András Szabó, Hungarian Journalist

The Pegasus Project
Investigation

“I started thinking about what these hackers were able to find out about me through my phone’s data. Were they searching for my sources? Did any of them get into trouble?”

Banner: Svetlana Tiourina

July 18, 2021

I received an unusual call in mid-April. My colleague Szabolcs Panyi said he wanted to speak with me in person that day. This alone would not have been strange, but it was unusual that he didn’t reply to any of my questions, even though we were talking on a safe channel we’d previously used to discuss a number of sensitive topics.

My curiosity was fired up. I couldn’t stop thinking about what could be behind Szabolcs’s mysterious call.

When I arrived at our editorial office at six in the evening, the situation became even more mysterious. Szabolcs and my other colleague, András Pethő, asked me to turn off my phone. I thought maybe we were awaiting the arrival of an important source, someone close to the government.

Instead, to my surprise, a French investigative journalist stepped into our office. He briefly introduced himself and asked for my permission to record on camera what was about to happen. After I said yes, the door of our office opened again and two other journalists appeared. They needed no introduction, since I had already seen them many times in photographs. I even owned a copy of a book they’d written on the Panama Papers investigation, which they spearheaded.

And now Bastian Obermayer and Frederik Obermaier were standing in front of me. They are real superstars in journalistic circles. Although I consider myself a serious movie fan, I could not have been more excited if I’d bumped into Hollywood celebrities such as Adam Driver or Robert Pattinson on the street. However, it was instantly sobering when I learned they were working on a story I had unwittingly become part of.

Szabolcs finally started talking. The story he told was like something out of a spy movie. He said that his phone had been hacked, presumably by an intelligence service. Bastian and Frederik were playing a leading role on an international team of journalists investigating the hack. They found that the same unknown service seemed to have broken into my phone as well.

I found all this incredible. First of all, I didn’t understand how I could have become a target. Although I have written some important stories that I am proud of, it didn’t seem to me like they weakened the positions of the people I investigated.

Moreover, I did not even understand how all this could have happened, as we are always so cautious about security at Direkt36. We don’t communicate via phone or chats, but use an application called Signal, which is theoretically impossible to hack. I protect my phone and laptop with passwords. I use two-factor identification for my e-mail and social media accounts. And I choose my passwords on the basis of what I learned at cybersecurity workshops for journalists. But this time, even all this caution was not enough, as hackers used so-called zero-day vulnerabilities of my phone to access my data.

I started thinking about what these hackers were able to find out about me through my phone’s data. Were they searching for my sources? Did any of them get into trouble?

After an examination of my device, the German journalists could tell that my iPhone had been hacked at least two times: on June 13, 2019, and September 24, 2019. They wondered if I remembered doing anything around those dates that could have drawn the hackers’ attention.

After a quick search, I remembered that three weeks before my hacking in June, I published an article about Antal Rogán, the minister in charge of Prime Minister Viktor Orbán’s Cabinet Office, who has been leasing luxury cars in an expensive but stealthy way for years so that his name could stay hidden. For this story, I drew on internal documents containing some sensitive information for this story. The other hacking occurred two weeks after I published an investigation into the government ties of Lajos Oláh, a politician with DK, one of Hungary’s largest opposition parties.

Later, my colleague András also noticed that the two hacks occurred suspiciously close to dates when I traveled abroad for work. On June 15, 2019, two days after my phone was broken into, I traveled to the United States to participate in a two-week State Department program on fighting propaganda and disinformation. In September 2019, only a few days after the second hacking of my phone, I was returning from Warsaw, where I had participated in a conference on press freedom.

I still don’t have answers to most of my questions. I do not know who the hackers worked for, or why they found me interesting. I’ve also struggled to process the situation since I haven’t been able to talk about it with anyone other than the journalists in the room that day in April, to avoid jeopardizing the ongoing investigation.

After the meeting, I tried to settle my thoughts. So after I got home, I took Bastian and Frederik’s Panama Papers book off the shelf and started reading it.