"It is a weapon": Ronan Farrow discusses the spyware in our pockets in "Surveilled"

The cogent documentary, “Surveilled,” now available on HBO, tracks journalist Ronan Farrow as he investigates the proliferation and implementation of spyware, specifically, Pegasus, which was created by the Israeli company NSO Group. The company sells its product to clients who use it to fight crime and terrorism. It is claimed that Pegasus was instrumental in helping capture Mexican drug lord, Joaquín “El Chapo” Guzman. However, there are also reports that NSO’s products are being used to target journalists, human rights activists and political dissidents. 

Directors Matthew O’Neill and Perri Peltz follow Farrow as he meets with individuals including a former NSO employee, who spoke on condition of anonymity; Ron Deibert, of Toronto’s Citizen Lab, which uncovered spyware abuse; and Elies Campo, in Catalonia, Spain, who is able to check phones for spyware. Campo discovers that members of the European parliament have been hacked in part because Catalonia has angered Madrid by wanting to become independent. He also found out his own parents and sister were targeted, which emphasizes the concerns and implications of this nefarious spyware.

Farrow explores how the United States is testing and evaluating Pegasus and other spyware as well as whether to ban or regulate it. 

Salon spoke with Farrow, along with filmmakers Matthew O’Neill and Perri Peltz about “Surveilled” and spyware. 

How did you learn about Pegasus and what made you spend two-plus years investigating spyware in general and Pegasus and NSO in particular? 

Ronan Farrow: It flowed from reporting I’d done in the Israel private intelligent space around the story “Harvey Weinstein’s Army of Spies.” I and other people were being followed around and intimated by a firm called Black Cube. Through that body of reporting and the book “Catch and Kill,” about that espionage plot, I became fascinated by the way in which surveillance issues are not incidental to any of the other issues I report upon, whether that is abuse of power in the corporate sector or national security issues. Surveillance underpins all of it. The questions of fairness and accountability is so often shaped by whether people in power are surveilling their opponents. I wanted to unmask that industry. It is not that I don’t think there is a place for it to exist, but people need to understand how much watching people who are less powerful in a democracy can shrink the space for democratic expression. 

Through those relationships, I understood that what I have been exposed to — old-fashioned gumshoes and some light tech surveillance. I also came to understand that as much as that shrank that space of my reporting, it wasn’t the outer edge. The consequential part of it was this incredibly advanced technology you see documented in the film. Pegasus can turn on your phone freely, it can capture all your calls, photos and videos, and disgorge every text and email you sent. I was fascinated by the capacity of tech accelerating and how available and how prevalent it was becoming. 

Matthew and Perri, how did you get involved in making this film, and what decisions did you make in how to tell or approach the story? 

Matthew O’Neill: This topic chose us. The executives at HBO, Lisa Heller and Nancy Abraham, connected Perri and me to Ronan to have a conversation broadly about what he was working on, and what we were working on. Together, we created the “Axios” on HBO series, which used the intersection of documentary techniques fused with television journalism.

Perri Peltz: We really looked at this as an opportunity to go behind the scenes in the journalism. So much of it was based originally on Ronan’s reporting for The New Yorker. Having the opportunity to follow Ronan as he investigated this story is incredibly compelling. This is not a talking heads film, it’s watching Ronan do what he does so well, and we thought capturing that on film would translate well for the audience. 

O’Neill: The idea was that the audience would feel like they are going on journey of discovery with Ronan, like riding shotgun in his investigation. We were lucky to have Ronan’s voice, but also seeing the detritus of Ronan’s all-nighter eating at his desk at The New Yorker, when he’s rushing for the deadline, gives a behind-the-scenes look at what print journalists do. The work is really time consuming, and difficult, and challenging. You get a taste of that. 

In the film, you uncover that NSO has been selling Pegasus to Europe for one price and the Middle East for 25 times that price as well as to African countries. Is this simply a “follow the money” story? Does this all come down to a question of supply and demand? 

