Resolution 2513 (2023)1Provisional version

Pegasus and similar spyware and secret state surveillance

Parliamentary Assembly

1. In July 2021, an international coalition of investigative journalists co-ordinated by Forbidden Stories,with the technical support of Amnesty International’s Security Lab (“the Pegasus Project”), publishedinformation about a leaked list of over 50 000 phone numbers identified as potential targets by clients of NSOGroup, an Israeli company that developed and globally markets a spyware called Pegasus. This list includedhuman rights defenders, political opponents, lawyers, diplomats, Heads of State and nearly 200 journalistsfrom 24 countries. 11 countries around the world were identified as potential NSO clients, including twoCouncil of Europe member States, Azerbaijan and Hungary.

2. Subsequent investigative reports, including by CitizenLab of the University of Toronto, have revealedthat governments of several Council of Europe member States have acquired and used Pegasus for targetedsurveillance of their own citizens. It is known that Pegasus was sold to at least 14 European Union countries,including Belgium, Germany (in a modified version), Hungary, Luxembourg, the Netherlands, Poland andSpain. There is strong evidence that Azerbaijan has also used it, including during the conflict with Armenia.Other member States have acquired or used similar spyware, such as Candiru and Predator. These toolshave not only been used within the jurisdiction of member States but they have also been exported to thirdcountries with authoritarian regimes and a high risk of human rights violations, including Libya (under theGaddafi regime), Egypt, Madagascar and Sudan. These exports have potentially breached EU export rules.

3. The Parliamentary Assembly notes that Pegasus is a highly intrusive surveillance spyware, whichgrants the user complete and unrestricted access to all sensors and information on the targeted mobilephone. It turns the smartphone into a 24-hour surveillance device, accessing the camera and microphone,geolocation data, e-mails, messages, photos, videos, passwords, and applications. While some spywarerequire some action on the part of the victim, such as clicking on a link (for instance, Predator) or opening anattachment, Pegasus is installed through a so-called “zero-click attack”. Given its unprecedented level ofintrusiveness into the private life of the targeted individual and all their contacts, the Council of EuropeCommissioner for Human Rights and the European Data Protection Supervisor have expressed seriousdoubts as to whether its use could ever meet the proportionality requirement and therefore be human-rightscompliant.

4. The Assembly shares these concerns and believes that the use of Pegasus-type spyware should belimited to exceptional situations as a measure of last resort, to prevent or investigate a specific act amountingto a genuine and serious threat to national security or a specific and precisely defined serious crime, and onlytargeting the person suspected of committing or planning to commit those acts, and always under courtsupervision. In order to limit such a high level of intrusiveness, States should take into account theproportionality of new spyware before acquiring and using them; they should also consider using spywarewithout some of the most invasive features of Pegasus or a version that is programmed in such a way that itlimits access to what is strictly necessary.

1. Assembly debate on 11 October 2023 (22nd sitting) (see Doc. 15825, report of the Committee on Legal Affairs andHuman Rights, rapporteur: Mr Pieter Omtzigt). Text adopted by the Assembly on 11 October 2023 (22nd sitting).

See also Recommendation 2258 (2023).

II SÉRIE-D — NÚMERO 18 ____________________________________________________________________________________________________________

124