Canadian research team The Cyber Lab has said it had identified that the phones of seven journalists who fled from Belarus or Russia had been infiltrated with Pegasus spyware, made by the Niv, Shalev and Omri (NSO) Group, an Israeli cyber-intelligence firm.

While it is reportedly likely that a European country's intelligence service is behind this, and both the Estonian and Latvian states are reportedly under suspicion, there is no smoking gun evidence linking the cyber surveillance to the Estonian state.

Cyber watchdog The Citizen Lab, based at the University of Toronto, has found that since 2020, the phones of several journalists and public figures who fled from Belarus or Russia had been tapped.

Conservative People's Party of Estonia (EKRE) MP Ants Frosch, who was also the first head of the Estonian Foreign Intelligence Service (välisluureamet, during Frosch's time known as the Teabeamet) and currently a member of the Riigikogu's Special Committee on Supervision of Security Authorities, outlined to ERR's radio news how spyware such as Pegasus works.

"A tapped phone transmits real-time images and sounds from its camera, often even when the phone is not turned on," Frosch said.

"Activation is done in a way that is not externally visible to the user. Consequently, all email exchanges, email history, photo banks, and all phone functions are accessible to the interested organization, which would include intelligence and counterintelligence agencies," the EKRE MP continued.

In a previous case, an attempt was made to infiltrate a phone used by Galina Timchenko, head of Russian dissident publication Meduza.

The Citizen Lab team has now identified seven more cases.

One target was Latvian citizen Yevgeny Pavlov, who has worked for Current Time and Novaya Gazeta Baltija publications.

The remaining six individuals allegedly targeted by the spyware are Russian and Belarusian citizens, one of whom also holds Israeli citizenship. The six had reportedly fled the regimes in Russia and Belarus.

The spyware was not only used against journalists. For instance, it was also found on a phone belonging to opposition politician.

Andrei Sannikov, who ran against Alexander Lukashenko in the 2010 Belarusian presidential elections.

After those elections, Sannikov was imprisoned by the Belarusian KGB, and now operates out of Warsaw.

It is likely that a sovereign state is behind the Pegasus spyware system.

Frosch said: "The company that created it, NSO Group, based in Israel, has very precisely stipulated in its licenses what it can be used for."

"This makes it practically impossible for Pegasus to fall into the hands of random or private individuals. It has always been in the possession of state actors," Frosch went on.

Those researchers who detected the spying emphasize that they are not pointing the finger at any culprit.

However, they have also indicated it is unlikely to be the Polish, Lithuanian, Russian, or Belarusian states.

Instead, there are hints that the intelligence services of Latvia and/or Estonia might be utilizing the Pegasus spyware.

Citizen Lab also claims that, unlike in Latvia, Estonian intelligence services use spyware beyond their sovereign national borders, though presented no evidence to back this, in the articles.

Ants Frosch said: "This is pure speculation, as no evidence has been presented."

"It is conceivable that the Latvian secret services or other agencies have approached Estonian security services in order to monitor specific individuals or their communication devices. This cannot be ruled out," he added.

Frosch said that it is not easy for a Riigikogu committee to address the issue based on pure speculation.

"No evidence has been presented to the Estonian state, and there has been no specific approach by the individuals in question to the Estonian state. However, in general, the Riigikogu's Security Authorities Surveillance Select Committee, has the obligation to monitor this this issue, and it will certainly be brought up as a broader question at the next security committee meeting, that I promise you," he continued.

That next meeting is scheduled for this coming Monday, June 3.

The pieces published on the back of The Cyber Lab's reports seem to reference a 2022 New York Times article, which also described how Estonia procured spyware from Israel.

The American daily reported, citing sources, that Estonia had expressed interest in Israeli software as early as 2018, and made a US$30 million (€27.7 million) advance payment to that end.

A year later, Russia informed the Israeli government that Estonia intended to use its spyware against Russia. This led to a heated debate within the Israeli government, and resulted in a ban on Estonia using the spyware in question against phone numbers of Russian origin.

All that might suggest that Estonian intelligence services use Pegasus only in a limited capacity. However, this is not confirmed either.

