Pegasus spyware: Bahraini women's rights activist 'fears the worst' after hack
A Bahraini human rights defender has told Middle East Eye she “can simply no longer feel safe using my smartphone” after an investigation revealed that she and a Jordanian women’s rights campaigner had been hacked using NSO Group’s Pegasus spyware.
“I now fear the worst and worry that the Bahrain government will be able to exploit my personal documents and family photos,” said Ebtisam al-Saegh, who has previously accused Bahrain’s security services of torturing and sexually assaulting her. She lives in Bahrain.
An investigation led by the human rights group Front Line Defenders (FLD) found that the mobile phones of al-Saegh and Hala Ahed Deeb, a lawyer who works with human rights and feminist groups in Jordan, had been hacked multiple times by countries using NSO Group spyware.
Al-Saegh’s iPhone was hacked at least eight times between August and November 2019 using Pegasus. Ahed Deeb’s mobile phone was found to have been infected with the spyware since March 2021.
'I now fear the worst and worry that the Bahrain government will be able to exploit my personal documents and family photos'
- Ebtisam al-Saegh, Bahraini activist
Front Line Defenders worked with the University of Toronto’s Citizen Lab and Amnesty International’s Security Lab to verify their findings.
New MEE newsletter: Jerusalem Dispatch
Sign up to get the latest insights and analysis on Israel-Palestine, alongside Turkey Unpacked and other MEE newsletters
The group said the “impact of surveillance on women is particularly egregious and traumatising, given how governments have weaponised personal information extracted through spyware to intimidate, harass and publicly smear the targets’ reputations.”
Hala Deeb is part of the legal team defending the Jordan Teachers Syndicate, which the kingdom’s government shut down in July 2020. The teachers’ union, one of Jordan’s largest, remains in conflict with the government and authorities.
Al-Saegh is a human rights defender who has worked for Salam for Democracy and Human Rights, a group that fights for democracy and human rights in Bahrain. She has previously been harassed by Bahraini authorities.
On 20 March 2017, al-Saegh was detained for seven hours at Bahrain International Airport after she returned from the 34th session of the UN Human Rights Council. She was interrogated for five hours and had her passport and mobile phone confiscated.
A couple of months later, interrogators from Bahrain’s National Security Agency abused her physically and verbally, and sexually assaulted her at Musharraq police station. According to her testimony, she was told that if she did not cease her activism she would be raped.
“As someone who has been unable to heal from the torture and sexual assault experienced by Bahraini security due to the culture of impunity that allows my abusers to walk free, I feel deep pain in knowing that malicious spyware has now been used against me,” al-Saegh told MEE.
“This increased surveillance on human rights defenders is one of the consequences of Bahrain’s normalisation with Israel and it will only stop when NSO, Israel and Bahrain are held accountable,” she said.
'A weapon against me'
Bahrain normalised ties with Israel in September 2020. Pegasus was developed by Israel cyber arms group NSO.
Once installed on a device, the spyware can harvest any data from it and transmit that back to the attacker. It can steal messages, photos, videos, recordings, location records, web searches, passwords, call logs, social media posts and can turn the phone into a remote listening device.
“My private property has been turned into a weapon against me,” al-Saegh said. “My right to privacy has been breached… I am not only concerned about surveillance but I am terrified that this breach will impose a serious threat to my safety and my life.”
NSO says its software is licensed for use by client countries against suspected terrorists and serious criminals, and insists that it investigates credible allegations of abuse by its clients.
A spokesperson for the surveillance firm told the Guardian they couldn’t comment directly on the report, but added:
“NSO’s firm stance on these issues is that the use of cyber tools in order to monitor dissidents, activists and journalists, regardless of their gender, is a severe misuse of any technology… The international community should have a zero tolerance policy towards such acts, therefore a global regulation is needed.”
Sayed Ahmed Alwadaei, director at the Bahrain Institute for Rights and Democracy (Bird), hailed al-Saegh as one of Bahrain’s “most fearless campaigners”.
“Having already suffered harrowing abuse at the hands of the state, including sexual assault, torture and unlawful detention, she thought she would now finally be safe. She now finds herself under surveillance by the state. This is what human rights defenders in Bahrain have to endure,” Alwadaei told MEE.
British Gas pension stake in NSO
News of the hacking of the two women’s rights campaigners and human rights defenders comes as the Financial Times revealed that pension cash for British Gas workers was used to buy the NSO Group.
The retirement investment fund of Centrica, the parent company of British Gas, was among the biggest contributors to the 1bn euro fund that bought a stake in the Israeli firm in 2019, three people with knowledge of the matter told the newspaper.
Unlike other pension funds, the Centrica fund did not make this investment public. Those that did received letters from Amnesty International saying they were "directly linked" to "human rights abuses".
The FT also revealed that the family office of Albert Frere, a Belgian billionaire who died in 2018, had committed about 50m euro to Novalpina Capital, which owns a 70 percent stake in NSO. A dispute between its co-founders resulted in Novalpina being stripped of control of its own fund last year.
NSO was blacklisted in November last year by the US Department of Commerce, which said there was evidence it had supplied spyware to foreign governments that “used these tools to maliciously target government officials, journalists, businesspeople, activists, academics and embassy workers”.
The company, which is $500m in debt, is reportedly spending heavily to build up drone-monitoring technology and a big data analytics platform in a bid to survive its Pegasus scandal.
Middle East Eye delivers independent and unrivalled coverage and analysis of the Middle East, North Africa and beyond. To learn more about republishing this content and the associated fees, please fill out this form. More about MEE can be found here.
