Pegasus: The Israeli spyware that helped Saudi Arabia spy on Khashoggi

A year has passed since the brutal murder of Jamal Khashoggi, yet Omar Abdulaziz, a Canada-based Saudi activist and friend of the late journalist, still feels guilty over the hacking of his mobile phone by the Saudi regime which he believes made it possible for them to track conversations between him and Khashoggi.

"The hacking of my phone played a major role in what happened to Jamal, I am really sorry to say, the guilt is killing me," Abdulaziz told CNN in 2018.

CNN was granted access to over 400 WhatsApp messages exchanged by Abdulaziz and Khashoggi. The Saudi journalist used unreserved criticism of the Crown Prince Mohammed bin Salman (MbS0, describing him as a "beast who destroys everyone in his path, including his own supporters".

The correspondence also showed that two Saudi activists were planning to launch projects to combat the authority Twitter trolls of intimidations and threats against Saudi dissents and to try to expose that MbS was mismanaging the kingdom.

In September 2018, Khashoggi wired $5,000 to Abdulaziz who was trying to set up an online movement of Saudi youth, called Electronic Bees, that would fight the Saudi regime's propaganda on social networks.

In fact 11 days before Khashoggi's brutal killing in the Saudi consulate in Istanbul, he wrote on his Twitter account that "the bees were coming".

Now, thanks to Pegasus, the Saudi authority had established a direct line into the thoughts and plans of Khashoggi. His elimination was ordered and the right moment arrived when he entered the Saudi Consulate in Istanbul on October 2, 2018.

	Read also: The Israeli company 'behind' WhatsApp, Khashoggi, Qatari emir hacks

Weeks after the brutal murder, NSA whistle-blower Edward Snowden said that the software, created by NSO Group Technologies, was used to help track Khashoggi, and further, that the Saudis were able to gain information on Khashoggi by spying on Abdulaziz, who is also in exile in Canada.

He condemned NSO as "the worst of the worst" in the murky world of espionage.

NSO’s four founders are said to be former members of the so-called Unit 8200, an Israeli Intelligence Unit responsible for collecting signal intelligence and code decryption. The NSO was founded in 2010, at the Israeli seaside hi-teach hub of Herzliya, near Tel Aviv. The company is currently valued at $1 billion and employs over 600 cyber security experts.

According to its website, they help to develop technology to investigate and prevent serious crime and terror: "We work to save lives and create a better and safer world".

In June 2017, Israeli media reported that Abdullah Al Malihi, a close ally of Prince Turki Al Faisal and Saud al-Qahtani, met in Vienna with two NSO representatives.

Al-Qahtani, often labelled by activists and journalists as the "troll master" or Saudi Arabia’s Mr Hashtag, he was the founder of the "army of electronic flies", a team of cyber attackers who would intimidate and harass dissident Saudi voices like of Khashoggi or Abdulaziz. He also run media operations inside the royal court running media reports against Qatar, Iran and Canada.

According to the Washington Post, Saudi officials pursued Pegasus as part of a surveillance network designed to help the crown prince combat domestic enemies as part of his drive for power.

According to the paper, the sale was partially carried out through a shadowy NSO subsidiary, in Luxembourg, called Q Cyber Technologies. A lawyer for NSO and Q Cyber refused to confirm or deny the sale.

Two years before the murder of Khashoggi, NSO came under fire; in 2016, Citizen Lab and Lookout revealed that Pegasus was being used to target human rights activist Ahmed Mansoor in the United Arab Emirates.

It all started with an innocent text message

In November 2018, Abdulaziz revealed that the hacking was confirmed by Citizen Lab, an outfit at the University of Toronto that studies digital espionage.

The Citizen Lab researchers’ report claimed that a text message disguised as shipping update about a package he had just ordered.

According to them the phone was hacked by a military-grade spyware, Pegasus and it was deployed at the request of the Saudi government.

The CIA reached a similar conclusion and claimed the murder was requested by MbS.

The NSO has previously faced lawsuits from citizens from Mexico and Qatar, who say this very software was used to hack their smartphones. In December 2018, Abdulaziz’s lawyers in Tel Aviv filled a lawsuit against the NSO stating that the selling of Pegasus spyware to despotic regimes is a breach of international law, knowing that it could be used to spy on dissidents.

In June 2018, an Israeli court indicted a former employee of NSO Group for allegedly stealing a copy of Pegasus and attempting to sell it online for $50 million worth of cryptocurrency.

In November 2018, after that the Israeli Newspaper, Haaretz, exposed that NSO offered Saudi Arabia a system for hacking mobile phones, Amnesty International Israel called upon the
Defence Ministry to revoke NSO's defence export license, arguing that it had been proven that its software had been used in "a series of egregious human rights violations"

Pegasus – We got everything on you: How does Pegasus work?

	Read also: Israeli spyware firm implicated in WhatsApp and Arab dissident hacks 'can mine social media data'

Pegasus is NSO Group's most powerful creation, it had been designed to hack iPhones, Android, and other mobile devices remotely, allowing an attacker to access a vast amount of data on a victim, including text messages, calendar entries, emails, WhatsApp messages, user's location, microphone and camera.

It is designed to infect phones without being detected, it is also a highly invasive tool that can reportedly switch on a target’s mobile phone camera and microphone, and access data on it, effectively turning the phone into a pocket spy.

According to Citizen Lab, the software can jailbreak an iPhone when a malicious URL is opened, a form of attack known as spear phishing. The software installs itself and collects all communications and locations of targeted phones, including communications sent through iMessage, Gmail, Viber, Facebook, WhatsApp, Telegram or Skype. Pegasus can also collect Wi-Fi passwords.

In May 2019, Israel Amnesty International and New York University launched a legal case against NSO. According to Danna Ingleton, the Deputy Programme Director, Amnesty Tech "NSO group sells its products to governments who are known for outrageous human right abuses."

An Amnesty Press dated May 13, 2019, reads: "Pegasus spyware was reportedly used by Saudi Arabia to track Jamal Khashoggi".

It also talks about mounting evidence that Pegasus has been used to target parliamentarians in Mexico, Amnesty employees, human rights lawyers and activists like Yahya Assiri, Ghanem Al Masarir, Ahmed Mansoor and the late Jamal Khashoggi.

NSO CEO Shalev Hulio firmly has denied NSO involvement in the tracking of Khashoggi and constantly portrayed NSO as a company that fight terrorism and save lives. "I will say with modesty that thousands of people in Europe owe their lives to the hundreds of workers in Herzliya," he said referring to the Israeli town where the company is based.

Citizens Lab has identified at least six countries with significant Pegasus operations linked to abusive use of spyware to target dissidents, both Saudi Arabia and the United Arab Emirates are included in that list.

Suzan Quitaz is a researcher specialising in counter terrorism and policing, politics and society in Israel and Gulf Affairs