Journalist targeted by Pegasus spyware says her sources — and her loved ones — are at risk

Read story transcript

Khadija Ismayilova says she knows it's not her fault that her friends and family members may have been targeted by military-grade spyware, but she still feels responsible.

The Azerbaijani investigative journalist is one of dozens of reporters, human rights activists, political dissidents and more whose phones were infected by a malware program developed by the world's most infamous hacker-for-hire outfit, according to an investigation by a global media consortium.

What's more, she has reason to believe her friends, family members and even some casual acquaintances have been targeted as well.

"I was devastated. It's like you feel like you have to wear this sign, 'I'm dangerous,' so people don't get close to you. If they get close to you, they will be endangered as well," Ismayilova, who is based in Baku, Azerbaijan, told As It Happens guest host Susan Bonner. 

"I know that it's not my fault. It's the government's fault, or those who produce this spyware are guilty of that. But still, people are [at] risk because of me."

Amnesty International: 'We are not safe'

The joint investigation into the widespread use of Pegasus malware by authoritarian governments was conducted by 16 media organizations in collaboration with Amnesty International and Forbidden Stories, a Paris-based nonprofit media organization.

Pegasus was developed by the Israel-based company NSO Group. Once installed on a phone, it can be used to extract text messages, photos and emails, secretly activate cameras or microphones and even read conversations on encrypted messaging apps such as WhatsApp and Signal. 

Amnesty and Forbidden Stories obtained a leaked list of more than 50,000 cellphone numbers, which they say belong to people identified as potential surveillance targets by NSO clients.

Those clients, according to consortium member the Guardian, include the governments of Azerbaijan, Bahrain, Kazakhstan, Mexico, Morocco, Rwanda, Saudi Arabia, Hungary, India and the United Arab Emirates.

So far, the consortium of journalists has identified more than 1,000 individuals in 50 countries from the leaked list. They include 189 journalists, more than 600 politicians and government officials, at least 65 business executives, 85 human rights activists and several heads of state. 

While a phone number's presence on the leaked list does not mean an attempt was made to hack a device, the consortium have already started to unearth the sophisticated spyware on several of the suspected targets' phones. 

"The evidence provided by this frankly bombshell investigation proves that the spyware is used in an extensive, if not systematic global way, to target … journalists, human rights defenders, politicians of the opposition, and indeed, even friends," Agnès Callamard, secretary general of Amnesty International, told CBC Radio's The Current.

"That is the major takeaway: We are not safe. There is a weapon out there that is unregulated and can go after anyone."

Ismayilova's number was on the list. She has since confirmed that Pegasus was active on her phone. 

The surveillance didn't come as a complete shock to her. She's an outspoken critic of the government in Azerbaijan and has been previously jailed on what she and her supporters allege are trumped up charges meant to silence her. 

"I was suspecting that some sort of surveillance was happening. But on this scale, it was really gross," she said. 

What she didn't anticipate, though, was finding several phone numbers for people she knows, both professionally and personally, on the leaked list. Even her go-taxi driver's number was there. 

"They are not sources," she said. "Friends [with] whom I am playing backgammon, for example, they are in the list."

Our work is based on trust. And this trust is broken, not because of me. This trust is broken because the government has broken into my life.- Khadija Ismayilova, investigative journalist 

In an emailed statement to The Associated Press — which, itself, has two reporters on the list — the NSO Group denied that it has ever maintained "a list of potential, past or existing targets."

The company insisted it only sells Pegasus to "vetted government agencies" for use against terrorists and major criminals, and that it has no visibility into its customers' data. 

Ismayilova doesn't buy it. She says if NSO really wanted to limit the spyware's use to criminal investigations, the it would require its clients provide court orders greenlighting their surveillance plans. 

What's more, NSO's list of clients includes governments that are widely known for human rights abuses and the violent quelling of dissent, she said. 

"If they would Google, make due diligence before choosing the client, they would understand that the Azerbaijani government is notorious for using surveillance technology against critics of the government, activists and journalists instead of terrorists and criminals," she said.

Ismayilova says she's not only worried about her friends and family, but about the safety of her sources, and her ability to keep doing her job now that she knows she can't trust her own phone. 

"I am endangered. My family members are endangered. The sources whom I'm talking to are endangered," she said. 

"Our work is based on trust. And this trust is broken, not because of me. This trust is broken because the government has broken into my life, and it will take time to develop a new strategy on how to get in touch with sources and people who were valuable sources of information."

Written by Sheena Goodyear with files from The Associated Press and The Current. Interview with Khadija Ismayilova produced by Chris Harbord.