• Our forensic analysis confirms that phones belonging to three individuals in Bahrain were hacked in 2021 with NSO Group’s Pegasus spyware. Two have consented to be named.
• One target, Mohammed Al-Tajer, is a prominent Bahraini lawyer, who was previously hacked with FinFisher spyware and blackmailed in an operation linked to the Bahraini government in 2011.
• Al-Tajer’s phone was hacked on September 2, 2021, approximately one week after a previous report by Red Line for Gulf and the Citizen Lab on the hacking of Bahraini activists’ devices.
• Dr. Sharifa Siwar is an exiled Bahraini psychiatrist who accused a member of the Bahrain Royal Family of being involved in a scheme to distribute medications for recreational use to schoolchildren.
• Journalist A, hacked in September 2021, received a notification from Apple in November 2021 that their device was targeted by government attackers, as did Al-Tajer.

NSO has claimed “Whenever a suspicion of a misuse arises, NSO investigates, NSO alerts, NSO terminates. NSO is proud to prove its commitment to protect human rights.”

This case proves that the opposite is true: NSO had clear evidence of abuses in Bahrain, yet they neither alerted these victims, nor terminated the customer. Selling hacking tools to an authoritarian regime with such a notorious track record was irresponsible...

...the sale was made despite nearly a decade of evidence that Bahrain is a serial spyware abuser. This case dramatically underscores both NSO Group’s failure to halt repeated misuse of its technology, and the continued failure of Israel’s export control regime to prevent even the most predictable abuses.