Respond to prefers-color-scheme dark in app web views

Follow section front redirects in Spectrum

Enable NLP source in PCS for load testing

Switch off the News Alerts Survey Widget when we have enough responses

Poll to determine if new LUF updates are available

Allows the winning A/B test variant to be turned on without Spectrum deployment

Show infinite scrolling sections in Assembler MultiView

Show option for NLP article summaries in Action Bar

A general feature flag for Recipe Features that aren't yet released

Feature flag for media team features that aren't yet released

Use new Orca video player for preroll plugin in Spectrum

Show the snow tracker (instead of the heat tracker) on Spectrum

After years of delay, Boeing to try again with Starliner space capsule

Divided Trump campaign weighs joining TikTok, the app he tried to ban

Google’s empire is massive. A judge will soon rule if it’s a monopoly.

The new cure-all for vacation excess: the IV drip 

What’s the best bus to New York? We tested 5 for comfort and value.

You asked: Do I need a passport for my cruise?

In photos: The 150th running of the Kentucky Derby

University of Michigan graduation disrupted by protesters

Protesters clash with law enforcement at U-Va.

The Post endorses April McClain Delaney and Tom Royals for Maryland’s 6th District

On Press Freedom Day, little to celebrate for Hong Kong’s journalists

Young Georgians want to be part of Europe. Their government is in the way.

Strangers help Sesame Street puppeteer after heirloom necklace was stolen

Teen grabs wheel when driver passes out and school bus veers into traffic

Cat climbed into Amazon return box, found alive 630 miles away

The New York Times, alone in its outrage over access to Biden

The ‘Access Hollywood’ video cemented Trump’s air of invincibility

Stephen A. Smith would like even more of your attention

Carolyn Hax: Working for a celebrity has this employee feeling ‘small’

Ask Amy: I live with my boyfriend – and his sister and her family

Miss Manners: Is it inappropriate to reach out to old girlfriends?

Trump escalates attacks on prosecutors, says Democrats run ‘a Gestapo administration’

Top RNC lawyer resigns after rift grows with Trump

How Pope Francis opened the Vatican to transgender sex workers

Israeli cabinet votes to shut Al Jazeera’s Israel operations; cease-fire talks ongoing

Residents accuse Israeli forces of executions during West Bank raid

A frank look at hot dog prices at MLB ballparks

Sloppy first inning dooms the Nationals in a 6-3 loss to the Blue Jays

In a pinch, the Nationals finally find some offense

Big Tech news and how to take control of your data and devices

See more coverage in your recommendations

Technology

Tips delivered to your inbox twice weekly

The Tech Friend newsletter

Business and Tech alerts

Alexander Zemlianichenko

The iPhone of a prominent Russian journalist whose news outlet has effectively been outlawed by President Vladimir Putin was infected with Pegasus spyware this year, researchers say, in the first known case of the powerful eavesdropping tool being used against a significant Russian target.

The spyware appears to have been installed while the phone’s owner, Galina Timchenko, owner of the news outlet Meduza, was in Germany for a meeting with other Russian journalists in February — raising questions about who hacked her phone while in a Western democracy.

<a href="https://www.accessnow.org/publication/hacking-meduza-pegasus-spyware-used-to-target-putins-critic" target="_blank">Access Now</a>, a nonprofit that defends digital rights, and the <a href="https://citizenlab.ca/2023/09/pegasus-infection-of-galina-timchenko-exiled-russian-journalist-and-publisher/" target="_blank">University of Toronto’s Citizen Lab</a> say they confirmed the Pegasus infection after Timchenko received an alert this summer from Apple that spyware may have been planted on her phone.