Farrow: That’s certainly part of it. It calls into question the dog-and-pony show you get from some of these leading spyware companies who say our business is about empowering benign democracies. Employees [in these companies] quit over ethical concerns saying no, the bread and butter is in the cases where the company knows or should know that there are going to be abuses. That is an intractable problem for this industry. It is a weapon of sorts. Lawyers at NSO make this point on camera in the film — this is a form of arms dealing. We’re selling weapons to the world, and it is not our fault that there is no Geneva Convention equivalent to put guardrails or consequences that are sufficient. Yes, it is a "follow the money" story about who is using and making this technology. To be clear, the NSO group is just one example in this multibillion-dollar industry. It’s everywhere now.

O’Neill: We hope that the balance between the supply and the demand is clear. In terms of law enforcement, and you also hear it from [Congressman] Jim Himes, the top Democrat on the intelligence committee saying, “If this is software that can help rescue my theoretically kidnapped child, I want that.” It’s part of the real challenge in terms of abuse and potential use of this software. What is a crime and what is being investigated as a crime? What you see unfold in Catalonia is people who are representatives of civil society advocating for certain political situations. They are seen by representatives of the state as legitimate targets of investigation. It is easy when it is a clear terrorist or someone who kidnapped a child to say their phone should be hacked, but when these tools are all powerful because it’s geolocation, pictures and medical records, that’s a whole new territory. 

Farrow: It is such an under-regulated space. The stories captured in the film include Elies and his family finding out in real time that they have been hacked and all of the consequences of that. They are innocent, apolitical bystanders. I hope that people see those stories and understand it is not just information gathering; it really can intimidate and be so painful personally. But also, it shrinks the space for free expression and efforts to holding people accountable. It can come for any one of us. 

Peltz: We know that people are using Pegasus to target dissidents, activists and politicians, but there is residual and collateral damage as well. There is something about this ability to say, “It’s not going to happen to me. I’m an open book. I’m not doing anything wrong, so therefore there is nothing to be afraid of.” And that’s wrong. We both learned you don’t have to be a politician, or an activist, or a dissident. You see this in Elies’ mother, a physician, and all the images of her patients that get exposed as a result of Pegasus. If you think, I haven’t done anything wrong, why does it matter? It does matter, and all of us need to worry about what the potential impact is. You never know [spyware] was there. It copies everything on your phone and it leaves. That’s really bad. It’s your bank and health records, your photos, your family. 

Surveilled (HBO)

It is exponentially terrifying. Do you worry that your phones, or your family member’s phones, would be hacked because you were investigating this topic? Did you have Elies test your phone? 

Farrow: Yeah, I am really in a situation now where no one is going to want to hang out with me, dammit! [Laughs] Of course, I worry about this all the time, and try to exercise good digital hygiene, and use devices as secure as possible and test those devices regularly.  But to do the work I do is to acknowledge it is all porous and you have to work as hard as you can to protect yourself and your sources. But these days, ultimately, if someone wants to put the effort and money into hacking you, they can. It can happen. 

Peltz:  Absolutely. Elies did test our phones. We were aware that it was a possibility, So far, so good, but we absolutely had our phones checked and it would be foolhardy if we didn’t. 

Likewise, I fear we should be very concerned that with this incoming administration spyware is going to be unregulated in the United States, and there will be consequences. What observations do you have about spyware’s immediate future?

Farrow:  I put up a piece in The New Yorker this week. It was fascinating to talk to experts in the privacy law space who are really in a high state of alarm right now. The United States, under administrations from both parties, has flirted with this technology in ways that is alarming. Under the first Trump administration, they bought Pegasus. They claimed they were buying it to test it and see what our enemies were doing, and The New York Times later sued them for more information and found really persuasive evidence that the FBI wanted to operationalize that in American law enforcement investigations. 

In this latest piece I talk about ICE and the Department of Homeland Security purchasing spyware tech from a company called Paragon, and that contract is currently under review, and we don’t know if that will be unraveled, or what restraints will be put on that. The thing I hear from these privacy law experts is the DHS is where you see the purchasing of legally dubious technology because they have a built-in excuse, “Hey, it’s all in the course of law enforcement operations.” There is very little reason to think that we are going to see more aggressive self-policing under this incoming Trump administration than we did under the Biden administration. And under Biden it was insufficient. They promised to pass an executive order, and they did, ostensibly limiting how much of this spyware the government can purchase. But we are already seeing how many loopholes there are to that. You can imagine how you couple the Trump administration’s various promises that are so much about targeting the opposition, enemies and vulnerable groups – and statements that show a flagrant disregard for law – you can image how experts fighting in this space to safeguard privacy rights are really worried right now.

