Joint statement: States must take immediate action to stop spyware threatening press freedom

We, the undersigned civil society organisations and individuals, condemn the use of spyware against journalists and media workers – an alarming trend impacting freedom of the press and creating a wider chilling effect on civil society and civic space. Given the profound and overarching threat that spyware and unlawful targeted surveillance poses to freedom of expression, and increasing evidence of how the use of malicious surveillance technologies facilitates and enables related human rights violations, we urge all governments to implement an immediate moratorium on the export, sale, transfer, servicing, and use of digital surveillance technologies, as well as a ban on abusive commercial spyware technology and its vendors. 

Privacy, source protection, and digital security are essential components of press freedom, allowing journalists to protect the confidentiality and integrity of their work and sources. However, as governments and other entities seek to suppress the press and silence dissent, we are seeing an exponential increase in the market for digital surveillance technologies, including spyware, that overrides these journalistic principles. Invasive spyware can infiltrate a target’s phone, giving the attacker full access to emails, messages, contacts, and even the device’s microphone and camera. Even the most secure and encrypted communication platforms are rendered useless. Using spyware allows for the surveillance of journalists, their sources, associates, and family members, putting them at heightened risk of harm, persecution, or prosecution.

When journalists are targeted with spyware, it affects society at large by restricting individuals’ ability to speak securely with the press and to access independent information, and by hindering journalists from revealing corruption and abuse, or holding authorities to account. A free press is the cornerstone of democratic governance, keeping people informed and encouraging the transmission of information and ideas across borders – a key target of the United Nations Sustainable Development Goals (see Goal 16).

From El Salvador to Mexico, from India to Azerbaijan, from Hungary to Morocco, to Ethiopia – the list goes on of countries where investigative journalists working to expose corruption, power abuses, or human rights violations, have been targeted by invasive spyware such as Pegasus. To date, we know of at least 180 potentially targeted journalists in 21 countries – below are just some of the many examples of where spyware has been used against journalists, to silence, intimidate, censor, and suppress their work. 

• In Azerbaijan, as far back as 2015, Khadija Ismayilova, a journalist investigating corruption, was infected with spyware allowing her attackers to eavesdrop on her conversations and track her movements. 
• In El Salvador, the devices of at least 35 individuals, many from media organizations, including staff from El Faro, were infected with Pegasus between 2020 and 2021.
• In Hungary, Andras Szabo and Szabolcs Panyi, who reported on corruption and human rights abuses, were targeted by Pegasus in 2019. 
• In India, Siddharth Varadarajan, investigative journalist and founding editor of independent news website The Wire, was targeted with spyware in 2017. 
• In Mexico, researcher and journalist Ricardo Raphael’s phone was infected with Pegasus spyware multiple times between 2019 and 2020, while in 2015 and 2016, investigative reporter Carmen Aristegui was targeted after uncovering a corruption scandal related to the current Mexican president.
• In Uganda, Raymond Mujuni, an investigative journalist, and Canary Mugume, reporter, were targeted with Pegasus spyware in 2021.

The use of spyware is often accompanied or followed by state-sanctioned physical harassment, assault, and imprisonment, and its reach goes beyond a country’s borders. Moroccan investigative journalist Omar al-Radi was targeted with Pegasus spyware between 2019 and 2021, and later sentenced to six years in prison on bogus rape and espionage charges. Meanwhile journalist Hicham Mansouri, who fled from Morocco to France in 2016 following state harassment and detention, was hacked by Pegasus at least 20 times between February and April 2021. 

Perhaps the most infamous example of how spyware can facilitate and enable transnational repression and serious human rights violations, including enforced disappearance and extrajudicial killing, is the murder of Saudi journalist and dissident Jamal Khashoggi at the Consulate of the Kingdom of Saudi Arabia in Istanbul on October 2, 2018. Both prior to and after his death, Mr. Kashoggi’s family members and acquaintances were targeted by Pegasus spyware.

It is clear that the use of spyware and unlawful targeted surveillance violates the fundamental rights of freedom of expression and access to information, peaceful assembly and association, freedom of movement, and privacy. Considering how widespread its use against individuals is, and how their fundamental rights are violated as a result, we call on all countries, who have a duty to respect, protect and fulfill individual rights, to:

1. Implement an immediate moratorium on the export, sale, transfer, servicing, and use of targeted digital surveillance technologies until rigorous human rights safeguards are put in place to regulate such practices;
2. Where there is evidence that commercial spyware technology facilitates or enables human rights abuses, implement a ban on said technology and its vendors;
3. Hold the companies who develop and distribute these technologies, and their investors, accountable for their failure to respect human rights and for the role they play in enabling abusive end uses, and demand transparency from said companies around their clients and practices, in particular regarding their data collection and processing practices;
4. Reaffirm protections for all journalists and media workers and safeguard press freedom, by recognizing that journalists and media workers are not legitimate surveillance targets for practicing their work;
5. In documented cases of abuse against the media, establish accountability and remedy mechanisms for surveillance victims;
6. Leverage existing processes, including the Universal Periodic Review, UN Plan of Action on the Safety of Journalists, UN resolutions on the Safety of Journalists, the UNESCO Observatory on Killed Journalists and related monitoring reports, and other norm-development and remedial processes, to ensure that commitments to limit the abusive use of surveillance technologies, including spyware, translate to appropriate action, laws, and policies on targeted surveillance aligned with international human rights standards;
7. Create national gender-responsive prevention and protection mechanisms to ensure journalists’ safety online, based on multi-stakeholder participation and standards grounded in the international human rights framework.

Signatories:

Civil society organisations

Access Now, Acción Constitucional, Advocacy for Principled Action in Government, Al-Haq, ALQST For Human Rights, ALTSEAN-Burma, ApTI, ARTICLE 19, Bulatlat, Citizen D, Committee to Protect Journalists, Conexo, Cooperativa Tierra Común, Cultivando Género AC- México, CyberPeace Institute, Daraj, Democracy for the Arab World Now (DAWN), Digital Defenders Partnership, Digital Society, Switzerland, Electronic Frontier Finland, Epicenter.works, European Center for Not-for-Profit Law (ECNL), European Digital Rights (EDRi), European Sex Workers Rights Alliance (ESWA), Freedom House, Gong, Heartland Initiative, Hiperderecho, Hivos, Hungarian Civil Liberties Union, INSM, IPANDETEC – Centroamérica, IT-Pol, KENYA HUMAN RIGHTS COMMISSION, Manushya Foundation, Masaar, Egypt, Media Foundation for West Africa, MENA Rights Group, Organization for Identity & Cultural Development (OICD.net), Paradigm Initiative, Privacy International, Project on Organizing, Development, Education, and Research (PODER), R3D: Red en Defensa de los Derechos Digitales,Red Line for Gulf, Reporters Without Borders (RSF), Robert F. Kennedy Human Rights, SocialTIC, Statewatch, Sursiendo, Surveillance Technology Oversight Project, TEDIC – Paraguay, The Collaboration on International ICT Policy for East and Southern Africa (CIPESA), The Syrian Center for Media and Freedom or Expression (SCM), The Tahrir Institute for Middle East Policy (TIMEP), Transparentem

For the full list of signatories, click here.