Despite having sponsorship from a reputable international organization, Mai Anh, a journalist and project manager in the digital rights sector based in Vietnam, has faced challenges in organizing in-person digital self-care training for journalists in her hometown. The proposed program aims to address the risks posed by spyware to vulnerable groups in digitally authoritarian Southeast Asia, including Vietnam, where internet freedom is classified as "not free" by Freedom on the Net.

Non-compliance risks heavy fines or event cancellation. 'Discussing this topic would be tantamount to portraying the Party and the state negatively, making approval impossible'

The subject matter itself may be considered taboo. Mai Anh notes that certified digital rights trainers often have ties to the single-party government, and non-profit organizations are hesitant to engage with her on this topic due to self-censorship. The 2018 Cybersecurity Law, which draws inspiration from China's model, enables the state, led by the Communist Party, to intensify surveillance in cyberspace and impose harsher penalties on online dissenters.

Mai Anh, who uses a pseudonym for safety, expressed the challenges of organizing digital training in Vietnam, stating, 'We cannot find any trainer in Vietnam for our training,' and dismissing the idea of a webinar due to anonymity concerns. Moreover, inviting an international trainer isn't feasible either, as Decision 06/2020, issued by the Vietnamese Prime Minister, mandates local authority approval for events with international funding and foreign speakers. Non-compliance risks heavy fines or event cancellation. 'Discussing this topic would be tantamount to portraying the Party and the state negatively, making approval impossible,' Mai Anh explained.

Pegasus, a sophisticated no-click spyware used in over 20 countries, can breach encryption on mobile devices. Predominantly sold to governments, including those in Southeast Asia with questionable human rights records, Pegasus and other Israeli spyware have been implicated in numerous state-sponsored digital attacks against journalists, ranging from the implementation of weaponization laws to network disruptions, harassment, and surveillance.

Covert Cyber Threats: The Hidden Dangers of Advanced Spyware

NSO Group and the governments that purchase Pegasus violate privacy by claiming to be in favor of the stability of the country and terrorism prevention to protect the welfare of people in the state and in the world without legitimate grounds

The NSO Group, an Israeli cyberespionage technology firm founded in 2010 by Niv Karmi, Shalev Hulio, and Omri Lavie, quickly became a leading player in the spyware industry. By 2020, valued at $1 billion, it emerged as the largest company in the sector. Pegasus, known for its advanced capabilities, can compromise personal data through seemingly innocuous means like an unanswered text or a missed call. "It is harrowing to be hacked, and even more so to be hacked unknowingly," said Mai Anh, highlighting the insidious nature of such attacks.

André Ramiro at the Berlin-based Humboldt Institute for Internet and Society, where he is supporting the programme “Data, actors, and infrastructures: The Governance of Data-driven Innovation and Cyber Security," said that the relationships between the Israeli government and spyware companies are very close. Ramiro noted that it's common for former members of Israel's intelligence services to establish surveillance technology companies, including those developing spyware. 'The spyware industry receives state subsidies,' he said.

Chatmanee Taisonthi, a Thai human rights lawyer handling Pegasus spyware lawsuits at Rising Sun Law Co., Ltd. in Bangkok, described the highly sophisticated and invasive nature of this single-click exploit firewall. 'It's akin to modern-day cyber warfare, capable of hacking into and accessing your personal life,' she explained. Taisonthi further highlighted the unique sales strategy of the NSO Group, the developer of Pegasus spyware. 'NSO Group exclusively sells Pegasus to governments, with sales and exports approved by the Israeli government. In the wrong hands, this spyware could significantly threaten human rights, particularly privacy and freedom,' she cautioned.
 

According to Apirak Nantaseree, a researcher at Internet Law Reform Dialogue (iLaw), in charge of examining Pegasus-related cases in Thailand, such invisible intrusions are often made under the guise of national security protection. NSO claimed to be working with governments for humanitarian and human rights reasons, such as preventing terrorist attacks and organised crimes, locating victims in the event of natural disasters, and protecting airspace from hostile drone attacks. “Normally, states or private companies cannot access an individual's personal data without permission, but NSO Group and the governments that purchase Pegasus violate privacy by claiming to be in favor of the stability of the country and terrorism prevention to protect the welfare of people in the state and in the world without legitimate grounds," said Nantaseree.

