A member of the House of Lords is amongst greater than 400 folks whose UK cell phone numbers seem in a leaked listing of numbers recognized by NSO Group’s shopper governments between 2017 and 2019, the Guardian can reveal.
The principal authorities chargeable for deciding on the UK numbers seems to be the United Arab Emirates, in accordance with evaluation of the information. The UAE is one in every of 40 international locations that had entry to the NSO spy ware that is ready to hack into and secretly take management of a cell phone.
Dubai, the emirate metropolis dominated by Sheikh Mohammed bin Rashid al-Maktoum, can be believed to have been an NSO shopper.
The telephones of Sheikh Mohammed’s daughter Princess Latifa, who launched a failed bid to flee Dubai in 2018, and his ex-wife Princess Haya, who fled the nation and got here to the UK in 2019, each seem within the knowledge.
So too do the telephones of a number of associates of each girls – together with, within the case of Haya, principally UK-based numbers.
In a number of statements, NSO stated that the truth that a quantity appeared on the leaked listing was under no circumstances indicative of whether or not a quantity was focused for surveillance utilizing Pegasus. “The listing isn’t a listing of Pegasus targets or potential targets,” the corporate stated. “The numbers within the listing usually are not associated to NSO group in any approach.”
However the Guardian and different media companions that had entry to the information as a part of the Pegasus venture, a media consortium, consider the listing signifies individuals of curiosity chosen by authorities purchasers of NSO. It consists of folks internationally whose telephones confirmed traces of NSO’s spy ware, Pegasus, in accordance with forensic evaluation of their gadgets.
These with UK numbers showing on the listing embrace:
Girl Uddin, an unbiased member of the Home of Lords, whose quantity appeared on the information in each 2017 and 2018. She stated if there was spying on members of parliament it will quantity to “an incredible breach of belief” which “contravenes our sovereignty”.
A lawyer working for a London legislation agency advising Princess Haya. Haya is embroiled in a bitter custody battle with Sheikh Mohammed within the household division of the excessive courtroom of justice.
John Gosden, a number one horse coach based mostly in Newmarket, who can be good friend of Princess Haya, herself a global equestrian rider. Numbers for different folks working for Haya’s safety and PR workforce additionally seem within the knowledge.
John Chipman, the chief government of the defence thinktank the Worldwide Institute for Strategic Research, which runs an annual convention in Bahrain, one of many UAE’s allies.
Matthew Hedges, a Briton detained with out trial within the UAE for 5 months in 2018, whose quantity first seems within the knowledge whereas he was within the UK, earlier than embarking on his journey. “I need to know what the British authorities is doing about it,” he stated.
Different high-profile UK names who seem on the listing have already been named, corresponding to Roula Khalaf, the editor of the Financial Times, who was deputy editor when her quantity appeared within the knowledge in 2018. NSO later stated there have been no tried or profitable Pegasus infections of Khalaf’s telephone.
Earlier this week, the Guardian additionally revealed the itemizing of the variety of the human rights lawyer Rodney Dixon QC, who has acted for each Hedges and the fiancee of the murdered Saudi journalist Jamal Khashoggi, Hatice Cengiz. Evaluation of the information suggests his quantity was amongst a small group of UK numbers that seem to have been chosen by Saudi Arabia.
Attorneys for NSO urged it was “technically unimaginable” for Dixon’s telephone to be focused by Saudi Arabia. Forensic evaluation of Dixon’s system carried out by Amnesty Worldwide’s Safety Lab confirmed Pegasus-related exercise however no profitable an infection.
Amnesty examined two different UK telephones within the knowledge. One confirmed the identical sort of Pegasus exercise found on Dixon’s iPhone. The second, an Android telephone, confirmed no proof of an tried or profitable an infection.
Neither the United Arab Emirates, Dubai nor Saudi Arabia responded to requests for remark. Until Dunckel, a German lawyer representing Sheikh Mohammed, instructed the newspaper Süddeutsche Zeitung: “Our shopper emphatically denies having tried to ‘hack’ the telephones of the individuals named in your request, or having instructed others to take action.” Representatives of the sheikh have additionally beforehand stated he feared Latifa was a sufferer of a kidnapping and that he had carried out “a rescue mission”.
NSO Group has at all times stated it doesn’t have entry to the information of its clients. In statements issued through its lawyers, NSO stated the Pegasus venture reporting consortium had made “incorrect assumptions” about which purchasers used the corporate’s expertise.
Exiled dissidents and supportive activists within the UK additionally appeared on the leaked listing, which is sure to lift questions concerning the UAE, which is historically thought of a British ally, and whose main household, the rulers of Abu Dhabi, personal the Premier League champions, Manchester Metropolis.
