In 2022, Human Rights Watch documented war crimes against Armenian prisoners of war, and the region suffered a massive blockade that left tens of thousands without basic necessities. Researchers found that most spyware victims were infected during and after the war.
“Most of those targeted were those working on topics related to human rights violations,” says Donncha Ó Cearbhaill, head of Amnesty International’s security lab.
Although researchers could not conclusively determine who was behind the surveillance, NSO Group has consistently stated that it licenses its products only to governments, particularly law enforcement and intelligence agencies. Previous reports revealed that Azerbaijan, Bahrain, Kazakhstan, Mexico, Morocco, Rwanda, Saudi Arabia, Hungary, India, Togo and the United Arab Emirates were all likely customers of the group NSO. In 2022, the company said it would no longer sell to non-NATO countries.
A Pegasus infection is a “zero-click” attack, meaning the victim does not need to open a suspicious email or click on a bad link. “No amount of behavior could have protected these people from this spyware,” says John Scott-Railton, a senior researcher at Citizen Lab.
While Pegasus has historically been used by government officials against their own populations, particularly activists and journalists, for whom the company has faced international scrutiny, Scott-Railton says its use beyond borders in conflict is of particular concern. “NSO always says, ‘We sell our products to fight crime and terrorism,’ which obviously suggests that the reality goes beyond that,” he says.
Although Scott-Railton says it’s unclear what information was sought from victims, the Pegasus software gives almost unprecedented access to everything on an infected phone. It also allows the supervisor to turn on the microphone or camera remotely, turning the device into a “pocket spy”. “It’s the kind of thing that could potentially… change or influence the course of a conflict.”
Nowhere is this more evident than in the experience of one victim, Anna Naghdalyan, a former spokesperson for the Armenian Foreign Ministry. As part of her duties, Naghdalyan had extensive knowledge of the ceasefire negotiations between Armenia and Azerbaijan, with “all the information about the war on my phone”, she told Access Now.
“It is one thing for a state to use a tool like this against military adversaries on the battlefield,” says David Kaye, former UN special rapporteur on the right to freedom of opinion and of expression and clinical professor of law at the University of California. , Irvine. But the possibility of surveillance across borders in times of conflict “raises not only human rights concerns, but also national security concerns.”
According to the report, if humanitarian organizations were caught in the surveillance trap, the use of Pegasus could constitute a violation of international law, which protects aid workers in conflict situations.
“Aid workers are considered non-combat, so efforts to infiltrate their communications or conduct surveillance for military advantage over aid workers and humanitarian facilities are prohibited in most cases,” explains Raymond , co-head of the humanitarian research laboratory and lecturer. at the Yale School of Public Health.
“Whichever state uses this measure, there needs to be a thorough investigation and accountability,” says Ó Cearbhaill.
