Six Palestinian human rights defenders hacked with NSO Group’s Pegasus Spyware

On 19 October 2021, Israeli Minister of Defense, Benny Gantz, announced the designation of six leading Palestinian civil society organizations in the Occupied Palestinian Territory as “terrorist organizations” under Israel’s Anti-Terrorism Law 2016. The groups named are Addameer; Al-Haq; Defense for Children – Palestine; the Union of Agricultural Work Committees; Bisan Center for Research and Development; and the Union of Palestinian Women Committees.

Download the Investigation (PDF)

This move is intended to not only criminalize these organizations, but to cut off their funding and other forms of support they receive from international partners and supporters. Front Line Defenders condemns Israel’s effort to criminalize support for well-respected and long-serving human rights defenders and their organizations, as it has when other such measures were introduced in countries like Russia, Egypt and Nicaragua.

While this latest move by the Israeli government is part of an alarming trend that is designed to try to stop the work of human rights organisations and human rights defenders, the timing and method of the designation suggests that it is also an effort to legitimate the surveillance and infiltration of the devices of Palestinian human rights defenders using Pegasus spyware, as discovered by a Front Line Defenders forensic investigation (see timeline below).

On 16 October 2021, Front Line Defenders was contacted by-Al Haq, a human rights organisation in Palestine, about the device of a Jerusalem-based staff member and a possible infection with spyware. Front Line Defenders immediately conducted a technical investigation, and found that the device had been infected in July 2020, with spyware sold by Israel-based NSO Group. Front Line Defenders began investigating other devices belonging to members of the 6 designated Palestinian civil society organizations, and found that five additional devices were hacked with the same spyware. Front Line Defenders shared the data it gathered from the phones with Citizen Lab and Amnesty International’s Security Lab for independent peer review. Both confirmed, with high confidence, Front Line Defenders conclusion that the phones were hacked with Pegasus.

Citizen Lab
Technical Report

Amnesty International Security Lab
Technical Report

Timeline

Investigation & Technical Information

Front Line Defenders investigated 75 iPhones and found that 6 devices were hacked with NSO Group's Pegasus spyware. Citizen Lab and Amnesty International’s Security Lab each confirmed FLD’s analysis. Three victims consented to be identified (listed below), and three wished to remain anonymous:

1. Ghassan Halaika: Field researcher and human rights defender working for Al-Haq
2. Ubai Al-Aboudi: Executive Director at Bisan Center for Research and Development. Ubai Al-Abdoudi holds US citizenship.
3. Salah Hammouri: Lawyer and field researcher at Addameer Prisoner Support and Human Rights Association based in Jerusalem. On 18 October 2021, human rights defender and lawyer Salah Hammouri was notified of the Israeli Minister of Interior’s decision to revoke his permanent residency in Jerusalem and deport him on the basis of his alleged “breach of allegiance to the State of Israel”. Salah Hammouri is a citizen of France.

The investigation conducted by FLD included:

* A scan of the iPhone devices from the 6 human rights organizations and human rights defenders from these organisations.

* FLD shared data from its scans, including the findings indicating Pegasus spyware, with Citizen Lab and Amnesty International Security Lab, each of which confirmed FLD’s findings.

FLD found traces of process names associated with NSO Group's Pegasus spyware on iPhones belonging to six human rights defenders:

1. Ghassan Halaika's phone showed traces of the Pegasus process smmsgingd in July 2020.
2. Ubai Al-Aboudi's phone showed traces of the Pegasus processes MobileSMSd, CommsCenterRootH[...] and otpgrefd in February 2021.
3. Salah Hammouri's phone showed traces of the Pegasus processes ctrlfs and xpccfd in April 2021.
4. Human Rights Defender 4 phone showed traces of the Pegasus process bundpwrd in April 2021.
5. Human Rights Defender 5 phone showed traces of the Pegasus processes launchrexd, gssdp, launchafd, com.apple.Mappit, cfprefssd, libtouchregd, ABSCarryLog and contextstoremgrd in February and April 2021.
6. Human Rights Defender 6 phone showed traces of the Pegasus process accountpfd in November 2020.

Amnesty International's Security Lab has published research attributing these process names to NSO Group's Pegasus spyware. Some of these processes were determined by Citizen Lab to be the same as used against other human rights defenders and journalists in other countries.

When Pegasus is installed on a person’s phone, an attacker has complete access to a phone’s messages, emails, media, microphone, camera, passwords, voice calls on messaging apps, location data, calls and contacts. The spyware also has the potential to activate the phone camera and microphone, and spy on an individual's calls and activities. As such, the spyware not only allows for the surveillance of the target, but also anyone with whom they have contact via that device. This means that, in addition to the targeting of Palestinians, including dual nationals, non-Palestinians (including foreign nationals and diplomats) with whom these victims were in contact, including Israeli citizens, could have also been subject to this surveillance, which, in the case of its citizens, would amount to a breach of Israeli law.

