By Jeph Ajobaju, Chief Copy Editor
Global media reports say more than 50,000 telephone numbers are being tracked in several countries, including Nigeria, which are clients of NSO Group, an Israeli firm whose Pegasus spyware is licensed to monitor terrorists and other criminals.
Seventeen major news outlets, including The Washington Post, The Guardian (UK), CNN, and the BBC are investigating how rights activists, journalists, lawyers, and business people around the world have been targeted.
Nigeria spies on its citizens
TheNiche reported on December 16, 2020 that a software that tracks phone calls and text messages is being used by Nigeria’s Defence Intelligence Agency (DIA) to spy on citizens, and two South South governors have used it against political opponents.
A report by the University of Toronto’s Citizen Lab said Circles – a telecom surveillance firm – helps security agencies in 25 countries, including Nigeria, to spy on the communications of opposition figures, journalists, and protesters.
The report by Citizen Lab, quoted by Al Jazeera, said Circles is affiliated with NSO Group, a hacker-for-hire company based in Tel-Aviv, whose software, Pegasus, is used by several governments to spy on dissidents by taking control of their smartphone, its cameras and microphones, and mining the user’s personal data.
Circles, on the other hand, is known for selling systems to exploit Signalling System 7 (SS7) vulnerabilities and claims to have sold the technology to several countries, according to the report.
SS7 is a system that allows one mobile network to connect with another.
“Unlike NSO Group’s Pegasus spyware, the SS7 mechanism by which Circles’ product reportedly operates does not have an obvious signature on a target’s phone,” Citizen Lab explained.
The report said Pegasus and Circles products could possibly be integrated.
Buhari wants phone IMEI
Muhammadu Buhari wants Nigerians to submit this July their International Mobile Equipment Identity (IMEI) to a Centralised Equipment Identity Register (CEIR) under the Communications and Digital Economy Ministry, headed by Isa Pantami.
Pantami is an overt sympathiser of Islamist jihadists and a Fulani supremacist, one of the henchmen advancing the cause of the president who sees Nigeria as his personal estate, breaks the law, and is mulling how to continue Northern rule.
Nigerians are wary of Buhari, particularly in the South, and not just the Igbos he targets in his hate speech and conduct.
A poll by PUNCH in May shows that 90.2 per cent of 12, 224 respondents said they would not submit their IMEI to the CEIR, only 9.2 per cent said they would.
IMEI is a 15-digit number unique to each mobile phone device. Phone carriers and manufacturers share IMEI numbers to enable tracking of smartphones that may be stolen or compromised.
In May, the ministry released a Revised National Identity Policy for SIM Registration that requires Nigerians to submit their IMEI numbers to a CEIR, also called Device Management System (DMS), to be managed by the Nigerian Communication Commission (NCC).
Buhari votes N4.87b to track social media, phone calls, text messages
Federal lawmakers have, for now, withdrawn bills meant to jail protesters, gag journalists and impose fines on them and their media outlets if they publish what Muhammadu Buhari does not want to read, watch, or hear.
Nigerians know that, through his history of dictatorship, if he gets his way, he will – even in a democracy – jail journalists and other citizens, and close down media houses, even if what they write, broadcast, or say is true and in the public interest.
Public outcry against reviving Buhari’s Decree 2 and Decree 4 of 1984 led to Olusegun Odebunmi withdrawing from the House of Representatives his Amendment Bills on the Nigerian Press Council (NPC) Act and the Nigerian Broadcasting Commission (NBC) Act.
Emeka Chinedu has also withdrawn from the House his Amendment Bill on the Criminal Code Act that seeks to criminalise public protest.
Buhari is pressing on with his mindset on his game plan, anyway.
In his supplementary budget approved by the National Assembly (NASS) on July 7, a total N4.87 billion is allocated to the National Intelligence Agency (NIA) to monitor WhatsApp messages, telephone calls, and text messages, among others.
Premium Times reports that N1.93 billion is for “WhatsApp Intercept Solution” and N2.93 billion for “Thuraya Interception Solution” used for monitoring voice calls or call-related information, SMS, data traffic, among others.
Lawmakers passed a supplementary budget of N982.72 billion for 2021 against N895 billion proposed by Buhari, an increase of about N87 billion.
Up to N123.3 billion is for recurrent (non-debt) expenditure and N895 billion for contribution to the Development Fund for Capital Expenditure. Another N45 billion is for foreign aid and loans.
Defence Intelligence Agency (DIA) gets N16.8 billion for infrastructure, cyber intelligence centre/laboratory, independent lawful intercept platform (voice and advanced data monitoring) and tactical mobile geological platform.
