Welcome. So, sewing spyware in Europe, news from the front.
As Félix said, I am the director of Data Rights.
Data Rights has a scope that is the entirety of the EU, and we started being active in 2024.
The goals of Data Rights are to help fight for an internet that is
free from arms races and from monopolies that control our lives.
Celia, over to you.
And I'm from Spain. I'm from Barcelona.
I'm from an organisation called Iridia, which is a Catalonia-based
human rights association specialised on civic and political rights.
And we combine direct support for those who experience rights
violation with strategic litigation, psychosocial intervention,
transformative communication, and political advocacy.
And we work from an intersectional and feminist approach
trying to reach and promote public policy change.
So, I'm going to start not explaining a lot more about the organisation because
I'm going to explain a very specific case that we are currently litigating.
But before jumping into the case, I think that
I would like to explain you a bit the context.
So, let me take 30 seconds just to explain, to set the scene and
explain the context because in this case the context matters.
So, it brings us to 2017 and 2021.
Catalonia lived through an extraordinary moment of popular
mobilisation around the right to self-determination.
It all came to the head of the 1st of October of 2017 that
it was taking place, the referendum for independence of
Catalonia that the Spanish authorities declared as illegal.
Many of you might remember those pictures of many millions of protesters protecting
and protesting, but protecting the schools where the people were about to vote.
But also, you might remember the widespread police violence that was documented that day.
At last, at the end of the day, like a few months after, it was
declared the independence of Catalonia in the Parliament of Catalonia.
It's important to be said that it was a very important moment.
It took place in November 2017, but it was as much as
important as quick because it just lasts for 44 seconds.
You know, but we are proud of it. We have to explain it, you know?
Like, we have to say it, 44 seconds. It was huge.
But then the consequences, you know? *Applause*
But what I'm going to explain here, it was also the consequences because that
moment, the consequences had lasted years and years and bring us to today.
So, 12 political leaders, they were imprisoned on charges of rebellion
and embezzlement, and they were facing sentence between 8 to 12 years.
Their detention was repeatedly criticised as unfair by international human rights bodies.
And although they were ultimately pardoned in 2021, the damage had already been done.
So, I'm going to set, once the contact is set, I
really would like to bring you to the 14th May 2020.
We were finding ourselves in the middle of the pandemic.
So, in the middle of the COVID lockdown.
And an online meeting was held to coordinate the
collective legal defense for the political prisons.
Maybe in their pajamas. So, we're talking about the lawyers meeting online.
And one of the lawyers in that meeting that was
attending had his phone infected with Pegasus.
He didn't know it at the time. It was his personal and professional device.
And he is our colleague, Andreu, who is the person
whose case we are bringing before the course today.
It took two years for the Citizen Lab to uncover the truth.
So, 65 people in Catalonia had been surveilled using Pegasus and between 2017 to 2021.
Findings later on were confirmed by Amnesty Security Lab.
But also, we discovered a year ago that the spying start in 2015, being
Spain the second client of NSO Group, which I'm going to talk a bit later on.
So, those targets include human rights defenders, activists,
computer science, family members of politicians, elected
representatives of the Catalan and European Parliament, and lawyers.
Three lawyers.
So, Andreu, our colleague, and also a member of Iridia's board
of directors, was spied on because of his work as an attorney.
He was spied to gain access to confidential client
information and to undermine the legal defense itself.
The main suspect in here is the CNI, which is translated as the Spanish National
Intelligence Center, that it operates as domestic and international intelligence
agency, and all its activities are classified as secret under the Official Secret Act.
And let me tell you that this law was signed by
Franco in 1968, and it's still in force today.
So, officially, officially, neither the CNI or the
Spanish government have ever confirmed the surveillance.
But just the days after the Catalan Gate was published,
the director of the CNI back on the time was dismissed.
Surprise.
Also, it was shown to the leak to the press that confirmed that 18
of that group was spied with authorisation for the Supreme Court.
But then, actually, yet, today, when you ask, the official answer remains the same.
So nothing, nothing happened.
So, our colleague Andreu is one of those remaining 47 people who were spied with
Pegasus without judicial authorisation, which means that they were spied illegally.
At Iridia, we're trying to break down the case.
We're trying to answer that question, to clarify what had
happened, to establish responsibility, and to ensure that this
serious violation of human rights never happened again to anyone.
So, in May 2022, we filed a criminal complaint for unauthorised access to computer
systems, illegal interception of communications, computer espionage, and the
production and the use of spyware, pointing the companies responsible for developing
and exporting Pegasus, which is a company that you might know that it's NSO Group.
Because we often, and rightly, we focus on a state responsibility.
But from a direct perspective, we also need to look for those who build
the systems, the actors who design and test and develop and export tools
capable of taking disproportional and total control over a personal device.
So, going directly to NSO Group, which I found later on being
an expert on for this case, it was found in 2010 to respond
to what its three founders describe as an European need.
