Hacking Meduza: Pegasus spyware used to target Putin’s critic 3 of 4 https://www.accessnow.org/publication/hacking-meduza-pegasus-spywa... Kazakhstan, or Uzbekistan — may have hacked Meduza on behalf of Russia. In May 2023, an investigation by Access Now and partners revealed that Azerbaijan is a potential culprit behind the targeting of media workers and other civil society actors in Armenia. Notably, Kazakhstan itself has blocked Meduza over a controversial article. However, according to the Citizen Lab, there is no evidence of Azerbaijan or Kazakhstan targeting people in Germany, Latvia, or other E.U. states. Also, Uzbekistan is not believed to have been a Pegasus customer during the period in question. Finally, as we have seen with the state targeting of independent media and journalists in countries from El Salvador to Hungary, it is possible Timchenko’s own government — Russia — is behind the hacking. As we have noted, the attack happened just two weeks after Russia designated Meduza an “undesirable organization,” which, unlike the “foreign agent” designation, immediately criminalizes all activities of an organization, requiring it to shut down. Meduza also experienced a spike in digital attacks in February 2023; for example, attackers blocked mirror websites, and engaged in phishing and other efforts to compromise user accounts. However, according to the Citizen Lab, there is currently no evidence that the Russian government is operating the Pegasus system. Experts on Russia’s intelligence services, like journalist Andrei Soldatov, are not convinced that Russia has been using Pegasus. // Spyware violates human rights and international humanitarian law Whether during war or peace, surveillance of journalists and independent media by intrusive spyware like Pegasus is prohibited under E.U law, international human rights law, and international humanitarian law. Sophisticated spyware like Pegasus, which bypasses encryption and takes full control of the victim’s phone, including access to photos, messages, and contacts, as well as the phone’s camera and microphone, represents an existential threat to journalists and media freedom globally. Such spyware jeopardizes journalists’ ability to safely do their work and protect the confidentiality of their sources. Civil society has documented that it can also facilitate domestic and transnational repression and serious human rights violations, including torture, enforced disappearance, and extrajudicial killings, such as the murder of the Washington Post journalist Jamal Khashoggi. UN officials, the European Parliament, the European Data Protection Supervisor, and civil society actors from around the world have widely condemned the use of spyware against journalists and human rights defenders. The U.S. government has placed NSO Group and other spyware makers on its Entity List and has banned the federal government from using certain commercial spyware due to the severe human rights and national security risks. The International Committee for Red Cross and Red Crescent (ICRC) experts have stated that the use of spyware against civilians in a context of conflict “exposes civilians to harm, affects their rights, safety, and dignity.” // Call for action All States � Implement an immediate moratorium on the export, sale, transfer, servicing, and use of targeted digital surveillance technologies until rigorous human rights safeguards are put in place to regulate such practices; � Where there is evidence that commercial spyware technology facilitates or enables human rights abuses, implement a ban on said technology and its vendors; 7/5/2024, 3:46 PM