European lawmakers launch investigation into use of Pegasus spyware by EU states

The European Parliament voted on Thursday to create a new “committee of inquiry” to investigate allegations that European member states acquired and used the powerful Pegasus mobile spyware.

Lawmakers voted largely in favor to create the committee, which will investigate the use of Pegasus and other surveillance spyware across the 27 member states of the European Union. A committee of inquiry allows lawmakers to investigate possible breaches of European law.

In a statement, the European Parliament said the committee “is going to look into existing national laws regulating surveillance, and whether Pegasus spyware was used for political purposes against, for example, journalists, politicians and lawyers.”

Pegasus is a powerful mobile spyware developed by Israeli company NSO Group that can gain near-complete access to data on a target’s device. NSO is one of the more prolific and known spyware makers on the wider surveillance scene, allowing governments and law enforcement access to device data by exploiting security flaws and weaknesses in their device’s software. But researchers have consistently found that members of civil society — journalists, activists and human rights defenders — have been targeted by governments using the Pegasus spyware, despite assurances that only serious criminals and terrorists are targeted.

The formation of the committee comes less than a month after the European Data Protection Supervisor called for a bloc-wide ban on the use of Pegasus and other mobile spyware, fearing an “unprecedented level of intrusiveness,” citing reports that the spyware was deployed in two EU member states, Hungary and Poland.

In January, researchers at Citizen Lab found evidence that critics of Poland’s ruling party, including opposition lawmaker Krzysztof Brejza, were targeted with the spyware. Text messages stolen from Brejza’s phone were subsequently leaked, doctored and broadcast on state-controlled television, after which he lost the election by a close margin. Brejza has since accused the Polish government of interfering with the election.

Researchers have also reported Pegasus infections in France, Germany and Spain.

Per Europe’s rules, the European Parliament’s Pegasus committee will run for one year but can be extended by up to six months.

This tool tells you if NSO’s Pegasus spyware targeted your phone