So, Pegasus, the most known product they have, has evolved in alarming pace.
But it's very important to say that it has been developing and being tested
against Palestinians for many, many, many years before reaching Europe.
So, what initially required a user interaction, so a click
to download a link, now relies on a zero-click exploitation
that is the type that it was used against our colleague.
It can access communication, extract data, and
even manipulate the content on the device itself.
So, although NSO Group Technologies is formally a private company
registered in Israel, NSO Group operates as an umbrella brand of a
network of operational and financial companies spread across the world.
So, one of the most important hub that NSO has, is found in Luxembourg.
So, it was described by the European Parliament
itself as NSO Group Operational gateway into Europe.
Today, the group has at least 19 registered companies, many of which
share not only the same corporate purpose, but also the same office
in the same number, specifically the same building in Luxembourg.
So, within this structure that we are seeing, we decided to focus
on two specific companies, because they were the ones more linked
to cyber security and spyware activities, but also because they
were the first ones that were registered in Luxembourg back in 2014.
I'm talking about OSY Technologies and Q Cyber Technologies.
When we look closely to those companies, we found that these companies were
directly connected to NSO Group in Israel with direct and structural ties.
So much that between 2019 to 2020, they shared the same board of directors.
So, Henri Lavi and Shalev Hulio, two of NSO founders, has
a direct, a prominent role in those companies as well.
So, our goal here was to demonstrate a technical and corporate chain of responsibility.
But what we found investigating them was stronger than expected.
So, a similar governance structure repeated over
the time with the same individuals at the center.
That's why we decided to do this corporate report that we filed
into the case last year to request the indictment of those
who played the most prominent role across the three companies.
NSO Group in Israel, OSY Technologies and Q Cyber Technologies in Luxembourg.
So, a few months after, a judge, not the judge that is investigating the case
in Barcelona, but the judge for the Court of Appeal, accepted our request.
And this makes the case a global first.
A first criminal investigation anywhere in the world where NSO directors
are being investigated in connection with the target of a Pegasus victim.
And that matters. That it sets a precedent.
Because it opens the door for others who were spied by this kind of
technologies, but the same kind of spyware, to pursue not only the states,
but also the companies and the individuals who design and operate this system.
In short, it begins to crack what had long been along a wall of impunity.
Maybe I'm a bit ambitious here. *Applause*
Because we are sure that their decision-making power
in Luxembourg creates personal liability to them.
And importantly, it's very important to say that.
These companies are not only merely responsible for selling the software.
Their role goes much further.
So the evidences show involving in technical and support services.
So in the deployment and the installation of the spyware, the
monitoring of the use, and they provide ongoing operational support.
In other words, what we're talking here is not a passive distribution.
It's an active participation that the company has on the spying.
So at this point, you might be wondering why they
go so deep and why these people keep digging.
And the answer is it's quite simple and it's very sad at the same time.
Because the burden of the investigation in Spain
has fallen almost entirely in the defense on us.
And we are determined to get to the bottom of this to achieve justice.
Because you look around and the reality is striking.
It's quite depressing, actually.
The judge is not specialised in high technical and technological
cases and has shown little willingness to actively investigate.
Three years and seven months have passed and ongoing.
We're counting and counting and counting.
And meanwhile, we operate under a legal framework
that allows disproportionate unchecked use of spyware.
Because in Spain, the deployment of this technology by intelligence
agency service is regulated by a single article that is written
five lines long in a law governing judicial oversight of the CENE.
So targets are never notified. Judicial oversight is theoretical, but not always.
And there is not effective right to access to personal data or the surveillance records.
So the public prosecutor constantly opposed the investigation.
Israel remains silent. The company remains silent.
So it's very encouraging environment to keep going, right?
But despite having submitted extensive evidence showing
the urgency and the necessity of investigating these
practices now, one fundamental risk remains today in place.
That there is no mechanism in Spain to determine today
whether spyware is currently being used and against whom.
So here we are, fighting to investigate the past, legally forbidden
from discussing or addressing the present or preparing for the future.
And all of this is happening while mercenary surveillance tools,
spyware and the companies to produce them, continue to grow, to
expand, to operate without meaningful regulation or accountability.
So, and yes, it's not a way to speak.
What we're seeing today is that NSO Group is describing
themselves today after going through a reputational crisis.
But these companies are actively rebuilding. They are rebranding under American...
Okay. I forgot the slide. Sorry very much. I was like, uh-oh. No.
They're rebranding under American names and investors.
And they're moving into larger offices in Israel.
They're presenting themselves as renewed and stronger than before.
And although, for the first time in years, NSO founders, they're not longer
officially part of the companies, they have certainly not left the market.
On the contrary, they continue to thrive in
surveillance and security ecosystems through new venues.
Same expertise, same branding.
So we're seeing that with Shalev Hulio's new company, Dream Security.
So the conversation has to be taken now.
