Activists, journalists and politicians are among those believed to have been targeted by spyware developed by a private Israel-based firm, according to a new investigation.
They are on a list of 50,000 phone numbers of people believed to be targeted by clients of the company, NSO Group, since 2016, that was leaked to major news outlets.
Clockwise: Hatice Cengiz, wife of slain journalist Jamal Khashoggi; Indian opposition leader Rahul Gandhi, French President Emmanuel Macron and Saudi Arabian human rights activist Loujain al-Hathloul. Photo: AFP
Its Pegasus software infects iPhones and Android devices to enable operators to extract messages, photos and emails, record calls and secretly activate microphones and cameras.
NSO denies any wrongdoing. It says the software is intended for use against criminals and terrorists and is made available only to military, law enforcement and intelligence agencies from countries with good human rights records.
Phone numbers of three presidents, 10 prime ministers and a king were on the list of potential surveillance targets.
Here's what we know about some of those who might have been targeted by users of the software.
Members of Jamal Khashoggi's inner circle
Khashoggi, a US-based critic of Saudi Arabia's government, was murdered and dismembered in the Saudi consulate in Istanbul in October 2018.
According to the investigation, the spyware was used to try to monitor the two women closest to Khashoggi, along with other members of his inner circle.
One of the women was Hanan Elatr, an Egyptian flight attendant and Khashoggi's wife.
Six months before he was murdered, she had her phone secretly targeted by a Pegasus user, according to an examination by Amnesty International.
Someone using the software sent Elatr four text messages containing malicious links between November 2017 and April 2018. Amnesty International says it was unable to determine whether the hack was successful.
"Jamal warned me before that this might happen," Elatr told the Washington Post. "It makes me believe they are aware of everything that happened to Jamal through me."
Although Khashoggi was married he also had a fiancée, Hatice Cengiz, a Turkish researcher. She was waiting outside the Saudi consulate on 2 October 2018 when he was murdered and raised the alarm with Turkish authorities when he did not come out.
Hatice Cengiz. Photo: AFP
Days after the killing, her iPhone was breached by a Pegasus user, according to the analysis by Amnesty International's Security Lab.
The analysis could not determine what was taken from the phone or whether any audio surveillance took place, the Washington Post reported.
"I am deeply shocked that I have been targeted while I was in such pain waiting to find out what had happened to Jamal," Cengiz tweeted on Sunday night.
"This was the worst time of my life and yet the killers were spying on me. They have no shame. They must be brought to justice."
A close friend of Khashoggi, Wadah Khanfar, the ex-director general of the Qatar-based Al Jazeera network, was also allegedly targeted.
NSO denies that its technology was used against Khashoggi or his associates.
"As NSO has previously stated, our technology was not associated in any way with the heinous murder of Jamal Khashoggi," the company said in a statement.
"This includes listening, monitoring, tracking, or collecting information. We previously investigated this claim, immediately after the heinous murder, which again, is being made without validation."
Saudi Arabia has not responded to the allegations.
Journalists
Roula Khalaf, Financial Times editor
Khalaf became the newspaper's first female editor last year. The Beirut-born journalist was selected for possible surveillance throughout 2018, according to the investigation.
Analysis of the data suggests Ms Khalaf's phone was selected as a possible target by the United Arab Emirates (UAE) while she was deputy editor at the paper.
"Press freedoms are vital, and any unlawful state interference or surveillance of journalists is unacceptable," Khalaf tweeted on Sunday.
An NSO spokesperson told the FT it had confirmed Khalaf "was not a Pegasus target by any of NSO's customers".
The UAE has not commented on the allegations.
Cecilio Pineda, murdered Mexican journalist
Cecilio Pineda covered police information generated in Tierra Caliente, a zone of cultivation of marijuana and opium gum. Photo: AFP
Pineda, 38, was shot dead at a car wash in March 2017.
The reporter's phone is said to have been selected for surveillance one month before he was killed. The device was never found and it is not clear if it was hacked.
NSO denies its software or clients were "in any way connected" to Pineda's murder.
"Correlation does not equal causation, and the gunmen who murdered the journalist could have learned of his location at a public carwash through any number of means not related to NSO Group, its technologies, or its clients."
The Mexican government has not commented on the findings.
Szabolcs Panyi and Andras Szabo
The Hungarian investigative journalists are both prominent reporters for the Budapest-based investigative outlet Direkt36.
Panyi accuses Hungary's government, led by right-wing Prime Minister Viktor Orban, of seeing journalists as part of a conspiracy against it.
A government spokesperson denied knowledge of any data collection, saying Hungary was a "democratic state governed by the rule of law".
NSO Group said it "does not have access to the data of its customers' targets".
Activists and politicians
Loujain al-Hathloul
Loujain al-Hathloul. Photo: AFP
Al-Hathloul is one of the most outspoken women human rights activists in Saudi Arabia.
According to the Guardian, she was selected for possible targeting with Pegasus just weeks before she was arrested in March 2018 in the UAE, where she was studying, and then forcibly returned to Saudi Arabia.
That May she was detained by Saudi authorities along with a number of other women activists as part of an apparent crackdown on dissent overseen by Crown Prince Mohammed bin Salman.
Hathloul was convicted last December of seeking to change the political system and sentenced to six years in prison. She was released in February, after part of the sentence was suspended.
Saudi Arabia has not responded to the allegations.
Rahul Gandhi
Rahul Gandhi. Photo: AFP
Gandhi is a dominant figure in India's opposition Congress party, which he led during the country's 2019 elections, won by Prime Minister Narendra Modi.
The phone numbers of several other prominent Congress figures also feature in the data leak. It is not clear if any of the targeted phones were successfully hacked.
Gandhi calls the alleged targeting "an attack on the democratic foundations of our country".
The Indian government strongly denies any "unauthorised interception", calling the investigation's claims "bereft of facts".
NSO says it "does not operate the systems that it sells to vetted government customers, and does not have access to the data of its customers' targets".
Indian news portal The Wire reported that smartphones of two other lawmakers were among 300 verified Indian numbers listed as potential targets for surveillance during 2017-19 ahead of national elections.
French President Emmanuel Macron
French daily Le Monde said, according to sources, one of Macron's phone numbers, which he had used regularly since 2017, is on the list of numbers selected by Morocco's intelligence service for potential cyber-spying.
Morocco has denied being a client of Israeli manufacturer of Pegasus.
Being on the list does not mean that the software was used but it does mean that the person was a potential target.
It is not clear if the software was ever installed on the French president's phone.
Iraqi President Barham Salih
The Washington Post said that it had not been possible to determine if Pegasus had infected Salih's phone or whether there had been any attempt to do so.
Lawyers
Rodney Dixon QC
Dixon is a London-based lawyer who has taken on numerous high-profile human rights cases.
His clients have included Matthew Hedges, a British doctoral student jailed in the UAE, and Cengiz, Jamal Khashoggi's fiancee.
He told the BBC that if Pegasus users had managed to listen in to his conversations with his clients, it would have been a "fundamental breach" of privacy.
NSO says it will "continue to investigate all credible claims of misuse and take appropriate action based on the results of these investigations".
Numbers on the leaked list are also said to include those of South African President Cyril Ramaphosa, as well as the current prime ministers of Pakistan, Egypt and Morocco, and the King of Morocco.
More than 600 government officials and politicians from 34 countries are on the list.
- BBC / Reuters