Data from an investigation into Israeli spyware company NSO Group’s Pegasus technology shows that over a dozen current, former, and future world leaders were selected as potential targets of the spyware.
As well as run-of-the-mill ministers, diplomats, and civil servants, a list of numbers obtained by the Pegasus Project reveals that prime ministers, presidents, and even King Mohammed VI of Morocco were selected for targeting.
Typically, these high-profile figures appear to have been selected by countries that are rivals or curious neighbors. That is the case with French President Emmanuel Macron, Iraqi President Barham Salih, and South African President Cyril Ramaphosa.
But Kazakhstan’s current president and prime minister, a circle of people close to the current president of Mexico, and both the king and prime minister of Morocco appear to have been selected by their own countries.
In a statement to Pegasus Project journalists, NSO Group said the phone records are “not a list of targets or potential targets of NSO’s customers.” The company said that Emmanuel Macron and King Mohammed VI “are not, and never have been, targets or selected as targets of NSO Group customers.”
The Pegasus Project is an international collaboration of more than 80 journalists from 17 media organizations, including OCCRP, that was coordinated by French journalism non-profit Forbidden Stories. Numbers for heads of states were identified and verified by reporters from a leaked list of over 50,000 phone numbers in around 50 countries. The list is believed to represent numbers that have been selected for targeting by NSO Group’s clients.
Forensic Analyses Support Pegasus Project Conclusions
Pegasus is able to infect a cell phone without the target having to click on a link, read a message, or answer a call. Once installed, Pegasus can extract data, conversations, contacts, and call logs from the victim’s phone. It can even switch on microphones and cameras to silently record live audio and video.
“The states that purchase this kind of software don’t discriminate between different types of targets,” said Nate Schenkkan, Director of Research Strategy at U.S.-based human rights group Freedom House. “They’re just going to use it however they feel like.”
“As a leader or politician or official, everyone has to use some kind of device. And if you allow people to buy and sell the capacity to enter any of those devices, anywhere in the world … you’re eventually asking for everyone’s devices to be compromised.”
Succession Selections
Among the top officials on the list were Kassym-Jomart Tokayev, Kazakhstan’s current president, and Askar Mamin, the country’s prime minister. Bakytzhan Sagintayev, the prime minister until February 2019, was also selected.
Based on the clustering of the Kazakhstani numbers in the data, and previous revelations that Kazakhstan uses Pegasus software, Pegasus Project journalists conclude that the user of the surveillance system was likely the Kazakhstani state.
At the time of the selections, which took place in 2017 and 2018, Tokayev was not yet president of Kazakhstan. Instead, he was the number two to the country’s longtime ruler, Nursultan Nazarbayev. An imposing figure who assumed office in 1991, Nazarbayev ruled as president for almost three decades before stepping aside in 2019. But he did not throw himself into a quiet retirement.
Nazarbayev continues to exert significant control over the country and holds the title Elbasy, meaning “Leader of the Nation.” He is the chairman of the Security Council and ruling party Nur Otan, is immune from prosecution, and retains control of military and security issues.
Nazarbayev handpicked Tokayev to replace him in March 2019. “I believe that Tokayev is precisely the person who we can trust to lead Kazakhstan,” Nazarbayev said at the time. He also appointed Mamin to replace Sagintayev as prime minister.
Tokayev and Mamin had been selected as potential targets while still serving in their previous roles: Tokayev was chair of the senate, officially next in line for the presidency, and Mamin was first deputy prime minister.
Since assuming office, Tokayev has attempted to develop a reputation as a reformist, but has remained staunchly loyal to his predecessor. Mamin, a technocrat with little reputation for ambition, also poses little threat to Nazarbayev’s continued influence.
Domestic Focus
Pegasus Project reporters spotted a similar pattern in Mexico, where dozens of close contacts of current President Andrés Manuel López Obrador were selected as potential targets for a Pegasus attack in the run-up to his election victory.
When López Obrador ran for president in 2018, his young new party, Morena, posed a threat to a ruling party that had dominated Mexican politics since the late 1920s. The extent of this threat may be reflected in the selection of cell phone numbers for some of his closest family members — his wife, three of his sons, and three brothers.
The family phone numbers were selected in the two years leading up to the 2018 election. So were numbers for his cardiologist, his head of communications, his consultant on international matters, and even his former driver. In total, as many as 26 people in López Obrador’s circle had their phone numbers selected. The most likely user of the Pegasus software in this case is Mexico.
