On June 23, 2023, hours before Yevgeny Prigozhin would shock the world by staging a mutiny against the Russian military, Meduza co-founder and CEO Galina Timchenko learned that her iPhone had been infected months earlier with “Pegasus.” The spyware’s Israeli designers market the product as a crimefighting super-tool against “terrorists, criminals, and pedophiles,” but states around the world have abused Pegasus to track critics and political adversaries who sometimes end up arrested or even murdered. Access to Pegasus isn’t cheap: Researchers believe the service costs tens of millions of dollars, meaning that somebody — some government agency out there — paid maybe a million bucks to hijack Timchenko’s smartphone. Why would somebody do that? How would somebody do that? And who could have done it?

For answers, The Naked Pravda turned to two experts: Natalia Krapiva, tech-legal counsel for Access Now, a nonprofit organization committed to “defending and extending” the digital civil rights of people worldwide, and John Scott-Railton, a senior researcher at Citizen Lab, an interdisciplinary laboratory at the University of Toronto that investigates digital espionage against civil society.

Timestamps for this episode:

(3:39) Galina Timchenko’s hacked iPhone is the first confirmed case of a Pegasus infection against a Russian journalist
(6:16) NSO Group’s different contract tiers for Pegasus users
(9:59) How aware is NSO Group of Pegasus’s rampant misuse?
(12:29) Why hasn’t Europe done more to restrict the use of such spyware?
(15:50) Russian allies using Pegasus
(17:58) E.U. members using Pegasus
(21:37) Training required to use Pegasus and the spyware’s technical side
(27:38) The forensics needed to detect a Pegasus infection
(35:46) Is Pegasus built more to find criminals or members of civil society?
(40:10) Imagining a global moratorium on military-grade spyware
(43:22) “A German solution”
(45:14) Where the West goes from here

Как поддержать нашу редакцию — даже если вы в России и вам очень страшно

The Pegasus spyware attack on Meduza

The Naked Pravda