That's why we are here to really address the topic
and start building a strategy to combat against it.
Thank you so much, Celia. *Applause* That's what we love about Spaniards.
They're really passionate. So let's take a step back and zoom out.
So this was Spain.
Now, the reality is that Spain was not the only country in Europe that was messing up.
So let's go back in time in 2019.
So after the scandal of Amnesty and Forbidden Stories and then Citizen
Lab, the European Parliament thought, OK, let's do a serious investigation
here because there's a pattern of countries that seem to have messed up.
And so that investigation started in 2019 and was ended in 2024.
They came up with very strong recommendations, very inspiring recommendations.
And then nothing, as the Brits would say, not
even a sausage, which is not massively inspiring.
So this is actually the same year that I met Celia's colleague, Andreu.
And he was telling me, hey, there's nothing happening.
The political will is completely dead.
And we're a bunch of people across Europe working on these
cases, but we're actually not speaking with each other.
We should probably get together. And I thought, yes, that sounds reasonable.
And he said, hey, let's do it together. Oh, whoa, this is crazy.
But yeah, actually, I'm in.
So now we have launched this summer a coalition of organisations
throughout Europe that are putting resources together to really
help another and figure out how to be most strategic around cases.
So really, the strategy here, so the core goal, is litigation.
So that means going to court or to regulators with complaints and
Yeah, so we're really taking, you know, the the cases from the ground up
Basically, you know, you have local cases with the
experiences of the targets and then you build on this
And of course the goal is to reach European courts because the the
ultimate goal is to get precedence for the entirety of Europeans
The beauty of this coalition is that it gets us to be very strategic about cases
So yeah, we can focus on cases that we find the most interesting and
so when we launched the coalition in the edry offices last summer
we also had the
lead of the European Parliament's investigation that was there to launch with us and
Actually during the launch she even said that
from her perspective her political perspective,
litigation was the only way forward from now on so this is very inspiring
And so we're going to take the opportunity to tell you about two other countries
Hungary and Poland so in Hungary
There were seven targeted people that reached the Hungarian
Civil Liberties Union and got support from that organisation
It's interesting to know that most of these people are
journalists most of these journalists are specialised in
Investigating anti-corruption so there's a pattern
that we see but I'm going to go back on this
Three cases are now before the Constitutional Court
We are hoping to get a ruling by the Constitutional Court next year
But do not hold your breath because that court is clearly under the influence of
Orbán and the Fidesz so, but the goal is really to have a ruling and
then yeah again get to the European level where we can actually push for
for change
Maybe something worth mentioning they all went
to the data protection authority of Hungary and
that authority said as far as they were concerned. It looked amazing. So very inspiring
and now Poland so
Poland is very interesting because like Spain the context
plays a lot. So, a few years ago there was a coalition of
far-right parties that was leading the country and
At some point there were some local elections and one
of the coalition parties decided to hire to use Pegasus
To throw on their coalition of France, which is lovely
But also on many other people including a politician
that was campaigning for his own party and
And so this man's name is Brescia. I wrote it at the bottom so that yeah
Polish names and so
What happened to this man is very interesting because they used
Pegasus to infect his phone and they extracted ten years of texts
So just to pause for a second here, you know
Usually when we think about surveillance we think real
-time interception and we're already quite shocked
this is ten years this is insane. And so not only that but so they
took ten years of texts and then, what they, did no enforcement,
they rearranged the texts. They actually merged
some texts to build a completely new narrative.
And then they sent this to the media, probably media
that they owned, and then that was presented on Polish TV
So this man had his texts completely rearranged
building a new narrative on Polish TV during elections.
So this is really shocking in itself
But also what makes Poland very interesting is that since then
it has had a change of power and so from a legal perspective.
That's where it gets fascinating because there has actually been an investigation and
The Polish state has found that indeed they had used Pegasus
which you realise with the Spanish case is quite an improvement
already. And they even concluded that it had been used illegally.
Which again is very useful. Something also to mention
because unlike Spain actually some judges were
part of the authorisation of Pegasus and some European officials spoke
with some of these judges basically probably saying hey, what the fuck.
And the judges said: To be honest, I had no idea that I was allowing something so horrible.
So the technical realities were completely misrepresented to me. This is this is horrible.
So this is also something quite interesting.
So as you realise now there are some patterns
across these cases, which is also why we like to be
united because we start to see these patterns.
And so I'm not going to talk too much about the first point because you got it.
Some of the patterns are, well, clearly primary targets are these people that have
very protected, historically protected, professions because
they are safeguards in democracies. So lawyers and journalists
particularly investigative journalists working on anti-corruption
Which is very interesting because yeah, there are counterpowers
and I guess we're seeing more and more this expression rise
which I really like.Spyware really feels like
authoritarianism as a service and just so, you know, I
rechecked the definition of authoritarianism and so yeah,
the key features are you're destroying the separation of
powers, the free press, the rule of law and basic freedoms
Okay, second pattern no notification. So this is a very interesting one actually because
in 2020 a bunch of some of the people that created
data rights we were involved with a case in
France where we were suing the intelligence services.