Pegasus, a creation of the Israeli company NSO Group, can be installed on a phone remotely without the phone’s owner clicking a link or taking other action. Once installed, Pegasus can access everything including a phone’s contact list and its internal microphone and camera. It’s been used against <a href="https://www.washingtonpost.com/technology/2021/12/03/israel-nso-pegasus-hack-us-diplomats/" target=_blank>American diplomats</a>, human rights activists, journalists and dissidents across the globe. The Biden administration in 2021 said NSO’s operations were contrary to U.S. interests and <a href="https://www.washingtonpost.com/technology/2021/11/03/pegasus-nso-entity-list-spyware/" target=_blank>added the group to the Commerce Department’s entity list</a>, prohibiting American companies from doing business with it without a special license.

NSO has long said it sells licenses for Pegasus only to governments for legitimate law enforcement purposes. A person familiar with NSO operations, who spoke on the condition of anonymity to discuss the matter, said the Russian government is not a client.

Researchers said they couldn’t determine who was behind the infection after analyzing Timchenko’s phone. Leading suspects include Russia and a number of its neighbors, they say.

That mystery points to a disturbing trend, said David Kaye, a former U.N. special rapporteur who investigated the proliferation of commercial spyware during his time there from 2014 to 2020.

“When we see cases like this, at some level we need to, want to, know who the perpetrator is,” said Kaye, now a professor at the University of California at Irvine’s School of Law who did not play a role in analyzing Timchenko’s phone. “But at the same time, when you have such a globally unregulated tool, it’s just going to become part of the norm — that human rights defenders, activists, journalists, opposition figures and so forth are going to be regular targets.”

Apple notified Meduza in June about the possible hack.

The date of the suspected infection was Feb. 10, when Timchenko was visiting Germany for a Feb. 11 meeting with other Russian journalists in exile to discuss new restrictions that their home country had imposed on the internet and the media.

The month before, Moscow had labeled Meduza — which claims more than 10 million monthly readers, most inside Russia — an “undesirable organization,” effectively outlawing the publication.

Why cybersecurity experts say you should update your iPhone ASAP

Timchenko said she had been accustomed to harassment on the streets of Russia from “propagandists” before relocating Meduza to Riga, Latvia’s capital, in 2014. But this was different. “I never expected to be a target for spyware.”

“I decided that maybe I did something wrong. Maybe I didn't follow security protocols,” she said. “And it was approximately half an hour of a nightmare. But then when I realized that this is not my fault at all, that it just happens, I became angry.”

Timchenko was most worried that whoever planted the spyware on her phone obtained her contact lists.

“To know that your vast network of contacts can be targeted even when you’ve done all that you should professionally in order to protect yourself and your sources, it’s really, to my mind, pretty frightening,” Kaye said. “It’s absolutely essential for journalists to be protected so that governments and their publics get access to information.”

Also worrisome is the possibility that the perpetrators might have activated the microphone on Timchenko’s device to listen in on what the Russian journalists were discussing at their February meeting, said Natalia Krapiva, tech legal counsel at Access Now.

Apple unveils new security feature to block government spyware

Spyware poses a particular threat to democracy when it hits journalists, said John Scott-Railton, senior researcher at Citizen Lab.

“In a democracy, it is very important that journalists be able to do their jobs, and the only way you get people comfortable saying true things is if they can sometimes tell them to journalists discreetly with a degree of privacy,” he said. “Pegasus rips that source protection apart and makes it impossible for careful journalists to really be sure that they’re able to do what their ethics require.”

Spyware also poses a direct risk to journalists themselves. The widow of murdered Washington Post contributing columnist Jamal Khashoggi has filed a lawsuit against NSO Group, alleging that the firm’s technology spied on him in the months leading up to his demise.

Each of the top suspects have their own mix of capabilities and motivations for eavesdropping on Timchenko.

Meduza, as an independent news outlet that reaches readers in Russia, is a “big target” for the Russian government, Timchenko said. At the same time, researchers have seen no evidence that Russia is an NSO Group client.

The Israeli Defense Ministry approves export licenses for Pegasus that have reportedly ended up in the hands of repressive regimes like Saudi Arabia. But Russia may be too risky for Israel to approve a Pegasus license for, Krapiva said.

