In this gathering age of digital autocracy, it is hard to avoid the impression that the dictators are winning.

Khadija Ismayilova, an investigative reporter from Azerbaijan, is an icon among the subtribe of journalists who work to expose cross-border financial corruption. She has broken big stories about money laundering and dodgy banking, despite being targeted by President Ilham Aliyev’s authoritarian regime. Operatives planted cameras in her home in Baku and, in 2012, released a video of her having sex with her boyfriend. In 2014, she was arrested on trumped-up charges that included tax evasion; a court sentenced her to seven and a half years in prison. The human-rights lawyer Amal Clooney, among others, took up Ismayilova’s cause, and she was released after eighteen months, but the government prohibited her from leaving the country for five years.
press

In May, Ismayilova learned from colleagues that her iPhone had been infected by spyware known as Pegasus, made by NSO Group, an Israeli company, which has reportedly worked with Azerbaijan’s government. The product can access contact lists and activate a phone’s microphone to record conversations. Last week, an investigation published by Forbidden Stories, a journalism nonprofit based in Paris, in collaboration with Amnesty International’s Security Lab and seventeen news organizations—including the Washington Post, the Guardian, and Le Monde—revealed apparent attempts worldwide to use Pegasus against journalists, human-rights activists, business executives, and politicians. The reporting suggested that, for all Apple’s claims that iPhones are secure, and for all the efforts of reporters and activists to use encrypted channels to thwart hostile governments, “unless you lock yourself in [an] iron tent, there is no way” to defeat unscrupulous spyware users, Ismayilova told Forbidden Stories.

In this gathering age of digital autocracy, it is hard to avoid the impression that the dictators are winning. A decade ago, the Arab Spring fostered hopeful visions of social-media-enabled people-power movements toppling anachronistic strongmen from Beijing to Riyadh and Caracas. Facebook, Twitter, and other messaging platforms remain transformative tools for mobilization in many countries, yet autocratic regimes have fought back ruthlessly by unleashing legions of loyalist censors, bots, and trolls to control online discourse, and by using spyware to watch and harass troublesome journalists and dissidents.

Forbidden Stories says that its investigation found evidence that Pegasus may have been used in attempts to compromise the phones of at least a hundred and eighty journalists; eighty-five human-rights activists; and many politicians, including President Emmanuel Macron. Agnès Callamard, the secretary-general of Amnesty International, said the investigation showed that the spyware “facilitates systemic abuse.” NSO and its lawyers said that the journalists’ findings were based on “false claims,” factual errors, and “uncorroborated theories” about the significance of a leaked list of fifty thousand phone numbers that sparked the investigation. The company maintains that it restricts its clients’ use of Pegasus to such purposes as counterterrorism and fighting organized crime, and that it has dropped government clients following a human-rights audit. Israel’s Defense Ministry oversees NSO’s exports; the chair of the Knesset’s Foreign Affairs and Defense Committee said last week that it would conduct a review.

NSO says that Pegasus is not designed to function with phones registered in the United States. But there is a lot of other spyware around, and, in any event, the Justice Department has for years legally collected the phone and e-mail records of American journalists—at times secretly, by subpoenaing service providers. Federal prosecutors operate under guidelines issued by the Attorney General. These rules came about following the exposure of unhinged abuses of power during the Nixon years. (In 1972, the Nixon operatives E. Howard Hunt and G. Gordon Liddy met with a C.I.A. physician to discuss assassinating the investigative reporter Jack Anderson, possibly by smearing the steering wheel of his car with LSD, in the hope that, while high, he would have a fatal accident.) But, over time, the Justice Department has become less restrained. During the Obama Administration, the department, under the Espionage Act of 1917, prosecuted more cases involving leaks of classified information to reporters and the public than during all previous Administrations combined. Earlier this year, it was revealed that the Trump Administration’s Justice Department secretly seized phone records of reporters at the Post, the Times, and CNN.

In May, President Biden said that it was “simply wrong” for Justice to collect journalists’ records, adding, “I will not let that happen.” Last week, Attorney General Merrick Garland released a memo to federal prosecutors in which he directed them to stop seizing the records of “members of the news media” when they are “acting within the scope of newsgathering activities.” The order contains ambiguities, but it constitutes the most important step in years to protect journalists from prosecutorial intrusion. Unless Congress enshrines the protections in law, however, a future Attorney General could easily undo them.

Biden persuasively describes an unfolding “battle between the utility of democracies in the twenty-first century and autocracies” around the world, as he put it in March. “We’ve got to prove democracy works.” Strengthening First Amendment protections at home will surely help. Yet the problem of malign surveillance of journalists and dissidents abroad seems inseparable from the much wider assaults on citizen privacy that are intrinsic to much of our daily online life. When dictators abuse spyware, they are merely adapting digital marketing techniques of consumer “targeting” pioneered by Silicon Valley for the age of ubiquitous, indispensable smartphones.

Two years ago, David Kaye, who was the United Nations Special Rapporteur on freedom of opinion and expression at the time, warned that “the private surveillance industry is a free-for-all,” and that governments and corporations were causing “harm to individuals and organizations that are essential to democratic life—journalists, activists, opposition figures, lawyers and others.” He called for a moratorium on the sale and use of surveillance technology until laws to protect privacy and human rights were enacted. Since then, the European Union has moved to adopt export controls on spyware; the United States has only issued non-binding guidelines. Effective worldwide regulation is a tall order, yet the Forbidden Stories disclosures have again made plain that everyone is vulnerable. At issue in the unchecked proliferation of spyware is the future of dissent.