So we reached the top EU court and we actually got something that has been
asked around the globe for many years. So we got this for Europe.
So after secret surveillance when you're no longer
considered a threat you have to be notified.
So it's interesting because that made it possible for us to then
have conversations and yeah, typically in Hungary or in Spain, the
surveillance ended after that ruling in 2020. So people
should have been notified and that never happened.
Which is very interesting to stress out because that completely
prevents people from actually being aware that maybe they want
to check whether their rights were protected in the first place.
So a fundamental safeguard as a citizen of a democracy.
And this is where also Celia is going to share some of their experience
Celia/Irídia: Yeah, it was just about to say very quickly because you can
imagine like in cases that the person was never notified
So in the any of like the group of the 65 people in Spain none of them were notified.
And some of them they're not even recognised by
this list published in the press of this 18 that had
authorisation by the Supreme Court.
So we have these remaining 47 people that have been never
notified. They have been not spied illegal like legally speaking
So they don't have any avenue to seek for an effective remedy.
They don't have any remedy and any way to report to speak up to try to
put in place the safeguard that they need in their devices
But also to fight back and to ask what happened which
kind of information do you have? Where do you have it?
I mean there is many many many question that those people
still have today from the moment that they were notified
by the citizen lab that their phone was infected
So that even aggravate the situation with this no-notification, but also not any willing to
to accept any responsibility from the states.
Lori: And so now we're touching on the third point in terms of evidence
And actually this is where Irídia's experience is also useful.
Celia/Irídia: Yeah, because I think that
in all the situation that I already explained and also
with all these patterns that like glory and deep in
Imagine the situation so we found ourselves that your phone was hacked.
It was confirmed. It was tested by the citizen lab. It was confirmed by the citizen lab.
It was confirmed by amnesty security lab, but the judge
in Spain refused to accept it as a forensic analysis.
So then the judge is asking you and they're asking the
targets to first to pay another forensic analysis to an
another company specialised on this. So it has an independent
forensic analysis that could be filed in the case.
So we did that. So most of the targets decide to pay another exam
and the answer confirmed that the phones were spied with Pegasus.
But again, the judge and the prosecutor, the
public prosecutor in Spain, rejected as evidence.
So what is really happening right now in Spain: That the
judge is asking the targets, the people that got affected
by Pegasus to give their phones to the police, so the police can test it.
So you know and it's like how is this going to happen. And you know,
few people gave their phones to the police. And what the police said
That the phones was infected with Pegasus, but it's
kind of like how many we have to take, you know?
But it's very important to say that because I think just to
highlight it the impact that this technology has in people's life, in their work life,
I mean for journalists, for lawyers, who has a
confidentiality and not a secret right for the clients,
I mean it really breaks their profession, but it's very important to say that
for a technical point of view ,from a legal point of view, but from a human point of view
It's not investigation.
That is really revictimisation for those that have been
experienced that and they have to go again and again and again.
Like bringing their phones now to the police.
So few of them rejected that but the others are set.
Give it to them and the police accepted they were infected.
Lori: And so just to say this is a general pattern across countries and
You know this brings us back to the second point
You know, if the notification had been done by the states
we would not be reaching this point where, you know,
Individuals are getting notifications wherever they can get them.
So, be it companies, being a research lab in Canada
And and the judges are very often saying this is not hard evidence. So there's
no winning here. Um, sorry this confused me.
And yeah, of course, how acceptable is this that we depend on US companies
and the research lab in Canada to be able to use our fundamental rights.
All right, so on that note
I decided that we would have a sanity break and when Celia
saw my sanity break she created the sanity break over it.
So this is the first sanity break. The meta one.
And then I just wanted to pause for a second and say, you know
There are some very great things legally around here.
We have rulings in europe that are very strong
You know, secret surveillance for the protection of
national security can end up destroying democracy
under the cloak of defending it. So, you know when you
read things like this in law school, you're like well,
this is clearly some legal badassery going on,
it's going to be great and then you know you hit the
ground and this is actually what it looks like and yeah
It's slightly underwhelming. But anyways, so in terms of the long-term stakes,
your cyber security wears a crowd so we're not going to talk too much about it
But of course stockpiling hacking tools what could go wrong?
This is a disaster and Wannacry showed it because you turn
into a honeypot if you're sitting on a pile of zero days.
And yeah, Wannacry was stolen.
I mean the tools in there was stolen and then launched on the
public, it had critical infrastructure, hospitals disaster.
The only way around this is vulnerability management and I really wanted to mention this
non-binding opinion of the constitutional court of
Germany a few years ago that highlighted not only that
IT is so important now in people's life that it has to be intertwined
to the ability for people to enjoy their basic rights. So that's already fundamental.
