Spyware sold by an Israeli private intelligence firm was allegedly used to hack the phones of dozens of Al Jazeera journalists in an unprecedented cyber-attack that is likely to have been ordered by Saudi Arabia and the United Arab Emirates, according to leading researchers.
In a stunning new report, researchers at Citizen Lab at the University of Toronto said they discovered what appears to be a major espionage campaign against one of the world’s leading media organisations, which is based in Qatar and has long been a thorn in the side of many of the region’s autocratic regimes.
The report, written by some of the world’s top digital surveillance researchers, also raises troubling new questions about the apparent vulnerability of the Apple iPhone, which has sought to promote a reputation for security and commitment to privacy.
Researchers at Citizen Lab said the apparent malicious code they discovered, which they claim is used by clients of Israel’s NSO Group, made “almost all” iPhone devices vulnerable if users were using an operating system that pre-dated Apple’s iOS 14 system, which appears to have fixed the vulnerability.
NSO Group, whose spyware is alleged to have been used in previous surveillance campaigns in Saudi Arabia and the UAE, has said that its software is only meant to be used by government clients to track down terrorists and criminals.
But the new allegation by Citizen Lab marks the latest in a long line of alleged human rights violations involving the company’s software on behalf of its clients, including the alleged targeting of journalists in Morocco, political dissidents from Rwanda, politicians in Spain, and pro-democracy clergy in Togo.
In those cases, NSO Group spyware was allegedly used to target the individuals through a vulnerability in WhatsApp, which is suing the company in a US court. NSO Group, in turn, has said in court that its government clients, who it will not name, control how its spyware is used and deployed and that it investigates allegations of abuse.
In a statement to the Guardian, NSO Group said it was not familiar with the allegations. “As we have repeatedly stated we do not have access to any information with respect to the identities of individuals our system is used to conduct surveillance on. However, where we receive credible evidence of misuse, combined with the basic identifiers of the alleged targets and timeframes, we take all necessary steps in accordance with our product misuse investigation procedure to review the allegations,” a spokesperson for NSO Group said.
In the wake of the latest alleged attack, Citizen Lab said the prevalence of the apparent vulnerability it discovered on iPhones, coupled with NSO Group’s known global reach, meant it was likely that only a “minuscule fraction” of attacks oniPhone users had been discovered so far.
In a statement, Apple said the attack described in Citizen Lab’s research was “highly targeted by nation states” against specific individuals. It said: “We always urge customers to download the latest version of the software to protect themselves and their data.” It also said it could not independently verify Citizen Lab’s analysis.
The latest alleged attack, which appears to have relied on a “zero click” technology – meaning that the targets would not have had to click on a link with malicious code to be infected – suggested attacks were getting “more sophisticated, less detectable”, Citizen Lab said.
The alleged hack of Al Jazeera was discovered after a well-known investigative journalist for its Arabic network, Tamer Almisshal, became concerned that his phone had been compromised, and turned to Citizen Lab for assistance, prompting researchers to begin monitoring his iPhone.
Citizen Lab said that logs of the metadata associated with Almisshal’s internet traffic found that, although he had never clicked on any suspicious links, his phone had connected to an NSO server after it was infected with an apparent malicious code delivered through Apple’s servers. Seconds later, researchers found technical evidence that Almisshal’s phone had been infiltrated.
Al Jazeera reported news of the hack on three dozen of its journalists during a TV broadcast on its Arabic channel on Sunday evening. The media organisation did not immediately respond to a request for comment from the Guardian.
Citizen Lab said it identified 36 personal phones inside Al Jazeera that it claims were hacked by four distinct “clusters”, which the researchers attributed to NSO Group operators. One operator, given the code name Monarchy by Citizen Lab, is alleged to have spied on 18 phones and was believed – with a “medium” degree of confidence – to have acted on behalf of the Saudi government, researchers said.
Another operator, code named Sneaky Kestrel, is alleged to have spied on 15 phones and is believed – with a “medium” degree of confidence – to have acted on behalf of the UAE. In one case, the Saudis and the Emirates appear to have spied on the same phone, researchers found, suggesting the attacks may have been coordinated.
Journalists, executives, anchors and producers were alleged to have been affected by the hacks.
Researchers also alleged that another journalist, Rania Dridi, a London-based presenter for Qatar’s Al Araby network, was also hacked. Citizen Lab said it found evidence that the device had been hacked six times with spyware between October 2019 and July 2020.
Dridi told the Guardian she had been shocked by the discovery. “I don’t know how to explain my feeling. It messes with your mind. Everything, your private life, it’s not private any more. It wasn’t [just] for a month, it was for a year, and they have everything: the phone calls, the pictures, videos, they can turn the microphone on,” she said. “It makes you feel insecure.”
But she said she was also happy to be speaking out, and planned to take legal action against the UAE.
Dridi said she believed she was possibly targeted because she raises sensitive topics on her programme, such as women’s rights. She added she may also have been targeted because she has a close personal associate who is known as an outspoken critic of the Saudi and UAE governments, and that targeting her may have helped the governments collect information about the associate.
Citizen Lab said it believed that the network it codenamed Monarchy worked on behalf of Saudi Arabia because it appeared to target individuals primarily inside the country, including a Saudi activist.
In the case of the UAE, Citizen Lab said that one activist who had been attacked by Sneaky Kestrel had previously received spyware links that were also used in attacks against the UAE activist Ahmed Mansoor, who Citizen Lab has alleged was targeted by NSO Group’s Pegasus software in 2016.
The claims of a hacking campaign against journalists from the two Qatari-funded media outlets underscores the extent to which Saudi Arabia and the UAE continue to see the Doha-based network as a major threat to their interests.
Saudi Arabia, the UAE, Bahrain and Egypt demanded that Qatar shut down Al Jazeera as part of their list of conditions for lifting a diplomatic and economic blockade against Doha that they imposed in June 2017.
The diplomatic crisis – which could be nearing resolution following recent “fruitful” discussions – was an escalation of years of jostling for regional influence between Qatar and its fellow Gulf Cooperation Council members.
The Saudi embassy in London and the UAE embassy in Washington did not respond to request for comment.
Additional reporting by Jassar Al-Tahat in Amman