The UAE has develop into a fast-emerging cyber energy, whose highly effective surveillance functionality is managed by the household of its ruler, Sheikh Mohamed bin Zayed, and specifically his brother, the nationwide safety adviser, Sheikh Tahnoon bin Zayed.
Three sources conversant in NSO’s operations confirmed that throughout the previous 12 months the corporate had stripped Dubai of its Pegasus licence. They stated the choice had been knowledgeable primarily by human rights issues, however didn’t dispute that the chance Sheikh Mohammed was wielding the software program in opposition to his circle of relatives members had additionally been an element.
It’s unclear whether or not MI5 was conscious of any UAE spying exercise. Usually if the spy company turns into conscious a Briton is topic to international surveillance, it solely takes motion to alert the sufferer if it believes there’s a menace to life or different critical hazard within the UK.
However the British authorities issued a coded rebuke to the nation this week following the revelations of the Pegasus venture.
A authorities spokesperson stated: “It’s important all cyber actors use capabilities in a approach that’s authorized, accountable and proportionate to make sure our on-line world stays a protected and affluent place for all.”
Why sure folks could have been listed is tough to find out. Uddin was the primary Muslim lady to serve within the higher home, however isn’t thought of a international coverage specialist. “If espionage is going down in opposition to the very best of sovereign British establishments, questions come up concerning whether or not our authorities was conscious,” she stated.
Matthew Hedges, a Durham College PhD pupil specialising in safety, was first listed on the database in March 2018, two months earlier than he was detained and tortured with out trial for 5 months, accused of spying for MI6. The preliminary itemizing of his quantity within the knowledge passed off earlier than Hedges had travelled to the UAE for his analysis.
MI6 denies he was performing as an agent, in a high-profile case that strained relations between London and Abu Dhabi. Hedges was topic to repeated interrogations that lasted hours and was injected with a cocktail of medication on which he’s partly dependent at present, however was solely charged after being held for 5 months.
It was not attainable to conduct forensic evaluation of Hedges’ UK telephone from the time as a result of UAE authorities confiscated his system.
Mohammed Kozbar, the chair of the Finsbury Park mosque, arguably the best-known mosque in Britain, additionally appeared on the leaked listing. His quantity appeared within the knowledge in 2018, apparently due to the UAE. The mosque was comprehensively reformed in 2015 below his management, and is taken into account a mannequin of group relations, performing just lately as a public vaccination centre.
Kozbar stated he was baffled as to why he may need been of curiosity to the Gulf state, saying he had “by no means been within the UAE” nor had any involvement with the nation. He stated he feared that “British residents might be open to abuse from each nation on the planet” except the UK spoke out in opposition to obvious abuses of NSO spy ware worldwide.
Dissidents – a few of whom centered on Saudi Arabia or Bahrain – and not less than one British activist have additionally appeared within the listing. They embrace the Emirati-born Alaa al-Siddiq, 33, the manager director of the Saudi marketing campaign group ALQST, who was killed in a automotive crash in Oxfordshire final month. After speaking to the police her organisation stated there was “no suggestion of foul play”.
One other one who seems within the knowledge in 2018 was the main Bahraini dissident and human rights campaigner Saeed Alwadei, who has political asylum within the UK. He was additionally chosen by a buyer understood to be the UAE, though he campaigns for democracy and rights in Bahrain, significantly across the time of the grand prix, held that 12 months in April.
He known as on the UK authorities to “converse out and cease defending these abusive governments”.
A quantity belonging to Rori Donaghy was chosen by UAE all through 2017 and 2018, in accordance with evaluation. He was beforehand reported to have been a goal of a UAE hacking marketing campaign unrelated to NSO.
He labored for 3 years till 2016 for Center East Eye, a UK-based information organisation that repeatedly criticised the UAE regime. However on the time his quantity appeared within the knowledge he was working for a specialist Center East consultancy, writing reviews about Syria and the refugee disaster.
The variety of the president of the Muslim Affiliation of Britain, Raghad Altikriti, the primary feminine head of the organisation, additionally seems on the listing. She was beforehand a vice-president and head of media, and her brother Anas Altikriti, who runs the Cordoba Basis thinktank, which promotes intercultural dialogue, was listed between 2017 and 2019.
The numbers of a number of staff of three London company intelligence companies additionally appeared on the listing. In a single case, it seems the top of the agency was chosen by the UAE together with two numbers belonging to his spouse. All three companies work for Gulf state purchasers.