Hacking Meduza: Pegasus spyware used to target Putin’s critic 2 of 4 https://www.accessnow.org/publication/hacking-meduza-pegasus-spywa... the government went even further and blocked Meduza’s website. Finally, in January 2023, Putin’s regime officially outlawed Meduza, classifying it an “undesirable organization,” a more serious designation. This action drew strong condemnation from the Organization for Security and Cooperation in Europe (OSCE), International Press Institute, European Federation of Journalists, and others. Other independent media organizations, such as TV Rain, The Insider, Novaya Gazeta, The Moscow Times, Mediazona, DOXA, as well as human rights NGOs, like Memorial, OVD-Info, Golos, Sakharov Center, and many others, have likewise faced escalating persecution in recent years, especially since Russia’s 2022 full scale invasion of Ukraine. They have been targeted under various designations, blocked, banned, and disbanded. In addition, Meduza, like many other Russian independent media and human rights organizations, was also heavily impacted by tech and financial companies’ over-compliance with sanctions against Russia. Blocked and criminalized in its own country, Meduza was unable to receive donations from supporters inside Russia due to Western payment services pulling out. Despite the enormous financial challenges, the organization continued to do its work. Horrifically, Russian independent journalists have also faced suspected poisoning attacks while seeking refuge in Europe. In October 2022, Elena Kostyuchenko, Novaya Gazeta and Meduza journalist, was allegedly poisoned in Germany. Her symptoms were similar to those experienced by other Russian journalists, activists, and dissidents criticizing Putin’s regime. // Who is behind this Pegasus attack? Pegasus is designed to obfuscate which government is behind a particular attack, making it difficult for us to attribute. However, based on NSO Group’s assertion that Pegasus is only sold to state agencies and the available technical and circumstantial evidence, there are several theories of which state is likely behind the attack. Meduza’s host state, Latvia, could have been responsible, as they appear to be a Pegasus customer. However, according to the Citizen Lab, there has not been any indication of Latvia using Pegasus to spy outside of its borders. Germany, where Timchenko was staying at the time of her phone’s infection, is another potential culprit, as they also appear to be a Pegasus customer, although the reported German customer is a police agency, rather than an intelligence agency. Two other reported European Pegasus customers, the Netherlands’ General Intelligence and Security Service (AIVD) and an unnamed Estonian government agency, appear to use Pegasus extensively outside their borders, including within multiple European countries, according to the Citizen Lab. While there are claims that NSO Group does not allow Estonia to target Russian phone numbers, Timchenko’s phone number has a Latvian country code (+371). The E.U. PEGA Committee revealed at least 14 E.U. states and 22 operators of Pegasus in the E.U. In fact, just two months before Timchenko’s phone was infected, Latvia declared another independent media organization in exile — TV Rain — to be “a threat to the national security and public order” and canceled its license. This decision was criticized by the Latvian Association of Journalists as “disproportionate.” Other E.U. leaders, like the president of the Czech Republic, Petr Pavel, have publicly stated that all Russians living in the West should be put under “strict surveillance” as the price of Russia’s war against Ukraine. The public pressure on E.U. leaders to demonstrate support for Ukraine in the face of Russia’s aggression may be deepening the risks for Russian independent media groups like Meduza that are already in danger because they seek to hold Putin accountable. Another possibility is that states with ties to Russia that are suspected Pegasus users — Azerbaijan, 7/5/2024, 3:46 PM