Democracy campaigner to sue Saudi Arabia over Pegasus and QuaDream spyware in UK court

Data access

The spyware potentially enabled the Saudi government to access a wide range of data, including text messages, calls, location data, photos and files. It also gave Saudi officials the ability to intercept voice calls, remotely activate and record from microphones in mobile devices, and take photos and track Assiri’s movements, according to the complaint.

Assiri is bringing claims against the Kingdom of Saudi Arabia over the misuse of private information, harassment and trespass of goods.

The former captain in the Royal Saudi Airforce, who claimed asylum in the UK in 2014, is a prominent dissident who has publicly criticised the Kingdom of Saudi Arabia’s human rights practices.

Assiri received a text message in May 2018 containing a link that he clicked on, causing his iPhone to freeze.

Analysis of Assiri’s phone by Amnesty International and The Citizen Lab revealed that the URL sent to him appeared to be hosted on a server linked to Pegasus spyware and associated with Saudi Arabia.

In September 2018, a replacement phone used by Assiri was compromised by spyware, attributed to QuaDream, resulting in large amounts of data being covertly accessed.

Assiri received a text message in July 2020 containing a link to Pegasus internet domains that matched previous attacks on Saudi dissidents.

Analysis by the Citizen Lab confirmed that his phone was successfully hacked by Pegusus spyware using “zero-click” exploits.

At the time of the attack, Assiri was working on the case of murdered journalist and critic of the Saudi administration Jamal Khashoggi, advocating sanctions on Saudi officials and lobbying for a UK boycott of the Saudi-hosted G20 summit.

Assiri had stored a large volume of sensitive and confidential information on his iPhone, including court documents, details of contacts, ID documents of human rights defenders in Saudi Arabia, and other highly sensitive information

Pegasus

According to the complaint, Pegasus spyware is capable of monitoring text messages, emails, calendar records, call history, instant messages, contacts lists and the browsing history of infected phones.

It can also intercept phone calls and secretly record from built-in microphones, retrieve photos, take screen shots and photographs, retrieve files stored on mobile devices, and continuously monitor location through phone cell IDs and GPS.

Users of Pegasus software have the capability to create “rules” to send alerts, for example, when the target arrives at a particular location, meets another target, uses a key word in a message or phones a particular person.

Pegasus can be remotely uninstalled and is designed to leave no trace that it was ever on the target device. It features a self-destruct mechanism to uninstall where there is a risk of exposure.

QuaDream

Now-disbanded Israeli company QuaDream offered spyware exploits, malware and infrastructure marketed under the name, Reign.

There is little publicly available information about QuaDream, and it’s unclear whether the spyware is still in use.

The software uses “zero-click” exploits to allow it to be installed on a device without requiring the user to click on a link.

Like Pegasus, the spyware is able to intercept and record voice calls, activate the microphone of an infected device, take photographs, search and access files and databases, and track the users’ location.

Assiri’s case is the second to be brought against Saudi Arabia in the UK courts over Pegasus spyware.

In January, the Court of Appeal in London struck out an appeal by the Kingdom of Saudi Arabia against legal action brought by human rights campaigner Ghanem Al-Masarir, after the Kingdom failed to comply with an order to pay funds into court.

Al-Masarir, represented by Leigh Day, is claiming psychological damage resulting from the misuse of private information and harassment after the Saudi government targeted his phone with Pegasus spyware acquired from Israeli tech company NSO Group.

Metropolitan Police investigation

In a separate action, the Metropolitan Police is investigating complaints from four activists that they have been targeted by spyware from Saudi Arabia, the United Arab Emirates and Bahrain.

The case, filed by the Global Legal Action Network, names NSO Group Technologies Limited, the Israeli software company that supplied Pegasus technology; Q Cyber Technologies, a Luxembourg-based firm linked to NSO; and Novalpina Capital, a UK private equity business that undertook a “management buyout” of NSO in 2019; and individuals involved in the sale of Pegasus.

Pegasus was implicated in the murder of journalist Jamal Khashoggi at the Saudi embassy in Istanbul.

It has been used in attacks within UK government networks, including the Prime Minister’s Office and the Foreign, Commonwealth and Development Office, and it was used against a member of the House of Lords, Fiona Shackleton, when she was acting as the legal representative of Princess Haya of Dubai.

Saudi targeted human rights victims

Yahya Assiri said he was concerned that Saudi Arabia had targeted victims of human rights abuses and their families simply because they had been in touch with him.

“I am fully aware that the authorities will want to target me,” he said. “However, it is outrageous for them also to target individuals such as the victims of rights abuses and their families in Saudi Arabia simply because these people have been in contact with me. We have no idea how the authorities might use the information found on my device against them.”

Saudi Arabia is expected to argue that it has state immunity, a claim currently being tested by law firm Leigh Day in the case of Al-Masarir, a vocal opponent of the Saudi regime, who was also targeted with Pegasus.

Assiri is expected to argue that there are exceptions to state immunity for property damage and personal injury.