And then yeah, if you are not capable of doing
it well, then no spyware for you! Pretty simple.
And then a second point:
So there's the need to really have serious conversations around capabilities because when
not here, but clearly if you're in Brussels when you
talk about spyware, a lot of people will say 'Oh,
that's just a new surveillance tool. That's just
a new toy of law enforcement.' Yeah, but it's not
It's zero days. So zero days can do all sorts of things not
just spying. And there needs to be a real reality check here.
Especially because you know, normal market dynamics:
If you want all the shares of the market you need to have the most powerful zero days.
What are going to be the most powerful zero days? Well, the ones that give admin control.
And if you have admin control, then you have your handover data integrity
so you can add, you can remove, you can modify data and we're getting in that way.
The Polish example is kind of getting in that way.
But to be fair, they were going for smear campaign.
So they didn't actually look they didn't need to modify the data on the phone of
uh Brescia. the Indian case is really interesting: So in 2018,
what the police did, they partnered with hackers and they're going after
activists and they they got the hackers to
infect with Pegasus and then inject with another tool the computers of activists.
They injected fake evidence and then -surprise
surprise- the police raided the activists the day after,
used that evidence and sent the activists to jail. So this
is really powerful to realise because this is actually
what is at stake with spyware?
Right and on this note we are reaching the end of this talk
Maybe something quite reassuring to think about
because this is not really something that people
realise in our circles, but here definitely, you know,
what's the bottom issue also here? The bottom issue
is that we have highly monopolistic environments.
We have basically for the general public two operating systems.
So you know if you want to be a strong actor in this market,
you have to figure out how to hack into those.
But what if we had a more diversified environment?
It would be much more expensive to develop spyware and so
this is really a thought that I want to leave you with:
And then also, this is of course the opportunity for
us to widen a little bit the scope of the conversation
and to highlight the fact that here we're talking about spyware,
but spyware is actually falling into the category of dual use technologies.
So I put the definition here: It's technologies
that have very potent military and civil use.
And so yeah other examples are AI, satellite imagery biometrics.
Biometrics is a very good example for example because the cameras
that will be used for you to go through the airport are exactly the same
that will have been trained in china as reported by the New York Times
to recognise the
ethnic origins of individuals that were muslims
so that there would be signals sent to the police,
if you have a muslim that enters a certain area in the city.
So these are technologies that are incredibly powerful and states
are very reluctant to build safeguards artists because yeah
they have an edge. And so this is really a conversation that we're trying to
develop to go in that space to not be completely tied
to the technology to be a bit technology neutral.
To be able to not be reactive and to adapt to future conversations because
We're actually a little bit surprised that at the moment. There's
no more conversations about the coupling of these technologies.
And, you know, we're hearing new rumors about AI and spyware.
And we're looking for money to actually look into this.
But also what about biometrics and AI you know, so this is
really something that we also want to, yeah, lean towards to
adapt to future conversations and challenges. Thank you so much. *Applause*
Herald: Thank you so much Lori and Celia very important and impactful work
We have a bit of time for Q&A so if you have a question
Please make your way to one of the microphones throughout the room and
You also have the possibility to ask questions through matrix or IRC.
And if you're leaving the room, please do so quietly so we can continue with the Q&A.
And we start at microphone number one, please
Hello Thanks for the talk. It was very interesting
My question is about the public discourse. Like the
public discourse is shaped by the media very much into the
'We only use spyware to fight terrorists' and it's
very shaped around 'oh, we wouldn't abuse it' - even though there's clearly abuse
Would you say this public discourse and how it's shaped
and often portrayed hinders you in your investigations?
Because people are like 'why are you investigating?
It's used against terrorists. Oh, there's one misuse'
Would you say this affects your investigations and also the public opinion against you?
Lori: Maybe just if I start that so it's actually a conversation that we had because
that's also what is really strong and talking and working together because we realised that
the context is very different from one country to
another and so typically in the Spanish example
the public was actually led to think that it was spyware
were great because it was enabling to go after separatists.
So you absolutely need to hone to the national context
of the conversation and then maybe if you want to?
Celia/Irídia: Yeah, and I think that what we have been trying to do
because since we we are finding ourselves a bit isolated
I'm quite lost so it's actually the organisation that we are
going to and litigating in these cases that we are adding.
And that adding more information to really break down
this kind of narratives that have been built by the media.
And I think that what we're seeing is like
As we speak I mean three years had passed so I mean it's a lot.
So we had the opportunity a lot also to work with journalists, to explain
what is really happening, to present our reports, to show the evidence
I mean, forensically speaking, on the companies on the state responsibility aspect
I mean we have everything in our favour.
I mean the information is there so I think it's
we're experiencing how it changed, but it's very much
difficult for people to understand.
The impacts of a spyware, because they think that it's something that is
happening to some politicians that they were doing things back on the time.