In July 2021, a global investigation by the Washington Post, the Guardian, Le Monde and other news outlets reported that Pegasus spyware has been used to monitor human rights defenders, journalists and politicians around the world. NSO Group has denied reports that the Pegasus spyware is used in the mass surveillance of human rights defenders; according to the company, Pegasus is intended for use only by government intelligence and law enforcement agencies to fight terrorism and crime. As such, the Israeli designation of these organizations as ‘terrorists’ after Pegasus was detected, but just days before this investigation is reported, appears to be a clear effort to cover its actions and disconnected from any evidence that would discredit these organizations.

‘Terrorist' Designation & Discredited ‘Evidence’

The ‘terrorist’ designation made against these organizations could allow Israeli authorities to close their offices; seize their assets, including bank accounts; arrest and jail their staff members; interfere with their international funding and donor relations; and frustrate their efforts to monitor and document Israeli government violations. Aside from the impact on these six organizations, this measure, by targeting some of the longest-established and most respected organizations, as well as those with high profiles internationally, serves as an act of intimidation to other Palestinian organizations. This designation should be seen as an all-out assault on Palestinian human rights defenders and civil society, particularly on their efforts towards accountability and justice.

Attacks and campaigns against Palestinian human rights organisations and other civil society organisations have been carried out for years by the Israeli authorities. As documented in a report published by the Observatory for the Protection of Human Rights Defenders in April 2021, these practices intensified over the past six years, in the context of the upheaval caused by the Trump administration in the United States and the expected opening of an investigation by the International Criminal Court. The report found that the strategies put in place by the Israeli Government is threefold: one, delegitimising civil society critical voices through “naming and shaming” and labeling them as 'terrorists' or 'anti-Semitic'; two, pressuring institutions from giving a platform for Palestinian voices and perspectives that seek accountability or justice; three, actively lobbying to cut sources of funding for Palestinian organizations, especially those that have been part of civil society efforts towards accountability. Resorting to smear campaigns, intimidation and harassment measures, new restrictive legislation, administrative or judicial harassment and increased pressure on international donors who support those organisations have proven to be effective tactics to destabilise NGOs and undermine human rights defenders.

These tactics have also targeted other actors, including key health organisations in Palestine such as the Health Work Committee, which provides medical support to vulnerable communities, and UN mandate holders, who play a key role in exposing Israeli violations.

Front Line Defenders strongly condemns the decision and allegations of terrorism brought against these Palestinian human rights organisations in response to their peaceful human rights work. Human rights defenders are not terrorists. This development marks a grave expansion of Israel's systematic policies and practices intended to silence Palestinian human rights defenders who seek justice and accountability for violations of Palestinians human rights. This attack also puts the future of child protection, women’s rights, rights of prisoners and the ability to document human rights violations at significant risk.

Recommendations

Front Line Defenders calls on all stakeholders – states, international bodies, corporations and law enforcement authorities to clearly and unequivocally reject the terrorism charges brought against Palestinian human rights organisations and human rights defenders.

The international community, including the EU and its member states, should stand firm in its support to Palestinian human rights defenders by publicly condemning this flagrant attack on the Palestinian human rights movement and by urging Israel’s Minister of Defense to immediately rescind the designation of the six human rights organisations as “terrorist organisations,” making clear that counter-terrorism legislation should never be used to constrain legitimate human rights work. The EU and its member states should also continue to fund these organisations for their legitimate human rights activities and mirror the United States recent decision to blacklist the NSO Group. Front Line Defenders calls for an immediate global moratorium on the export, sale, transfer and use of surveillance technology until an adequate human rights regulatory framework is in place.

______

¹ These documents were shared with European governments starting in May 2021.

² The Health Work Committee is a Palestinian organisation working on women’s and children’s health. In March 2021, two of its former employees were arrested by Israel – their employment had previously been terminated by the organisation. The organisation had been declared a ‘terrorist’ organisation on 22 January 2020, similar to the determination made on the 6 organisations in this statement. On 13 April 2021, Juana Ruiz Sanchez, a Spanish national married to a Palestinian and project coordinator at the organisation was arrested and has been detained since. On 9 June, Israeli forces closed down the office of the Health Work Committee in Ramallah for 6 months. On 7 July, Shatha Odeh, the organisation’s Director, was arrested from her home; fabricated charges have been filed against her and she remains in detention.