The Washington PostDemocracy Dies in Darkness

French government confirms cabinet ministers’ phones bore traces of Pegasus spyware, news outlet reports

The numbers were on a list of more than 50,000 that sparked an investigation into the misuse of spyware the NSO Group licenses to governments

An NSO Group building in Sapir, Israel. (Sebastian Scheiner/AP)

The phones of five French cabinet ministers bore traces of powerful Pegasus spyware, according to an analysis done by their country’s security agencies, France’s Mediapart news outlet reported Thursday.

The confirmation that Pegasus was directed against the ministers underscores the degree to which spyware developed by the Israeli company NSO Group has been used to penetrate the top reaches of a powerful democracy.

The cabinet ministers’ phone numbers were among more than 50,000 on a list that a consortium of 17 media organizations, including The Washington Post, used to investigate potential misuse of the spyware in stories published in July. That investigation, dubbed the Pegasus Project, identified the phones of hundreds of public officials as being on the list.

The investigation confirmed Pegasus infections or attempts on 37 phones that owners had made available for forensic examination, but until Thursday, there had been no confirmation that the French officials’ phones had been targeted. The phones were not among those examined during the news outlets’ investigation.

On the list: Ten prime ministers, three presidents and a king

The list also included a number belonging to French President Emmanuel Macron, whose phone was not among the five identified as targeted on Thursday. French media reported in July, shortly after the Pegasus Project was published, that Macron had changed his phone number and device, but there has been no word on whether it, too, had been targeted.

In all, the news outlets identified numbers on the list belonging to 10 prime ministers, three presidents and a king, in addition to more than 600 other government officials and politicians, 189 journalists and 85 human rights activists.

Once infected with Pegasus, a phone can be turned into a portable eavesdropping device, with the hacker able to turn on its camera and microphone without the knowledge of its owner. The spyware also allows outsiders to flip through the contents of a phone just as though it were sitting unlocked in front of them, enabling access to emails, photos and even encrypted messaging apps such as Signal and WhatsApp.

Forbidden Stories, a Paris-based journalism nonprofit, and Amnesty International, a human rights group, gained access to the list of numbers and shared it with the news organizations, which did further research and analysis. Amnesty’s Security Lab did the forensic analyses on smartphones physically examined by the consortium.

Private Israeli spyware used to hack cellphones of journalists, activists worldwide

Mediapart reported that the ministers whose phones bore traces of the spyware included National Education Minister Jean-Michel Blanquer, Territorial Cohesion Minister Jacqueline Gourault, Agriculture Minister Julien Denormandie, Housing Minister Emmanuelle Wargon and Overseas Minister Sebastien LeCornu. Not all of them held those portfolios at the time their numbers were entered onto the list, the bulk of which was in 2019 and 2020, but all were in the cabinet.

The ministers declined to comment, as did the Élysée Palace and France’s digital security agency.

It was not clear which of NSO clients might have used Pegasus to target the ministers’ phones. French media, including Mediapart, have suggested that the customer may have been Morocco, but the Moroccan government has denied that and is suing Mediapart in French courts.

The NSO Group previously has said it allows its spyware to be used only against suspected terrorists and criminals — not government officials, journalists, opposition figures and others who appeared on the list. NSO pledged a review of its clients and its business practices after the findings were published.