The mobile phones of at least five French government ministers were targeted by the Pegasus surveillance spyware in 2019 and 2020, Mediapart has learnt from concurring sources.
Technical analyses of the phones of the five – all still serving in government – were carried out in July following the revelations of data leaked to the Forbidden Stories journalism organisation. The analyses, carried out by official technicians in parallel to an investigation opened by the Paris public prosecution services, revealed “the presence of suspect markers” according to a summary of their findings recorded in a confidential document dated last month.
Mediapart has also learnt that the mobile phone of at least one member of the diplomatic unit of the French presidential office, the Élysée Palace, was also found to contain markers of infection by the spyware.
Enlargement : Illustration 1
It was in mid-July that the vast secret surveillance scandal using Pegasus spyware, sold to governments by Israeli company NSO Group – which claimed that its clients were contractually bound to use it only for combatting “serious crime and terrorism” – was first revealed.
Leaked data about the use of the spyware was obtained by journalism organisation Forbidden Stories and rights NGO Amnesty International, which shared the information with 16 international media organisations in a joint investigation called “the Pegasus Project”.
They found that the surveillance tool, which can infect a mobile phone to extract all of its data and also activate its microphone to listen in on conversations, was used to target journalists and politicians worldwide, including French President Emmanuel Macron. It is operated at distance, and in a manner totally invisible to the targeted individual.
The current French ministers whose phones are now known to have been targeted by the Pegasus spyware are Jean-Michel Blanquer (in charge of education), Julien Denormandie (agriculture), Emmanuelle Wargon (junior minister, in charge of housing), Jacqueline Gourault (territorial cohesion and relations with regional and local public authorities), and Sébastien Lecornu (French overseas territories).
During the period that their phones were infected they were all members of government, although not all in the same posts as today. Mediapart has not been able to establish an exact duration of hacking, but the discovered traces of the virus concerned the year 2019 and, to a lesser extent, 2020.
Contacted by Mediapart, either directly or via their ministerial offices, none of the ministers commented the findings. Some did not respond while others declined to be interviewed, citing the sensitivity of the case. Of the latter, some advised Mediapart to contact the general secretariat of defence and national security (the SGDSN), which operates under the authority of the prime minister’s office, and which in turn declined Mediapart’s request for comment.
However, Mediapart has learnt that minister Jacqueline Gourault has now changed both her mobile phone and her number.
Also contacted, the Élysée Palace said it would not comment “on ongoing inspections, and which require long and complex work”.
The “Pegasus Project” found that the principal targets of the government clients of NSO included – apart from journalists and politicians – political opponents of regimes and activists in rights associations and NGOs. Among the journalists whose phones were found to be infected were two from Mediapart – publishing editor Edwy Plenel and Lénaïg Bredoux.
Technical analyses carried out by the Forbidden Stories organisation and Amnesty International’s Security Lab concluded that the French victims of the Pegasus spyware were targeted by Moroccan state agencies. Morocco is one of many states to have bought the spyware, and which include India, Saudi Arabia, Bahrain, Hungary, Mexico, Kazakhstan and Rwanda.
The Moroccan authorities have denied the accusations by Forbidden Stories, and have filed numerous lawsuits for defamation over the reports. Meanwhile, the Paris public prosecution services opened a preliminary investigation into the media revelations, which is ongoing.
As Mediapart has previously reported, expert analyses led by France’s National Agency for the Security of Information Systems (ANSSI), a body that reports to the General Secretary for Defence and National Security (SGDSN), along with investigations by officers of the central office for the fight against criminality in information and communication technologies, the OCLCTIC, which works under the auspices of the anti-cybercrime branch of the judicial police, have formally established the infection by Pegasus of the mobile phones of Edwy Plenel and Lénaïg Bredoux, after they voluntarily submitted the devices for examination.
The ongoing judicial investigation by the public prosecution services has also concluded that the phone of a journalist from international broadcaster FRANCE 24 was also infected by the virus.
The confirmation of the contamination of the phones of the Mediapart journalists was recorded in a formal statement during their questioning by ANSSI officers on July 29th. During the interviews, the two journalists explained why both the technical evidence and the chronological context indicated that the operators of the spyware were the Moroccan intelligence services. Amnesty International has published details of its own technical analyses which attest to this (see here).
Contacted by Mediapart, the Paris prosecution services declined to comment on whether or not it was aware of the targeting of the phones of the five ministers, nor upon the current state of the probe by the prosecutors, citing “the secrecy of the investigation into this case, in order to protect the ongoing inquiries”.
The French presidential office’s last public comment on the Pegasus scandal was on July 22nd, and the silence since appears to indicate the extent of the diplomatic embarrassment the affair has caused with the implication of Morocco, regarded as an ally. That last comment came after a meeting of the French national defence and security council (CRDSN) which had been called specially to discuss the Pegasus revelations, when a member of the presidential staff told journalists that “no certainty” had been established about the surveillance, and that “prudence” was required. However, members of Macron’s entourage confirmed that he had changed both his phone and its number “for some of his exchanges”.
The surveillance of Macron’s phone is the subject of a separate probe by French intelligence, and at the end of July France’s national coordinator for intelligence and the fight against terrorism, Laurent Nuñez, announced that the result of the investigation would remain confidential for reasons of “defence secrecy”. Since then, no information about the case has emerged, neither about the analyses of Macron’s phone nor eventual diplomatic exchanges between France and those “friendly” countries which purchased the spyware from NSO Group, a firm known to be close to the Israeli military.
Also at the end of July, French armed forces minister Florence Parly met in Paris with her Israeli counterpart Benny Gantz, when the two discussed the Pegasus scandal, but no details of their conversation were revealed.
Questioned about the affair in an interview with French daily Le Monde, published on August 23rd, France’s junior minister for European affairs, Clément Beaune, was evasive. “Given the seriousness of the alleged events, the diplomatic response can only come if there was confirmation that a certain number of countries participated in it,” he said. “But it would be hardly responsible to do it while we are still in the process of disentangling the reality of the situation.”
-------------------------
If you have information of public interest you would like to pass on to Mediapart for investigation you can contact us at this email address: enquete@mediapart.fr. If you wish to send us documents for our scrutiny via our highly secure platform please go to https://www.frenchleaks.fr/ which is presented in both English and French.
-------------------------
- The French version of this article can be found here.
English version by Graham Tearse