And we are trying to break this down because right
now as an environment that we are living in today,
it could happen to any of us and and we wouldn't know about it.
So we're trying to create all this alert to be prepared.
So we are trying to create this case,
to create a precedent for others so everyone
could be notified, everyone would be able to have
information about it and everyone would have the access to remedies to fight against it.
So we're trying to break this down,
even though it's very much complicated because the national
intelligence service calls the press and we have the very nice
highlights, but we're trying to create others that
could create the counterbalance on that sense.
Herald: Microphone number three for the next question, please.
Audience: Thank you for your talk
How easy is it if the national courts are not taking you seriously or
are actively blocking you to go to a higher court like the European one?
And do the countries accept the rulings of the European courts?
Celia/Irídia: I mean in we have to exhaust all the domestic avenues.
So right now, it's, I didn't say it, but we are like- three years have passed
and we are finding on the preliminary investigation on the case
So it's in the judge in Catalonia in Barcelona that is investigating.
But we have to go up, we have to exhaust all the avenues. So to go to the constitutional one
and then I mean first of all to appeal to go to the
court, to appeal and then go to the Supreme court
and then when we get denial, fully denial, for like the investigation to take place
Then we can go up to the European court of human rights.
And then I think that, what is really important and maybe
we can also add it here, like we are seeing that other
cases on spyware and pegasus are reaching the European court
of human rights that that could create a precedent for others
that we are on our way because we really believe that we are
not going to find justice in Spain as we have been seeing.
I mean, it's quite clear because we have all the obstacle that undermines investigation.
Even the public prosecutor who had to support and protect
the victims is all the time repeatedly asking for the
closure. And they are completely opposing to the investigation to take place
So while we're finding evidence the public prosecutor is
saying 'they're not valid'. J ust close this, it's there
They're too, you know They're they have been talking for so many times.
So I think that we are really wishing to arrive to the
European court for human rights because we think it's the
open opportunity for us to get some justice to get some remedies
and reparation for the victims for the people who are targeted.
But also to create a precedent for others and don't have to go all all the way up again.
Since we're experiencing that way.
Lori: Maybe you comment on this because also, you know
Typically the Hungarians they're not doing this because they think
their country is going to think ' oh my god. I have seen the light'
No, but they're doing this for the rest of Europeans.
They're doing this and this is the reason why we're doing
this: We're trying to not care too much about states.
We're trying to think in terms of like: How do we protect as a group? And so yeah
This is I guess our guide tonight.
Audience: Thank you
Herald: Microphone number one for the next question, please
Audience: Yes, hello Andres Dietschi a lawyer in Switzerland
So we saw a lot of cases, Switzerland wasn't mentioned so probably there is no
process going on there although like at least one Spanish
activist was like infected still when she was in Switzerland and there was
quite some infrastructure in Switzerland of Pegasus as well
So and we have all those different
countries and cases and stuff so my question is a little bit
How can we do like mutual assistance and mutual legal assistance?
At state level? I mean
it could be that in some countries states are more willing to like
seize a server for example in Switzerland, probably Switzerland wouldn't do that,
but maybe when there are two countries which are more privacy or
human rights friendly and that there one could use a state support as well?
How do you see that and like how is there a possibility of like
legal professionals on the legal professionals
level how one can support one internationally?
And then as well, how do you see like hacktivist
level how hacktivists could support in such cases?
Lori: I'm sure you have things to say but maybe some
thoughts so it's a difficult topic so it's not like
You just have someone random coming to you and say hey, I can help on that topic and you'll
like yeah, sure I'll trust you.
So there's that reality. Now in terms of using states to help us.
It's a cat and mouse game that we're playing at
the moment because we're working with investigative
journalists, researchers and of course that's the you know,
that's also the problem when states are relying on missionary,
well, for profits because they can just disappear very
quickly. So we're also trying to be very strategic about that
And then of course you guys are working also on that.
Now for us I mean
That we are really trying to I mean to create a network that goes beyond
to the state because mainly the state is the one responsible for that.
I mean, and we are fighting directly the state.
But I think that that's what is really important to start creating groups.
I mean to create this conversation and to start what
we why we create the Pega coalition it was a way to
open the conversation to share strategies because it was like:
We want to break this isolation that we're finding
ourselves and trying to bring cases into court
But while we are doing it,
ourself alone so as Lori was saying: We are doing
that to create a common strategy that could be used.
So if we open the way to go against the companies
that others in Hungary can you do it if they want it
I mean we have the information we we did we did that in order to support other cases as well.
So I think the way to start overcoming the situation it comes from this kind of multi space
that it's from researchers journalists, legal attorneys, advocacy
officers, activists as well.
So to create a space that we can build a conversation that could really
create another narrative as we were saying with the other question
Because what we're seeing is estates are completely
closing themselves. I mean they then don't they don't really
want to be part on these conversations because they are the
ones who use it against journalists, lawyers, activists.
