered for sale at UK events or by UK brokers.

MEE asked DIT whether it was considering this change. The department did not answer specifically, but a government spokesman said: "Our export controls are kept under contant review and we will not hesitate to take action where it is appropriate and necessary to do so."

The government spokesperson also said that the use of cyberespionage tools against civil society and political groups is "unacceptable".

"It is essential that nation states and other cyber actors use capabilities in a way that is legal, responsible and proportionate to ensure cyber space remains a safe and prosperous place for everyone," the spokesperson said. 

Calls for accountability

On his way to Exeter to teach for the day, Matthew Hedges, who was accused of spying, locked up and sentenced to life in prison in UAE while on a doctoral research trip in 2018, called for greater "accountability and oversight" from the UK government.

Researchers say Hedges was first listed on a database of Pegasus targets in March 2018, but his device was confiscated when he was arrested by UAE authorities and so it hasn't been possible to verify whether it was infected or not.   

'For the UK government to give tacit public support for a company that has been proven to lack accountable oversight and that of their clients shows a complete disregard for international law and human rights'

- Matthew Hedges

"For the UK government to give tacit public support for a company that has been proven to lack accountable oversight and that of their clients shows a complete disregard for international law and human rights," Hedges said.

"If UK citizens and residents have been targeted by foreign states, either there have been territorial abuses without reply or that the UK government is complicit in these abuses. Is the government then complicit in any ramifications such as injury or death?"

"The government should defend its integrity and citizens. Highlight where these abuses occur and that it is not acceptable behaviour. These actors should then be sanctioned for their behaviour."

Back at the demonstration, Nina, a local resident and Amnesty member who declined to give her last name, said she had turned out to protest after learning about Pegasus for the first time in recent weeks.

She said she is concerned that this type of spyware is only the beginning of a technology that will emerge in the coming years that will be capable of violating privacy.

"I don't know anyone who doesn't own a mobile phone and any one of us as members of the public could potentially be targetted," she said. 

"We need governmental action on a sort of multilateral global stage to really look at this issue. Artificial intelligence, tech development, and the speed of development - you've got to be reactive. There's an urgency for them to respond to this. It's an open jungle out there."