Police have N2.2 billion to spend on other logistics and consumables, N8.5 billion (ballistic helmets, bulletproof vests, and utility vehicles), N22.5 billion (drones, ammunition, discreet intelligence equipment, and other requirements).
The surveillance budget comes amid several attempts by Buhari to limit freedom of expression, which the public sees as a means to gag the media.
It comes after he suspended Twitter in Nigeria on June 4.
Pegasus sold to authoritarian governments
A leaked report said Pegasus is sold to authoritarian governments covering a list of some 50,000 phone numbers of people believed to be of interest to clients of NSO Group.
It was not clear where the list came from – or how many phones had actually been hacked, the BBC reports.
NSO denies any wrongdoing, but confirms selling the spyware.
It said the software is intended for use against criminals and terrorists and is made available only to military, law enforcement and intelligence agencies from countries with good human rights records.
It said the original investigation which led to the reports, by Paris-based NGO Forbidden Stories and the human rights group Amnesty International, was “full of wrong assumptions and uncorroborated theories”.
But NSO added that it would “continue to investigate all credible claims of misuse and take appropriate action”.
The allegations about use of Pegasus were carried on Sunday July 18 by The Washington Post, The Guardian (UK), Le Monde and 14 other media organisations around the world.
Pegasus infects iPhones and Android devices to enable operators to extract messages, photos and emails, record calls and secretly activate microphones and cameras.
The people targeted
Media outlets working on the investigation said they had identified more than 1,000 people spanning over 50 countries whose numbers were on the list.
They include politicians and heads of state, business executives, activists, and several Arab royal family members. More than 180 journalists were also found to be on the list, from organisations including CNN, the New York Times and Al Jazeera.
Many of the numbers were clustered in 10 countries: Azerbaijan, Bahrain, Hungary, India, Kazakhstan, Mexico, Morocco, Rwanda, Saudi Arabia and the United Arab Emirates, according to the reports.
When contacted by the outlets involved in the investigation, spokespeople for these countries either denied that Pegasus was used or denied that they had abused their powers of surveillance.
It was not clear how many of the devices on the list had actually been targeted, but forensic analysis of 37 of the phones showed there had been “attempted and successful” hacks, The Washington Post reported.
This included people close to Saudi journalist Jamal Khashoggi, who was murdered while visiting the Saudi consulate in Istanbul, Turkey, in October 2018 and his body dismembered.
The investigation found that spyware was installed on his fiancée’s phone days after his murder, and that his wife’s phone was targeted with spyware between September 2017 and April 2018.
The NSO Group said its technology was “not associated in any way with the heinous murder”.
The phone of Mexican journalist Cecilio Pineda Birto also appeared twice on the list, including in the month before he was murdered, the investigation found.
His phone disappeared from the scene of the murder so a forensic examination was not possible, but NSO said even if his phone was targeted, that did not mean that data collected was connected with his murder.
The phones of two Hungarian investigative journalists, Andras Szabo and Szabolcs Panyi, were found to have been successfully infected with the spyware.
Panyi told the BBC’s Forbidden Stories that learning of the hack was “devastating”.
“There are some people in this country who consider a regular journalist as dangerous as someone suspected of terrorism,” he said.
A Hungarian government spokesperson told The Guardian they were “not aware of any alleged data collection”.
In India, more than 40 journalists, three opposition leaders and two ministers in Prime Minister Narendra Modi’s government were reported to be on the list.
More details about who has been targeted are expected to be released in the coming days.
WhatsApp sued NSO in 2019, alleging the company was behind cyber-attacks on 1,400 mobile phones involving Pegasus. At the time, NSO denied any wrongdoing, but the company has been banned from using WhatsApp.
Larger scale target
The BBC adds that the allegations here are not new but what is new is the scale of the targeting of innocent people that’s allegedly taking place.
Nearly 200 reporters from 21 countries have their phone numbers on this list and more names of high-profile public figures are expected to be revealed.
There are plenty of unknowns in these allegations – including where the list comes from and how many of the phone numbers were actively targeted with spyware.
NSO Group have once again come out swinging and deny all accusations but it’s a blow for the company that is actively trying to reform its reputation.
Only two weeks ago they released their first “transparency report” detailing human right policies and pledges. Amnesty International brushed the 32-page document off as a “sales brochure”.
These latest allegations will do further damage to its image, but they won’t hurt the company financially.
There are very few private companies able to produce the sort of invasive spy tools that NSO sells, and clearly the largely unregulated market for the software is booming.