So that's why we have to create an alternative
space that we're trying to propose here as well.
So I think that for anyone who would like to add
information or to know more what they can reach us
I mean we can continue the conversation then.
But I think that more research as Lori was saying we need
to trying to understand what is really happening today.
Because we are fighting cases that goes back to 2020 and we're in 2025
Almost finishing it. So it's kind of like what is really
happening today to be able to not be always late on fighting
these cases to be in a situation that we can know what is really happening today.
Which are the tools that there are used, which kind of technologies that
there are mixed and use against us and from an activist point of view?
I think that because people are more aware of it
I mean, I think that people start creating copying
strategies on how they protect their phones?
How to use like more protecting on networks?
I think that it's a conversation that I'm an activist myself and
this conversation already taking place in our in our meetings.
So I think that it's why we cannot detect it,
we have to also be able to protect more ourselves in that sense.
Maybe actually to build on this I realise if useful,
there is definitely something that we need which is
a better, more granular understanding of the data life cycle.
This is something that I'm going to, you know,
the citizen lab and I'm begging them, you know
please giving give me more details-
and this is conversations that we're having because they're like:
Well, we absolutely are ready to explain some things to you,
but we're not going to give you anything in writing because we don't want to threaten our
research methods that could be used by the companies.
So this is also where we're kind of between the tree and the bark.
So this is something that we really need a better understanding of the data life cycle.
And actually to also build upon your question:
This is also the reason why we created the coalition so
that we can cross-pollinate in terms of the legal arguments
And yeah, we realised that we needed to have more cyber
security and data protection arguments for example.
So I'm working on it at the moment.
Herald: We have a lot of questions,
so please keep your questions brief so we can get to
all of them microphone number four in the back, please
Audience: Thank you both for your important work and the talk!
My question is about the obligation to notify.
I believe that was enacted in 2020 if I remember correctly And my question is:
Do you know even if it isn't practiced perfectly do you know whether that
also exists within retained or assimilated law in the United Kingdom?
Lori: So this was not a law. This was a ruling that we got
So that's different because you guys were already kind of out.
So that's I would say nope. A ctually the UK actually that's
really interesting because when we reached the top court of the EU
We were joined by privacy international that were working
on the UK aspect and actually some of us represented
privacy international in the court case.
So we were all working on data retention so actually I
'm wrong this should be working also in the UK
Even though it was post Brexit because the case has started before.
You said something, not working perfectly just a point on this because
it sounds like we're really, you know, pointing fingers - we are-
but we mentioned Spain and Hungary about this but I actually
thank you so much because you're giving me the opportunity to say:
No countries are following it. In the Netherlands that was already
existing and people laugh when I mentioned this because they're like
Oh, yeah, we have -wait, we have a saying for this right,
which is yeah, 'the right to information that you'll never get'
So, you know, it's an absolute failure everywhere.
So yeah, the UK as well would you imagine?
Audience: Thank you.
Herald: We have a question from the internet.
Signal: Yes, what laws or control should be put in place to try to limit the impact of these tools?
Lori: Vulnerability management laws.
That's definitely the start. And then of course we're working on exactly what
we want to put as a message out there because the reality is that
In the last years - I'm sorry, please do interrupt me,
We feel that in Brussels t's been a bit chaotic.
So politicians are kind of always passing a law. 'Oh a new problem -
Let's just pass a new law!' that makes it very
complicated to actually know what are the principles that
everyone needs to follow. So we're really at the moment
having a lot of strategic conversations within the coalition:
Do we actually want to call for some aspects to be regulated?
Or do we just want to call for the freak show to come to
a halt and actually we're coming more and more towards
aside from vulnerability management, we're thinking more and more about - actually
most of the safeguards already exist. If you did
follow the law that would already be quite a relief.
Herald: That's excellent advice microphone number one, please
Audience: All right, thank you for your talk and your work. I
n the Netherlands we have a thing called the
Tootingscommissie Inzetbevooghtheden which is the oversight committee
that sees over surveillance and stuff
in 2022 the law has changed so that instead of getting permission before spying on someone,
it's an after action review, which is kind of a slippery slope.
And I was wondering as as a concerned citizen
What can I do to prevent our government from even going further down that slope?
Lori: You're taking quite a task on your shoulders.
So doing requests for information is already a good start.
And I mean I did a talk last year at the CCC about Frank van der Linde.
His fight against the police, which is crazy.
So you might want to follow his path you can even reach him he will be delighted.
It's already yeah, it's always a good start because I mean
when people are asking for accountability from oversight bodies
we did this in France,
with the leader actually of the European Parliament's investigation and that was a disaster.
So, you know, it's already giving
resources for people like us to then help and see okay:
Is there something that we can build on here to then
yeah try to reach higher courts and and get a precedent?
Herald: For the next question microphone number three, please
Audience: Hi, my name is Dominic Kosciuk and thanks for the talk was really great and interesting.