“Now we are learning that they also spied on my wife, my sons, even my doctor,” López Obrador told reporters. “Apart from the issue of this spying, imagine how much it cost! How much money went for this spying?”
Leaks of private conservations between López Obrador’s family and Morena party officials seemed designed to disrupt the election campaign. An alleged call between his son, Andrés Manuel López Beltrán, and the party’s secretary general, Yeidckol Polevnsky, in which they supposedly discussed party financing, was recorded and leaked in an effort to undermine López Obrador’s anti-corruption platform.
Elsewhere, Moroccan agents seem to have selected phone numbers belonging to some of the most important figures in their own country: Prime Minister Saad Eddine el- Othmani and even King Mohammed VI.
High Stakes Diplomacy
Evidence strongly indicates that the three sitting presidents in the Pegasus Project records – Macron, Salih, and South Africa’s Ramaphosa – had their phone numbers selected by foreign states. Salih’s number appears among many connected to both Saudi Arabia and the United Arab Emirates (UAE) while Ramaphosa’s is among numbers connected to Rwanda.
Pakistan’s Imran Khan and Egypt’s Mostafa Madbouly are the other two sitting prime ministers (besides el-Othmani) whose cell phones were potentially targeted. As well as Kazakhstan’s Sagintayev, there were six other former prime ministers on the list, each of whom was in office at the time their numbers were selected: Édouard Philippe (France), Saad Hariri (Lebanon), Noureddine Bedoui (Algeria), Ruhakana Rugunda (Uganda), Ahmed Obeid bin Daghr (Yemen), and Charles Michel (Belgium). The prime minister of Burundi, Alain-Guillaume Bunyoni, was apparently selected by Rwanda before he took office.
Evidence from the phone records indicates that Khan was selected by India, Madbouly by Saudi Arabia, bin Daghr by the UAE, Hariri by both the Saudis and the UAE, Rugunda by Rwanda, then Philippe, Bedoui, and Michel all appear to have been selected by Morocco.
Michel, who has been the President of the European Council since 2019, told reporters from the Pegasus Project: "We were aware of the threats and measures were taken to limit the risks."
Macron also appears to have had his number selected by Morocco in the first half of 2019. Around the same time a number of French ministers and officials also had their numbers selected, including Macron’s key adviser on Africa, Franck Paris, and Alexandre Benalla, who was then in charge of Macron’s security.
A clue to the motive may lie in Morocco’s interest in Algeria, Morocco’s giant neighbor, which was gripped by a political crisis around the time Macron and French officials were selected for targeting. In March 2019, following protests, long-time Algerian leader Abdelaziz Bouteflika withdrew from a scheduled election and delayed the vote. The prime minister resigned and a new government was formed.
Pegasus Project records show that an Algerian diplomat, Lakhdar Brahimi, was selected for targeting around the same time as Macron. So was Ramtane Lamamra, a powerful figure in the new Algerian government, and the French ambassador to Algeria, Xavier Driencourt.
Two crucial summits for Morocco — the G5 Sahel and the African Union — were scheduled for 2019. Morocco’s contested interest in Western Sahara, attempts to finally ratify an African Union trade agreement, and the developing crisis in Algeria, were likely discussed by Macron and his emissaries on the fringes of these summits. The Pegasus Project records indicate that Morocco may have wanted to be a fly on the wall at these meetings.
Additional reporting by Ilya Lozovsky and the Pegasus Project, including Craig Timberg, Michael Birnbaum, Reed Albergotti, Karen DeYoung, Drew Harwell, John Hudson, Dana Priest, Niha Masih, Joanna Slater, Mary Beth Sheridan of the Washington Post, Sam Sole of the investigative nonprofit amaBhungane in South Africa, Damien Leloup and Martin Untersinger of Le Monde, Dan Sabbagh, Michael Safi and David Pegg of the Guardian, Bastian Obermayer and Frederik Obermaier of Süddeutsche Zeitung, Kristof Clerix from Knack, Joël Matriche from Le Soir, Alia Ibrahim, Hala Nasreddine, and Hazem Amine from Daraj, Holger Stark from Die Zeit, Jacques Monin from Radio France, and Sandrine Rigaud from Forbidden Stories.
