The use of Pegasus spyware should be banned in the EU, the bloc’s data watchdog has advised, as it is a “gamechanger” offering unprecedented powers to intrude into targets’ lives.
The European data protection supervisor (EDPS) said a prohibition was necessary as the software, developed by the Israeli NSO Group, was able to secretly turn a mobile phone into a surveillance device.
Able to send or receive encrypted messages, download stored photographs, hear voice calls, access messages and secretly film through a phone’s camera, the spyware had the capacity to interfere “with the most intimate aspects of our daily lives”, the authority said.
“The mounting evidence shows that highly advanced military grade spyware like Pegasus has the potential to cause unprecedented risks and damages not only to the fundamental freedoms but also to democracy and the rule of law”, a report from the EDPS said.
“Pegasus constitutes a paradigm shift in terms of access to private communications and devices, which is able to affect the very essence of our fundamental rights, in particular the right to privacy. This fact makes its use incompatible with our democratic values”.
The EDPS said a “ban on the development and deployment of spyware with the capability of Pegasus in the EU” was the best course of action given the software’s capacity for harm.
Last year a group of media organisations including the Guardian revealed that Pegasus software was being used against journalists, activists and politicians in numerous countries, including in Europe.
The investigation by the Guardian and 16 other media organisations was based on forensic analysis of phones and a leaked database of 50,000 numbers, including that of the French president, Emmanuel Macron, the European Council president, Charles Michel, and other heads of state and senior government, diplomatic and military officials in 34 countries.
NSO Group has previously said the figure of 50,000 was “exaggerated” and that the database could not be a list of numbers “targeted by governments using Pegasus”.
The EDPS noted in its report that a number of member states had admitted to buying the spyware, and it said the true list of customers “may prove bigger” as “it appears that a number of member states have at least initiated negotiations with NSO Group for the licensing of the product”.
The group of media outlets’ analysis of phones in Europe suggested that journalists, activists and lawyers in Hungary had been targeted with Pegasus. A senior Hungarian government official appeared to confirm in November that the state had bought the software, but this was later denied and ministers have since declined to comment.
The Hungarian Data Protection Authority has been examining the claims and an investigation has been launched by the Budapest regional office of the Hungarian prosecution service.
In Poland, a senate commission saw documents in January that suggested the country’s Central Anti-Corruption Bureau (CBA) had bought Pegasus in 2017 using funds from the justice ministry. Law and Justice, the lead party in the governing coalition, has boycotted the commission in the opposition-led senate.
As MEPs in Strasbourg debated the EU’s response to the EDPS report, France’s EU affairs minister, Clément Beaune, condemned the use of surveillance software for infiltrating phones but said limitations on an individual’s privacy could be necessary to fight crime and terrorism.
“The use of surveillance software can only be the exception,” he said. “This kind of surveillance constitutes such a severe intrusion into private life that it can only be used under the strictest conditions.”
The European commissioner for justice, Didier Reynders, echoed Beaune’s comments but said the commission was monitoring the investigations taking place in Hungary and Poland.
He said: “I’m aware that the Hungarian Data Protection Authority knows the conclusion of its investigation into the matter. We understand that an investigation by the Budapest regional office of the Hungarian prosecution service is still ongoing. I am also aware that in Poland, the senate special committee is examining the use of Pegasus. I would like to assure you that the commission continues to closely follow the issue and that we are gathering information in this regard.”
The European parliament is expected to launch a committee of inquiry in April into the use of Pegasus within the EU, with intelligence agencies, officials and elected ministers expected to be called to give evidence.
NSO Group has said it will not confirm or deny whether particular countries were clients. It also insists its tools are only meant for use against criminals and terrorists and should not be used on dissidents, activists or journalists.