Access Now named Latvia another suspect as the headquarters of Meduza, citing a recent hostile turn toward another exiled Russian outlet, TV Rain, <a href="https://www.reuters.com/business/media-telecom/latvia-cancels-license-russian-independent-television-station-tv-rain-2022-12-06/" target=_blank>whose Latvian government license was canceled</a> after it was labeled a national security threat. Citizen Lab has suspected Estonia, a Latvian ally, of conducting cross-border spyware infections before.

Other possible suspects include Russian-allied nations Azerbaijan, Kazakhstan and Uzbekistan. Timchenko theorized that a Russia-friendly nation could have infected her phone on Moscow’s behalf.

“NSO only sells its technologies to allies of the US and Israel and always investigates credible allegations of misuse, taking prompt action if warranted,” the company said in a statement.

Germany only acknowledged its use of Pegasus after its purchase of the spyware was exposed in a 2021 news investigation, sparking widespread criticism from rights groups.

German officials have insisted that investigators in its police and intelligence agencies only use a version of the software that is adapted to comply with the limits of the country’s legal system, without giving details of how that is ensured. Rulings by Germany’s Federal Constitutional Court enshrine the right to confidentiality on electronic devices and restrict state hacking to cases where there are “extremely important legal interests” such as a threat to life or the security of the state.

Spyware opponents worry what it means for Timchenko’s phone to have been infected while she was in Germany, a member of the European Union.

“Democracy is under threat by big actors like Russia,” Scott-Railton said. “And Europe has served as a tremendous countervailing force to the invasion in Ukraine. It is especially troubling to see techniques that one would expect to be used by anti-democratic powers showing up within the borders of the E.U.”

Access Now flagged Germany as a possible suspect in the infection of Timchenko’s phone, but a German member of the European parliament who sat on a committee that conducted oversight of spyware cast doubt on that idea given the limited form of Pegasus the government obtained, among other reasons.

“I would be very surprised that they would use it on an anti-regime Russian journalist inside Germany,” said the member, Hannah Neumann. Still, she said a German legislative panel with oversight of German intelligence agencies should look into what happened, because Timchenko is “the kind of person who should be able to find refuge and be protected in Germany. And apparently, because this stupid technology exists, and because there is not much willingness on an international level to regulate it, we can’t.”

Germany’s government press office referred questions to the interior ministry, which declined to comment.

Germany notably did not sign a <a href="https://www.whitehouse.gov/briefing-room/statements-releases/2023/03/30/joint-statement-on-efforts-to-counter-the-proliferation-and-misuse-of-commercial-spyware/" target="_blank">U.S.-led joint statement</a> in March among nations vowing to take specific steps to combat the proliferation of spyware.

The Biden administration has won plaudits from activists over what it has done to fight spyware, especially an executive order committing to limit the federal government’s own use of spyware following criticism of the FBI for <a href="https://www.washingtonpost.com/technology/2022/02/02/pegasus-fbi-nso-test/" target=_blank>flirting with an NSO Group contract</a>.

Rep. Jim Himes (Conn.), the top Democrat on the House Intelligence Committee who has <a href="https://www.washingtonpost.com/politics/2022/07/25/congress-joins-fight-over-foreign-spyware/" target=_blank>championed legislation</a> signed into law to restrict U.S. intelligence agencies’ use of spyware, said stories like Timchenko’s are a “dispiriting” example of the ongoing problem.

“If it turns out to be the Russians, surprise, surprise, put that on the list of dictatorial things Russia does,” Himes said. “I would be particularly concerned, however, if it turned out to be one of our NATO allies, one of the democracies.”

In Europe, a parliamentary committee that wrapped up its investigation of Pegasus this summer said several member nations did not cooperate with its probe. The Parliamentary Assembly of the Council of Europe said last week that five nations, including Azerbaijan, must investigate spyware abuses and also called on Israel to explain how it ensures Pegasus won’t violate human rights.

