A Proposed Response to the Commercial Surveillance Emergency

The body of Jamal Khashoggi has yet to be found, and the case of his murder is littered with unanswered questions. There are a number of certainties about the gruesome crime, however, backed up by evidence, including that some of his most private communications were monitored by Saudi intelligence.

Khashoggi used encrypted chats to communicate with his closest associates. If he assumed that technology shielded his secrets, as it was programmed to do, he was mistaken. While the condition of Khashoggi’s own personal devices remains unclear, ultimately it does not matter if they had been compromised. The phone of a close confidant, Omar Abdulaziz, had been hacked by Saudi intelligence and his communications with Khashoggi were being silently monitored.

Abdulaziz lives in Canada. Neither his distance from the kingdom nor that hacking into his phone violated Canadian law presented the Saudis with much of an obstacle.

Abdulaziz's phone was hacked using Pegasus, a notorious piece of spyware developed by NSO Group, a cyberwarfare company based in Herzliya, Israel. Pegasus is among some of the most sophisticated spyware available on the market and can infiltrate both iOS and Android devices. It also allows an operator to read text messages, including those that are end-to-end encrypted; examine photos; and track a phone’s location. The technology can also silently enable microphones and cameras, turning the phone into a portable surveillance tool to overhear and observe conversations happening in the phone’s vicinity.

Using NSO Group’s technology, Saudi agents monitored Khashoggi and Abdulaziz as they planned a social media campaign against the Saudi regime. They cannot have missed the biting words the men shared about Saudi Crown Prince Mohammed bin Salman. In the eyes of the Saudi rulers, such criticism—even in private—is treasonous and worthy of a death sentence. Khashoggi’s murder was thus intimately tied to unlawful use of spyware technology, as Agnes Callamard, the U.N. special rapporteur on extrajudicial, summary or arbitrary executions, described in her June 2019 report to the Human Rights Council.

The Use of Surveillance Technology to Silence Dissent

This connection between spyware and the silencing of dissent is not an isolated incident.

Citizen Lab—along with organizations such as R3D, Privacy International, EFF and Amnesty International—has closely tracked the deployment of surveillance technology against political dissidents, lawyers, journalists and human rights defenders. In 2013, Citizen Lab started publishing technical reports on the deployment of spyware beginning with surveillance technology sold by FinFisher. It expanded to cover research on products developed by other companies, including Hacking Team; Cyberbit, a subsidiary of Elbit Systems; and, more recently, NSO Group. On NSO Group, Citizen Lab has identified a total of 27 individuals targeted with Pegasus spyware.

Amnesty International has also documented two cases of abusive targeting with Pegasus: one against an Amnesty International staff member who remains anonymous and another against Saudi activist Yahya Assiri. Other documented incidents of targeting include those against Ghanem al-Masarir, a Saudi dissident living in the United Kingdom, and a U.K.-based lawyer involved in litigation against NSO Group.

While the instances of unlawful targeting listed above have been publicly reported, there are likely numerous others that have not yet been discovered (and may never be, due to problems inherent in tracking such secretive technology). Conside