The Illusion of Digital Freedom: The Case of Pegasus Spyware

August 6, 2021 12:40 am || By

Over the years, discourses surrounding freedom in the digital realm have intensified. From data protection to cyber espionage, such discourses are quite diverse. However, one thing that stands out amidst these discourses is how the government or government-related actors monitor the digital activity of citizens, which is often done without their consent or lawfully done. The most recent case of digital espionage by government or government-related actors is Pegasus Spyware. NSO Group, the maker of the spyware, stated that the product was sold to government clients with the intention to collect data from mobile devices of specific individuals suspected to be involved in serious crimes or terrorism. However, an international journalism investigation has found that the spyware has been misused. According to a leak received by Forbidden Stories, more than 50,000 phone numbers had been the target of Pegasus, comprised of activist, opposition politicians, journalist, lawyers, or dissidents[1]. This leak proved that the notion of digital freedom is currently still unachievable. In this article, the writer will argue that the continuous misuse of spyware such as Pegasus or any other spyware programs will jeopardize the notion of digital freedom, and there should be an international regime to regulate the use and proliferation of spyware in order to protect freedom in the digital realm.

Digital freedom is part of a concept called internet freedom. So far, there hasn’t been any universally-accepted definition of internet freedom. The concept itself was an amalgamation of concepts such as digital rights, freedom for information, and net neutrality. In this article, digital freedom and internet freedom will be more closely-related to digital rights, which deal with human rights in cyberspace[2]. In the case of Pegasus spyware or any other cyber surveillance method, the discourse tends to lean more on rights, such as freedom of speech and right to privacy. Pegasus works by exploiting vulnerabilities in mobile devices, aiming to seize full control of the said device operating system. By controlling the device’s operating system, the perpetrator can disable its security features and deploy more software that will further secure the perpetrator’s remote access[3]. The aims of the perpetrator are usually surveillance, censorship of oppositions and dissidents, monitor private communications, and criminalization of users for expressing their view and opinion[4]. The state usually tries to justify such practices under national security or public safety considerations, and some states even have legislation to strengthen their claim. State actors that usually use spyware are typically authoritarian or non-democratic regimes, however, liberal democracies in this case often turned a blind eye and even sold the spyware itself to these regimes. For examples, companies based in Canada, France, and United States provided spyware tools to regimes around the world[5]. If this continues to be the case, then freedom in the digital or cyber realm would just be an illusion.

Currently, there are still no international regimes in place that control spyware. By having an international regime, states and other actors will have to act according to a set of expectations, standards, and behavior[6]. According to a United Nations (UN) special rapporteur on freedom of expressions, states should impose an international moratorium on the export, sale, transfer, use of privately developed spyware until there are rules in place[7]. More recently, Amnesty International also voiced the need of an international moratorium on spyware[8]. However, the creation of an international regime is highly difficult, especially when there are sharp divergences of interest between actors. Suggestion for global moratorium won’t be in motion if actors decide that this issue isnot a priority, as reflected during the 2021 UN Cybersecurity Open-Ended Working Group (OEWG). OEWG 2021 was hailed as a success in elevating the issue of cybersecurity to be an issue that is discussed by all U.N. members[9]. However, OEWG 2021 still mostly discussed about cybersecurity between state actors, not cybersecurity that is related to freedom of speech and citizens’ digital privacy.

In conclusion, the issues surrounding digital freedom have intensified over the years, including  regarding digital surveillance of citizens by governments. The disclosure of Pegasus case and other spyware scandals could further fuel public outrage against the practices of the implicated governments, while at the same time also force governments in liberal democracies to push the issue of freedom and privacy in the cyber realm to be discussed and handled on the international level. To note, Pegasus spyware scandal is only one example of practices that could monitor and control targeted devices. In this case, the absence of an international regime in place that deals with this issue is all the more concerning: to alleviate this issue in the long run, there is a clear need to advance the existing discussion beyond inter-state cyber matters, as was done in  OEWG 2021, and focus more on individual rights. Additionally, implicated government actors must evaluate their practices, while liberal democracies can push the issue of cyber freedom and privacy to be discussed on the international level, such as discussion on the UN-level so that an international regime can be established, and finally state and other actors will have to act according to a set of expectations, standards, and behavior.

Author: Maula Mohamad Haykal
Editor: Heidira Witri Hadayani


References

Alais, O. (2020). Internet Freedom: Fighting Back Against Digital Authoritarianism [online]. Georgetown Journal of International Affairs. Available at: https://gjia.georgetown.edu/2020/07/24/internet-freedom-fighting-digital-authoritarianism/ (Accessed 24 July 2021).

Aljazeera (2021). Amnesty seeks moratorium on surveillance technology [online]. Available at: https://www.aljazeera.com/news/2021/7/24/amnesty-urges-moratorium-on-pegasus-surveillance-technology#:~:text=The%20rights%20group%20warns%20of,industry%20on%20human%20rights%20worldwide’.&text=In%20a%20Friday%20statement%2C%20the,industry%20on%20human%20rights%20worldwide%E2%80%9D. (Accessed 25 July 2021).