Harrys Puusepp of the Internal Security Service (ISS):"This may be a cliché, but we cannot confirm or deny."

Puusepp said the ISS, known in Estonia by the acronym Kapo, for security reasons cannot reveal details of its tactics, but stressed that the decision to put someone under surveillance is not made lightly.

Puusepp said: "The most important thing is that Estonia is a state governed by the rule of law."

"Any infringement on individual fundamental rights must remain in compliance with the Constitution, be based in law, and within the limits thereof. This means that both the security agency involved and the investigative body – if they need to, for example, wiretap someone to fulfill their duties – certainly do not do so on a whim; this is not a simple matter," Puusepp went on.

The request must be presented to a court, together with justification, and the latter must grant permission, he added.

"This is regardless of the tech or measures used – which are state secrets in the case of a security agency," Puusepp added.

Ants Frosch said that nonetheless, the ISS or its foreign intelligence counterpart, the Foreign Intelligence Service, being behind the operation, is not wholly beyond the realms of possibility.

He said: "It is in essence possible that either the ISS or the Foreign Intelligence Service could be behind the surveillance of these seven individual."

While in Estonia, the work of intelligence agencies as noted must be monitored by the courts, plus also the Riigikogu committee, and the Chancellor of Justice, the guarantor of the Constitution, Frosch added that even this oversight could be made more thorough.

Frosch said: "There is internal departmental control, but ministerial oversight is practically non-existent, and is in its infancy. Essentially, the minister or the ministry has to simply trust the heads and officials of the ISS or of the Foreign Intelligence Service. So there is no real control system in place."

In a situation where Russia is planning and carrying out an increasing number of hybrid attacks, it is quite likely that the two, sometimes opposing, values of security and privacy will increasingly rub up against each other, and will remain issues.

Preventing more attacks requires monitoring more people in short, Frosch argued, but confined this to Estonian citizens, in effect declaring the recent case of the seven Russian and Belarusian journalists a moot point, if it is Estonia's security services who are behind the monitoring.

Frosch said: "I wouldn't want to surrender my privacy too easily. I think the Constitution should clearly prevail here, and Estonian citizens should be protected. When it comes to the citizens of other countries, I must say that if they are legitimate targets and related to counterintelligence or intelligence tasks, then that is not really Estonia's problem."

Law-abiding ordinary Estonian citizens have nothing to worry about, Frosch stressed. Concerns are more likely to arise however if the work of intelligence agencies affects, for example, public officials, including high-ranking ones, as opposed to private citizens.

In fact, these people can potentially sign off on this when they get official secrets clearance, or apply to do so.

"I also want to point out that in Estonia, there are still a large number of people who, when applying for state secrets clearance, have handed a blank slate for control measures to be implemented against them. In these cases, there is no need to go to court for this to be sanctioned," the EKRE MP went on.

Ultimately, it comes down to resources. Individuals such as the public officials noted above are not constantly monitored, as apart from anything else, the intelligence agencies are too over-stretched to do so – and not just in Estonia, meaning a "1984" or "V for Vendetta"-type situation may have to remain in the category of fiction for now.

"Someone still has to evaluate the collected material, and there are not too many staff available for this, neither here nor anywhere else in the world.

"So an all-out surveillance society – we are not heading down that route any time soon," he concluded.

Named after the winged horse of Greek mythology, Pegasus is a spyware developed by the NSO Group, to be remotely installed on mobile phones running iOS and Android. Ostensibly an anti-terrorist and anti-crime software, governments around the world have reportedly used Pegasus to surveil journalists, lawyers, political dissidents, and human rights activists.

The spyware is generally capable of reading text messages, call snooping, collecting passwords, location tracking, accessing a target device's microphone and camera, and harvesting information from apps.

The sale of Pegasus licenses to foreign governments must in any case be approved by Israeli defense ministry. 

The Citizen Lab is an interdisciplinary laboratory based at the Munk School of Global Affairs, University of Toronto, Canada. 

--

Follow ERR News on Facebook and Twitter and never miss an update!