A new investigation has revealed how NSO Group’s notorious Pegasus spyware was used to infect the devices of three activists in Bahrain, demonstrating yet again the grave threat which Pegasus poses to critics of repressive governments.

Ali Abdulemam from digital rights organization Red Line 4 Gulf, with technical support from Amnesty International and Citizen Lab, found that a lawyer, an online journalist, and a mental health counsellor, all of whom have been critical of the Bahraini authorities, were targeted with Pegasus between June and September 2021. The three cases were first identified by Citizen Lab and independently confirmed by Amnesty International. The Pegasus Project consortium had previously identified Bahrain as a potential client of NSO Group, with hundreds of Bahraini phone numbers included on a leaked list of 50,000 potential Pegasus targets.

NSO Group, the Israeli tech company behind the Pegasus spyware, only supplies government clients.

Previous forensic work by Citizen Lab and Front Line Defenders has shown that three other Bahraini activists were hacked by Pegasus between 2019 and 2020: Yusuf al-Jamri, an online writer in exile in the UK; Moosa AbdAli, an exiled activist in the UK; and Ebtesam al-Saegh, a human rights defender still in Bahrain...

NSO Group’s targeted digital surveillance tool is inherently prone to human rights violations, given its design and the lack of checks in place to ensure its proper deployment.

Pegasus severely impacts the right to privacy by design: it is surreptitious, particularly intrusive, and has the capacity to collect and deliver an unlimited selection of personal and private data.