Phones of Natallia Radzina and Andrei Sannikov were infected with secret surveillance software

International digital security expert Nikolay Kvantilyani, The Citizen Lab at the University of Toronto, and Access Now have revealed that the case of surveillance on Galina Timchenko, co-founder and journalist of the Russian project "Meduza", was not unique. At least 7 other people, including Belarusian, Israeli, Russian, and Latvian journalists, became victims of surveillance through the Pegasus spyware.

One of the victims of espionage is a member of Belarusian civil society living in Vilnius. On June 22, 2023, he received a notification from Apple about a state-sponsored attack on his device. As a result, he sought help from Citizen Lab. The organization confirmed that his phone had spyware since approximately March 25, 2021.

Another victim of Pegasus is a Russian journalist from Vilnius. Three people were spied on in Riga:

• Russian-Israeli journalist from Baltic Weekly, Yevgeny Erlikh;
• Latvian freelance journalist for Current Time, Yevgeny Pavlov;
• General Director of "Novaya Gazeta Europa", Marina Epifanova.

On October 31, two Belarusians living in Warsaw received an attack notification: politician and head of the "European Belarus" campaign Andrei Sannikov, and editor-in-chief of "Charter-97" Natallia Radzina.

Citizen Lab notes that Sannikov's phone was infected with Pegasus around September 7, 2021. Radzina's phone received a similar threat three times – on December 2 and 7, 2022, and January 16, 2023.

The investigation showed that the use of Pegasus spyware against Russian- and Belarusian-speaking journalists and activists has been ongoing since at least 2020. The number of attacks increased after Russia's full-scale invasion of Ukraine in February 2022.

Access Now and Citizen Lab also confirmed that five of the victims' phones contained Apple IDs used by Pegasus operators in attempts to hack devices. Espionage using PWNYOURHOME can leave the attacker's Apple ID email address on the victim's device.

Citizen Lab believes that each Apple ID is used by only one Pegasus operator, although one Pegasus operator may use multiple Apple IDs. Investigators found the same email address in Pavlov, Radzina, and in the phone of another anonymous victim. A separate account was used on November 28, 2022, to attack the phones of Erlikh and Pavlov.

Files from the phones of Andrei Sannikov and Natallia Radzina contained a different ID. This indicates that one Pegasus spyware operator may be behind the attack on at least three, and possibly all five, victims.

Access Now and Citizen Lab are not publicly naming the suspected operator at this time. Poland has not been documented as a state targeting people outside the country. The Polish government assures that it stopped using Pegasus back in 2021. According to Citizen Lab, there is also no evidence that Russia, Belarus, or Lithuania are Pegasus clients.

Latvia uses the program, but there are no facts indicating its use for surveillance of phones of anyone living outside the country. Estonia is another Baltic country that closely cooperates with Latvia and Lithuania on security issues, including those related to Russia and Belarus.

According to Citizen Lab, Estonia actively uses Pegasus outside its country, including in a number of European countries.

The Access Now organization called on all governments to impose an immediate moratorium on the export, sale, transfer, servicing, and use of targeted digital surveillance technologies until such practices are better regulated and until strict human rights safeguards are put in place in case such programs are used. The organization also asked governments to ban spy technologies like Pegasus, which have facilitated human rights abuses in the past.

Natallia Radzina commented to Svaboda on the information about the Pegasus attack on her phone:

"Of course, this is a violation of privacy, the secrecy of correspondence and phone conversations. But most importantly, my phone was previously illegally wiretapped in Belarus, where I was persecuted for political reasons, subjected to criminal prosecution, and imprisoned in the KGB jail. I know that for many years my absolutely legal journalistic activity could only interest Belarusian and Russian special services, and I only fear possible cooperation on this matter between the current operators, whoever they may be, with the KGB or FSB."

Pavel Butorin, director of Current Time, also reacted to the investigation materials known to date:

"We are very concerned about Pegasus spyware attacks on journalists and continue to implement strict security protocols to ensure the protection of our employees."

The authors of the investigation note that it is not yet complete and they continue their search.

• 8
• 0
• 9
• 7
• 7
• 4
• 45
• 0