Citizen Lab assessed with “moderate confidence” that the offenders got into Timchenko’s phone via a zero-click exploit that the lab <a href="https://citizenlab.ca/2023/04/nso-groups-pegasus-spyware-returns-in-2022/" target=_blank>highlighted in April</a> that targeted Apple’s HomeKit and iMessage.

Apple says it doesn’t share the number of spyware notifications it has sent out to users. But it did <a href="https://www.washingtonpost.com/technology/2021/11/23/apple-pegasus-lawsuit-spyware-nso/" target=_blank>file a lawsuit against NSO Group in 2021 </a>to block the company from using any Apple products or services “to prevent further abuse and harm to its users.”

Access Now is contemplating additional legal action against NSO Group in response to the infection of Timchenko’s phone.

But the full answer to spyware can’t come from Apple or Timchenko, Scott-Railton said.

“This is not really a user behavior problem,” he said. “It’s why it’s not just an Apple problem. It has to be a policy problem and a government problem, because this stuff is very dangerous, very effective, is not going away and isn’t easy to mitigate the effects of in any other approach.”

The widespread use of technology in daily life means spyware poses a risk to everyone, Krapiva said.

“The general public following these infections might think, ‘This is all interesting, but really I have nothing to hide,’” she said. “‘Why will the government be interested in me?’ And I think the more and more revelations that we have, we also see all kinds of all kinds of constituencies being affected — media, journalists, politicians, but also university professors, some individuals that you would think have nothing sensitive.”

Access Now is investigating other hacking incidents in Eastern European that it said it doesn’t have permission to discuss. “I do hope that once this goes public that more victims would want to come forward because I think it is important,” Krapiva said.

<i>Loveday Morris in Berlin contributed to this report.</i>

2022 American Society of Business Publication Editors, Bronze National Award, Government Coverage

2022 American Society of Business Publication Editors, Silver Regional Award, Government Coverage

2022 American Society of Business Publication Editors, Bronze Regional Award, Single Topic Coverage by a Team

2022 Society of Professional Journalists Washington, D.C., Chapter, Finalist, Staff

2021 Best in Business Awards, Honorable Mention, Technology, Small Division (for editing role)

2009 National Press Club Sandy Hume Memorial Ward for Excellence in Political Journalism

2001 Indiana Associated Press Managing Editors, 1st Place, Non-Deadline News Reporting (with another reporter)

2001 Hoosier State Press Association, 3rd Place, Business Writing (team project)

University of Southern Indiana, BA in Print Journalism

Tim Starks is the author of the Cybersecurity 202 newsletter at The Washington Post. He previously served as senior editor at CyberScoop and ran Politico's cybersecurity newsletter. The Evansville, Ind., native also has held reporting roles for CQ Roll Call, the New York Sun and the Evansville Courier & Press.

Tim Starks

washpost

NSO’s Pegasus hacked Meduza’s Galina Timchenko’ iPhone, Citizen Lab says

the-washington-post

Russia Opposition

Help Desk

Artificial Intelligence

Internet Culture

Space

Tech Policy

Tech

prism://prism.query/site,/technology/tech-policy&limit=20

prism://prism.query/site,/national-security&limit=20

Sign up for Fact Checker, our weekly review of what's true, false or in-between in politics.

National Security

The Washington Post's coverage of national security issues, including the military, intelligence, justice, and foreign policy.

prism://prism.query/two-sites,/technology,/politics/powerpost/the-technology-202?limit=20

prism://prism.query/site,/world/europe&limit=20

Europe

The Washington Post provides the latest information and analysis on UK and European news. Includes news from the European Union, European commission news and European parliament news.

prism://prism.query/site-articles-only,/world/&limit=20

World

The Washington Post World section provides information and analysis of breaking world news stories. In addition to our world news and video, Post World News offers discussions and blogs on major international news and economic issues.