Bradford, A. (2007). Regime Theory [online]. Max Planck Encyclopedia of Public International Law. Available at: https://scholarship.law.columbia.edu/faculty-scholarship/1970 (Accessed 25 July 2021).

Feldstein, S. (2021). Governments Are Using Spyware on Citizens. Can They Be Stopped? [online]. Carnegie Endowment for International Peace. Available at: https://carnegieendowment.org/2021/07/21/governments-are-using-spyware-on-citizens.-can-they-be-stopped-pub-85019 (Accessed 25 July 2021).

Forbidden Stories (2021). About The Pegasus Project [online]. Available at: https://forbiddenstories.org/about-the-pegasus-project/ (Accessed 24 July 2021).

Gold, J. (2021). Unexpectedly, All UN Countries Agreed on a Cybersecurity Report. So What? [online]. Council on Foreign Relations. Available at: https://www.cfr.org/blog/unexpectedly-all-un-countries-agreed-cybersecurity-report-so-what#:~:text=Cyberspace%20Policy%20Program-,Unexpectedly%2C%20All%20UN%20Countries%20Agreed%20on%20a%20Cybersecurity%20Report.,malicious%20state%20behavior%20in%20cyberspace.v (Accessed 25 July 2021)

Haskell-Dowland, P. and Musotto, R. (2021). How does the Pegasus spyware work, and is my phone at risk? [online]. The Conversation. Available at: https://theconversation.com/how-does-the-pegasus-spyware-work-and-is-my-phone-at-risk-164781 (25 July 2021).

Miles, T. (2019). U.N. surveillance expert urges global moratorium on sale of spyware [online]. Reuters. Available at: https://www.reuters.com/article/us-socialmedia-un-spyware-idUSKCN1TJ2DV (Accessed 25 July 2021).

Pavlopa, P. (2021). Human Rights Defenders in Cyberspace: A Litmus Test for Cybersecurity [online]. Global Policy. Available at: https://www.globalpolicyjournal.com/blog/11/05/2021/human-rights-defenders-cyberspace-litmus-test-cybersecurity (Accessed 25 July 2021).


[1] Forbidden Stories (2021). About The Pegasus Project [online]. Available at: https://forbiddenstories.org/about-the-pegasus-project/ (Accessed 24 July 2021).

[2] Alais, O. (2020). Internet Freedom: Fighting Back Against Digital Authoritarianism [online]. Georgetown Journal of International Affairs. Available at: https://gjia.georgetown.edu/2020/07/24/internet-freedom-fighting-digital-authoritarianism/ (Accessed 24 July 2021).

[3] Haskell-Dowland, P. and Musotto, R. (2021). How does the Pegasus spyware work, and is my phone at risk? [online]. The Conversation. Available at: https://theconversation.com/how-does-the-pegasus-spyware-work-and-is-my-phone-at-risk-164781 (25 July 2021).

[4] Pavlopa, P. (2021). Human Rights Defenders in Cyberspace: A Litmus Test for Cybersecurity [online]. Global Policy. Available at: https://www.globalpolicyjournal.com/blog/11/05/2021/human-rights-defenders-cyberspace-litmus-test-cybersecurity (Accessed 25 July 2021).

[5] Feldstein, S. (2021). Governments Are Using Spyware on Citizens. Can They Be Stopped? [online]. Carnegie Endowment for International Peace. Available at: https://carnegieendowment.org/2021/07/21/governments-are-using-spyware-on-citizens.-can-they-be-stopped-pub-85019 (Accessed 25 July 2021).

[6] Bradford, A. (2007). Regime Theory [online]. Max Planck Encyclopedia of Public International Law. Available at: https://scholarship.law.columbia.edu/faculty-scholarship/1970 (Accessed 25 July 2021).

[7] Miles, T. (2019). U.N. surveillance expert urges global moratorium on sale of spyware [online]. Reuters. Available at: https://www.reuters.com/article/us-socialmedia-un-spyware-idUSKCN1TJ2DV (Accessed 25 July 2021).

[8] Aljazeera (2021). Amnesty seeks moratorium on surveillance technology [online]. Available at: https://www.aljazeera.com/news/2021/7/24/amnesty-urges-moratorium-on-pegasus-surveillance-technology#:~:text=The%20rights%20group%20warns%20of,industry%20on%20human%20rights%20worldwide’.&text=In%20a%20Friday%20statement%2C%20the,industry%20on%20human%20rights%20worldwide%E2%80%9D. (Accessed 25 July 2021).

[9] Gold, J. (2021). Unexpectedly, All UN Countries Agreed on a Cybersecurity Report. So What? [online]. Council on Foreign Relations. Available at: https://www.cfr.org/blog/unexpectedly-all-un-countries-agreed-cybersecurity-report-so-what#:~:text=Cyberspace%20Policy%20Program-,Unexpectedly%2C%20All%20UN%20Countries%20Agreed%20on%20a%20Cybersecurity%20Report.,malicious%20state%20behavior%20in%20cyberspace.v (Accessed 25 July 2021)