 The potential uses of the information to harm victims, or its connection to incidents like house raids against political activists, remain speculative. However, the very functionality of Pegasus already constitutes a violation of privacy and freedom

Governments Clients and Civil Society Victims: The Dual Faces of Surveillance Tech

In November 2022, marking a first in Southeast Asian history, eight Thai activists, among 30 individuals whose phones were hacked by Pegasus, took legal action against state authorities (in an administrative law case) and the NSO Group (in a civil law case) for rights violations. However, their efforts were in vain as the civil court in Bangkok dismissed the case. As of now, there are no verified cases of physical harm or specific damages directly linked to Pegasus Spyware. Nonetheless, pursuing legal action against one's own government over Pegasus use presents significant challenges, not least due to the broad and ambiguous nature of 'government' and the extent of NSO's covert operations.

"The potential uses of the information to harm victims, or its connection to incidents like house raids against political activists, remain speculative. However, the very functionality of Pegasus already constitutes a violation of privacy and freedom," stated Taisonthi.

Nantaseree added, "It's unclear how much information the NSO Group shares with Israel about individual users." Meanwhile, in some countries, the public remains largely unaware of the risks posed by such surveillance tools.

Mai Anh was taken aback by the nonchalant reaction of her journalist friends when she discussed Pegasus with them. "They even said they wouldn't write anything sensitive to avoid surveillance," Mai Anh recalled, also sharing an incident where her use of a VPN raised suspicions among her friends about anti-government activities. "They questioned if I was using the VPN to access 'enemy channels' when I mentioned it slowed down other apps," she said. 'Enemy channels' are often understood as websites run by Western media or democracy activists that counter the Party's news or criticize the Communist Party of Vietnam (CPV).

Mai Anh observed that awareness of spyware is generally limited to those concerned with human rights. "State-controlled media only offer sporadic reports about the growing use of Israeli spyware, often highlighting its acquisition by Western governments," she noted.

 A state-affiliated Vietnamese journalist, who spoke on condition of anonymity, reckons that the best way forward is an avoidant approach. “If we cannot know anything about the phone tacking tool, it is best not to cover anything sensitive," said the journalist. “I think the spyware is dangerous, but I do not think I will be the target.”. In addition, victims might be between a rock and a hard place. Activists do not want to be known as hacking victims. As a result, it is very hard to launch an investigation. “Victims might not yet know that they are victims, or if they do, they might not want to disclose themselves as activists," said Mai Anh. “In Vietnam, it is dangerous to declare oneself openly as an activist.". 

Global Response: Combating the Threat of Pegasus Spyware

Computer Professionals’ Union in the Philippines chairperson Kim Cantillas called for governments from democratic countries to expressly condemn the development and profiteering of this kind of technology. “Democratic governments can put pressure on the Israeli government to order the cessation of the development and sale of spyware," said Cantillas. 

For Nantaseree, there should be a treaty with penalties for states that violate the right to personal data. “International organizations should jointly take measures to limit the illegal use of Pegasus or other spyware in the global community and set standards for using spyware to not violate personal rights as much as possible," said Nantaseree. 

 It is harrowing to be hacked, and even more so to be hacked unknowingly

However, achieving this is complicated because it lies in the political will of state governments. The Israeli government has so far been unresponsive to such demands. Israel has diplomatic relations with most Southeast Asian countries, except for Brunei, Malaysia, and Indonesia. Generally, the Israeli government tends to only sell the spyware to countries that are allied with Israel. Nevertheless, there is evidence suggesting that since 2018, Indonesia has been using spyware to target opposition leaders and activists, as revealed by the whistleblower platform IndonesiaLeaks. Additionally, the Malaysian government, despite its boycott of Israel, has reportedly acquired this Israeli state-sponsored spyware.

Berlin-based researcher Ramiro commented, “The [Israeli] government leverages this industry as a diplomatic tool to forge closer ties with other strategically important countries. As such, these states should be held accountable for any human rights violations resulting from its use, either in Israel or other countries.”

Thai lawyer Taisonthi emphasized the need for a concerted effort to combat the spread of spyware. "Halting the use of spyware like Pegasus requires a united front from state entities and the global community, including international human rights networks, UN Human Rights Bodies, and social media platforms worldwide. They should collectively condemn the sale of Pegasus spyware and the governments likely to abuse it, urging respect for human rights. The efforts of human rights defenders alone are insufficient to counteract this powerful surveillance network."

Taisonthi believes that international advocacy to increase awareness about Pegasus spyware and its associated risks could play a crucial role in halting its use. "Public participation can serve as a powerful tool for citizens to hold their governments accountable, ensuring that taxpayer money is not spent on technologies that gravely violate human rights," she said.