Top Human Rights Watch investigator allegedly hacked with Pegasus spyware

The mobile phones of a senior Human Rights Watch staff member are alleged to have been repeatedly hacked by a client of NSO Group at a time when she was investigating the catastrophic August 2020 explosion that killed more than 200 people in Beirut.

The alleged hacking of Lama Fakih, a US-Lebanese citizen and director of crisis and conflict at HRW, marks the latest example of how NSO’s powerful surveillance tool, Pegasus, has been used by the company’s clients to target campaigners and journalists.

HRW said that Fakih had been alerted by Apple on 24 November 2021 that her personal iPhone could be under state-sponsored attack. An investigation by HRW’s security team, which was reviewed by Amnesty International’s Security Lab, found that Fakih’s iPhones had apparently been infected with Pegasus through a so-called “zero-click” exploit that allows operators of the spyware to infect a phone without the mobile user doing anything, such as clicking on a link.

The news comes as NSO has faced a raft of bad news at home and abroad. In November, the company was placed on a US blacklist by the Biden administration, which said it had evidence that the Israeli company was enabling foreign governments to conduct “transnational repression”.

NSO has also been engulfed in a domestic crisis in Israel after it was alleged in a report by Calcalist that the Israeli police had used Pegasus to gather intelligence for investigative purposes without legal oversight. The report prompted Israel’s attorney general Avichai Mendelblit to announce a probe into police use of the spyware against Israelis. NSO said in a statement in response to the report that it had no control over how its clients used the spyware.

On Tuesday, NSO’s chairman, Asher Levy, said he was stepping down as chairman of the company but denied that the move had any connection to the recent developments. Levy said he had been appointed to the role by NSO’s previous private equity owners, but that management of the fund that owns the company had been transferred to a new company.

“Any attempts to present this move as a present-day resignation as a result of any publication related to NSO are completely false,” Levy said. “I am full of appreciation to NSO, the life-saving technology it develops, the company’s management and employees, and the unprecedented ethical policies that the company has adopted.”

In a statement on Tuesday, NSO said it was a “profitable company” and that it believed an international regulatory structure ought to be put in place to ensure the responsible use of cyber intelligence tools.

“However, any call to suspend these life-saving technologies until such a structure exists is naive and would only benefit the terrorists, pedophiles and hardened criminals who will evade surveillance and apprehension,” the spokesperson said.

NSO declined to respond to the Guardian’s questions about Fakih’s case but the company told HRW that it was “now aware of any active customer using [its] technology against a Human Rights Watch staff member” and that it would open an initial assessment into allegations that Fakih had been hacked.

When it is successfully deployed, a user of Pegasus spyware can intercept phone calls, see a target’s photographs, read their messages, and turn the phone into a remote listening device. NSO has said that its clients are only meant to use the spyware to target serious suspected criminals.

HRW alleged that its analysis found that Fakih’s two devices had been hacked between 6 April 2021 and 23 August 2021. The human rights group could not identify the client who may have been responsible for the alleged hacking but said Fakih oversees crisis response from countries including Israel/Palestine, Kazakhstan, Ethiopia, Syria, Myanmar, Lebanon, Afghanistan and the US.

In an interview with the Guardian, Fakih said the issue she was most intently working on an investigation of the “Beirut blast” at the time when she was allegedly hacked. She was also involved in projects involving Gaza and Ethiopia in that time.

Related: Beirut blast: a night of horror, captured by its victims

“I was working around the clock,” she said, adding that she’d created a “Beirut blast” folder on her shared drive on 5 April, a day before the alleged attacks began.

“I have always been very cautious about my physical security…but I never had anything happen that led me to believe that I was compromised in some way, that my data was being hacked or that things were being leaked,” she said.

“So when I did receive this notification from Apple there was a certain amount of disbelief that this had happened to me,” she added.

Fakih, a native of Michigan, said she had always taken pains to keep her personal life private and protect the privacy of people she communicated with in her work.

“And then suddenly, I have my phone infected. So I have thousands of photos of my young kids or photos of my wedding and all these deeply personal and meaningful memories that suddenly were not mine. And that made me feel very insecure,” she said.

“My entire career has been about trying to protect people’s rights. And suddenly they were trying to use that work to undermine them.”