My question was for the long-term stake or for the long-term goal cyber security
Germany for example uses tools like Sentinel 1 to detect malware and co with the help of AI
- horrible in my for me -
However, this approach can conflict with certain GDPR or DSGFO
requirements since data may be transferred to the USA and
Yeah, with the current government that could of course be a problem.
My question was given these challenges, how can we still
achieve long-term goals in cyber security because of shifting the,
how would I say that like, the program to be secure to another country? With these?
Does that make sense?
Lori: Yes, it does and you're very lucky because it turns out there's someone from GFF in the room
So I am sure they're listening absolutely what you're saying.
First of all in the case that you described it would not be the GDPR that applies
It would be the data -I've lost the name - law enforcement directive
and that directive is an absolute disaster. So definitely
not starting on the wrong foot on the right foot here.
The fact that there are transfers with with the US is definitely
something interesting because when we're talking about critical
data, there's definitely some conversations to have. That being said,
and I guess this is a really interesting time to
have these conversations because typically Denmark,
they've always had agreements with the US and now their
Intelligent services are starting to say 'it's a bit awkward now'
So I guess this is the right time
But, yeah, it's it's a hard one honestly. I think GFF is your best port of call here.
Audience: Thanks a lot
Herald: If there are burning questions, please make your way to the
microphone now or post in the chat. We have one at microphone one
Thanks for the talk. I was wondering I felt that
you were dealing really well with the consequences
of this problem, but
is there any organisation coalition dealing with the root causes which I think are
the import of these technologies from places like Israel from places like the US?
Let's say maybe Hungary will start importing things from Russia, China, who knows
maybe from my perspective maybe it's time to close the door ?
And say on a European level this shouldn't happen.
I know that it can lead because I've heard discussions about this
It can lead to perversities like saying we need a European Palantir
Which I don't think we need.
I'm sure these technologies are still going to be somehow manufactured.
But maybe by closing this way of getting in it might be useful
to deal with some of it.
Lori: So this is a question that would deserve an entire talk.
Just to be clear. This is the reason why we have this slide
Because dual use is the wording of the regulation that touches on these exports.
So you mentioned Israel this is also a conversation that we have.
But I'm not going to go into details here because this is kind of strategic.
But yeah, of course, we're having these conversations. And of course, we're angry.
But maybe just another word on exports controls because this is a can of worms.
Because typically researchers that we spoke with on the topic
of the dual use regulation that is supposed to regulate exports.
In January, we're telling us that actually these rules at the moment
are such a disaster that they actually make it easier to share surveillance technology
without any sort of accountability within Europe and then in terms of bypassing them
It's extremely easy.
So a lot of Europeans are now yeah, you know, you
just travel with a server and then a bit of the code
I guess in another server you travel separately -boom.
So there are huge problems about this and to be honest if I may
I think this is exactly the type of conversations where we really need people
from the crowd of the CCC because it feels quite lonely
in these spaces where you're talking about capabilities and you say for example, you know.
Unfortunately, I could talk about this for hours. So maybe
Celia/Irídia: I was just about to say very quick on this like because I think that in the case of NSO
So what happens is like they move very quickly.
I mean they have they're spread around the world
But the place that the country has most companies register is in Luxembourg and like in
early 2019 they were presenting themselves, the
group was presenting themselves as an European
Network. So also that's that's what they're trying to do
They're trying to change their image.
They're really trying to reshape their own image, their narrative to
be able to operate in less regulation in terms of the exportations.
I mean they're doing that so we're finding ourselves that also
the type of technology that they developed it back on the time:
Now it's also European companies that are developing it.
I mean now it's not a way back.
So that's why also this conversation have to take place right now and also
I would really like to add because I think that we I think
that all of us we understand that it's an European problem
It has been happening all around European countries, but also
we don't have to forget that it's also an international problem.
It has been happening all around and the most effective people that
has been affected by these technologies has been the population
that has been tested against. S o in the case of NSO group,
we're talking about Palestinians that have been
subjected to this kind of technologies and surveillance for for many many many many years
before it was exported and spread around the world.
So I think also we don't have to forget that because in a way that we are fighting this
we're fighting at the European level because all
we have the mechanisms and all the tools to do it.
But we don't forget the international aspect that connects us with
the Colombians that they are fighting and they're doing an amazing job
against NSO as well. Or for example the
amazing rule that was in a in a court in California against
NSO group and that it was Whatsapp against NSO group.
So we are taking this perspective and international matter also to a way to address it.
So I think it's it's important.
And maybe just in case useful actually in terms of laws on imports:
There should be the start of a reform on exactly that topic in Europe next year.
And so we will definitely be following that or maybe getting involved. We'll see.
Herald: Okay, unfortunately, we're out of time.
But where can people find you if they have more questions throughout the next day?
On the internet or here at congress or yeah at the house of tea!