Two prominent Thai activists have launched legal action accusing Prime Minister Prayut Chan-o-cha’s government of using Pegasus spyware to infiltrate their mobile devices during a campaign of anti-government demonstrations in late 2020 and early 2021.
According to The Associated Press, human rights lawyer Arnon Nampa and legal reform advocate Yingcheep Atchanont filed a lawsuit yesterday accusing nine state agencies of unlawfully violating their privacy by using the spyware app, which is produced by the Israeli cybersecurity company NSO Group. Among those are the Office of the Prime Minister, the Royal Thai Police, the Ministry of Digital Economy and Society, and the three branches of the armed forces.
The AP reports that the pair have requested an immediate court injunction barring the use of Pegasus, and for the court to order the government to release the data on its use. They have also demanded compensation of 2.5 million baht ($72,000) each.
The Pegasus spyware, which came to prominence due to a joint global media investigation last year, is particularly dangerous because of its ability to carry out “zero-click exploits.” These enable it to be installed remotely onto a target’s phone without the target having to click any links or download any malware.
“Once it has wormed its way onto your phone, without you noticing, it can turn it into a 24-hour surveillance device,” The Guardian reported as part of the joint investigation mentioned above. “It can copy messages you send or receive, harvest your photos and record your calls. It might secretly film you through your phone’s camera, or activate the microphone to record your conversations. It can potentially pinpoint where you are, where you’ve been, and who you’ve met.”
Pegasus and other software produced by NSO Group are typically licensed only to government intelligence and law enforcement agencies to investigate terrorism and serious crimes, but invariably have been used to surveil political activists and dissidents in many countries, including India, Hungary, Indonesia, Greece, Poland, Kazakhstan, Armenia, Bahrain, Rwanda, and the United Arab Emirates, among many others. The app has also been found on the phones of politicians in France and Spain, and is believed to have contributed to the grisly killing of Saudi journalist Jamal Khashoggi in Turkey in 2018.
Last July, Canada’s Citizen Lab and the Thai civil society groups iLaw and DigitalReach published a report outlining what they described as “an extensive espionage campaign targeting Thai pro-democracy protesters, and activists calling for reforms to the monarchy.”
The report found that at least 30 Thai individuals, including activists, scholars, and people working with civil society groups. had their cell phones or other devices infected and attacked with spyware. All were involved in one way or another with the campaign of massive street protests that took place in the second half of 2020 and the early part of 2021 – including some who faced later charges for their roles in the protests. The protests were notable for connecting calls for democratic reforms to demands that the Thai monarchy be reformed, a virtual taboo in Thailand’s politics – and one that also played a prominent role in last month’s general election.
While the report could not confirm the involvement of Thai government entities, NSO Group, the company behind Pegasus, claims that it only sells products to government intelligence and law enforcement agencies, making it “reasonable to conclude that the discovery of Pegasus spyware indicates the presence of a government operator.”
During parliamentary censure debates last year, Digital Economy Minister Chaiwut Thanakamanusorn acknowledged that Pegasus had been used by state agencies for activities related to “security or narcotics.”
The lawsuit by Arnon and Yingcheep comes just days after Hanan Elatr Khashoggi, the widow of the slain Saudi journalist Jamal Khashoggi, filed a lawsuit against NSO Group after officials in the United Arab Emirates, a close ally of Saudi Arabia, installed Pegasus on her phone. The lawsuit claims that the software forced her to stop working, fear for her family’s safety and resulted in her “constantly looking over her shoulder.”