O’Neill: It’s Sinclair Lewis — “It can’t happen here.” We look around the world and think this is going to happen in China and in Russia, and other places. If there is something that changed for us over the course of film, it was understanding this can happen in democracies, and with U.S. allies. It can certainly happen here. It is just a matter of decision-making of the people in charge. 

Peltz: This is not going away. We are not putting this genie back in the bottle. It’s just a question of understanding how best to regulate its use. 

Is there an appropriate use for spyware?

Farrow: This is not a new part of the story of government excess or breeches of privacy. There is always this debate that there are legitimate law enforcement reasons, certainly theoretically, where we can reach for cases where that’s how it played out, or instrumental in exposing criminal plots and tracking down criminals. There is a reason why law enforcement officials love the idea of being about to do that without any guardrails on it. They want to be able to open up any phone at any time. In democracies with checks and balances in them, we tend to restrain that because it is a fundamental truth that is going to be abused. If companies only promise to sell it to governments who police the use of this, we only see abuses in conventionally repressive settings, like Saudi Arabi, and Jamal Khashoggi getting killed. Technology allegedly was on phones around him. 

Now this history we are reporting on in this film is much more about realizing it is happening everywhere. Having a constitution that protects privacy rights, and having a set of rules and regulations that should be followed isn’t enough. That’s how you see these scandals playing out in Greece and Spain, as you see in the film, and Poland. It’s the same pattern. The government says they are using it for law enforcement purposes, and then there is this overreach, and suddenly it is on the phones of political opposition members, activists and journalists.

Any problems we have in this country, where we want people to be able to expose facts related to the problem, or we want people to freely express dissent to the government is affected by the proliferation of this relatively cheap, increasingly easy to use, increasingly intrusive spyware. The less space there is for privacy for those kinds of conversations, the more the powerful can keep things under their thumbs. That is something we should all be worried and thinking about. It is not specific to United States or any one political party, it is just a fundamental truth. 

O’Neill: Ultimately, it’s about the rule of law and the system of checks and balances that exist for the use of any surveillance technology including this incredibly powerful one. That is our best hope for responsible use by governments and by our own government. As consumers, we can keep the pressure on providers of all the apps we use, the browsers, the operating systems saying, “We want privacy. Privacy is driving our decisions on what we use.” If we keep pressure on the technology companies, that privacy matters to us and they will keep up in the cat-and-mouse game of hackers and commercial spyware providers.

Peltz: This is a Gordian knot of a problem. This doesn’t go away entirely unless our cell phones go away entirely.  What are the chances of that? Pretty close to zero. This is a problem that will be with us as long as we are in a connected world. We just have to figure it out and grapple with it.

Want a daily wrap-up of all the news and commentary Salon has to offer? Subscribe to our morning newsletter, Crash Course.

What are our options here? 

Farrow: I do think people can and should vote according to these kinds of civil liberties concerns and look for political candidates, on whatever side of the aisle, who are going to protect our privacy rights and our basic freedoms. If you care about this, you should call and write to representatives in Congress that this is a concern, and we need legislation that puts guardrails on this. We need people on the Hill to hold whoever is in the White House to account on this and make sure there is greater transparency about what government offices are purchasing commercial spyware, what the vetting process is, what the red lines are when it can be used. 

I criticize the Biden administration heavily on this and I sat down with a Biden administration official and asked, “Why are you not being transparent about the loopholes here?” The executive branch of the government is never automatically going to self-police. They are going to want the loopholes. Maybe sometimes for an understandable law enforcement reason, but it should be our job as a body politic to press people in Congress to force rule-making and accountability. Otherwise, you see in one democracy after another where innocent peaceful protesters and political opposition members are being targeted, and journalism and the flow of information is threatened. 

Peltz: Unless you give up that connected life, you are going to be dealing with these issues at some level. What is second best, is figuring out how to regulate it. It is here to stay to some extent.

O’Neill: The only simple concrete advice we received was reboot your phone every day. Pegasus software is designed to erase itself, so if you reboot your phone, you are not vulnerable if it infected you yesterday. 

Peltz: I don’t want to be a downer, but I’m going to add to that: Sometimes. 

“Surveilled” is now available on HBO.