{"id":5471,"date":"2023-04-19T12:42:54","date_gmt":"2023-04-19T12:42:54","guid":{"rendered":"https:\/\/exciting-panini.13-37-234-21.plesk.page\/?p=5471"},"modified":"2024-07-23T14:05:03","modified_gmt":"2024-07-23T14:05:03","slug":"pegasus","status":"publish","type":"post","link":"https:\/\/viqtor.eu\/en\/pegasus\/","title":{"rendered":"Pegasus \u2013 spyware that challenges the law."},"content":{"rendered":"
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\"Pegasus\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t

Pegasus - spyware that challenges the law.<\/h1>\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\n

Legal Watch No. 37 \u2013 July 2021<\/strong><\/p>\n\n\n\n

Pegasus \u2013 spyware that challenges the law<\/strong>In July, the Pegasus project revealed the unprecedented surveillance impact of Israeli spyware that can listen to and extract data from smartphones running iOS or Android.<\/p>\n\n\n\n

This is the conclusion of an international investigation conducted by the NGO Forbidden Stories, with the help of Amnesty International and the Citizen Lab at the University of Toronto, as well as 17 major international media outlets, including Le Monde and The Guardian.<\/p>\n\n\n\n

While the software has already been talked about in the past, recent information provides a better understanding of the extent of surveillance made possible without the knowledge of smartphone users.<\/strong><\/p>\n\n\n\n

Around 50,000 target telephone numbers were reportedly selected, including a thousand in France, concerning civil society actors, journalists and politicians.<\/p>\n\n\n\n

Among the 55 countries listed as clients of NSO, which markets the software, are Saudi Arabia, the United Arab Emirates, India, Hungary, Rwanda, Mexico and Kazakhstan.<\/p>\n\n\n\n

NSO claims to follow a strict ethics policy and only deals with intelligence and law enforcement agencies for the purposes of combating crime, terrorism, drug trafficking and pedophilia.<\/strong><\/p>\n\n\n\n

These allegations, as well as the assurances given by the software owner, raise practical and legal questions.<\/p>\n\n\n\n

Even if guarantees are taken upstream of marketing, what are the real means of ensuring compliance with the contractual framework between NSO and its official clients, and its use by unauthorized parties and against political or civil society "targets", for example?<\/p>\n\n\n\n

The particularly intrusive and undetectable nature of this technology raises questions about the regulation of surveillance techniques in the international and European context.<\/strong><\/p>\n\n\n\n

In Europe, while law enforcement has specific investigative powers, these are strictly regulated by the GDPR and by national laws transposing the European "police-justice" directive of April 27, 2016.<\/p>\n\n\n\n

In France, this is Chapter XIII of the Data Protection Act.<\/p>\n\n\n\n

Data processing carried out more specifically by state security or national defense is excluded from the scope of the European Directive but remains subject in France to the Data Protection Act.<\/strong><\/p>\n\n\n\n

The clandestine introduction of spyware into computer systems can only be authorized under specific legal provisions.<\/p>\n\n\n\n

The matter is regulated by laws no. 2015-912 of July 24, 2015 relating to intelligence and no. 2017-1510 of October 30, 2017, known as the SILT law.<\/p>\n\n\n\n

The CNIL also points out that there must be elements presenting a concrete threat to the bodily integrity, life, freedom of people, or an attack on the fundamental interests of the nation.<\/p>\n\n\n\n

If the principles of the law apply, on the other hand, the CNIL has no power to control the implementation of intelligence service files.<\/p>\n\n\n\n

In its recent opinions on the bill on the prevention of acts of terrorism and intelligence (now voted on), it reiterated its request to be able to exercise its control powers in a manner adapted to new investigative techniques.<\/p>\n\n\n\n

She also called for the strengthening of the powers of the Intelligence Techniques Control Commission (CNCTR).<\/p>\n\n\n\n

Both the CNIL and the European Data Protection Committee stress the importance of effective supervision in the field of intelligence and state security, particularly in the context of increasingly intrusive processing, combined with the development of cutting-edge technologies that ignore borders.<\/strong><\/p>\n\n\n\n

These requirements are among the criteria cited by the Committee in its recent recommendations on the essential guarantees to be provided by third countries to the EU in terms of surveillance.<\/p>\n\n\n\n

They aim to protect European data from disproportionate interference in the event of international transfer.<\/p>\n\n\n\n

Given the increasing ease with which communications data can be intercepted, more fundamental questions arise about the technical measures that should be taken to limit these risks.<\/p>\n\n\n\n

In its press release of March 9, 2021 on the "ePrivacy" Regulation, the European Committee emphasizes the need to maintain data confidentiality throughout the communication process, and data encryption.<\/p>\n\n\n\n

In the same perspective, the question arises of the advisability of maintaining "back doors" in communication terminals for intelligence purposes, at the risk of seeing an increase in abuses and misappropriation of data beyond all control.<\/p>\n\n\n\n

And also<\/u><\/strong><\/p>\n\n\n\n

France:<\/strong><\/p>\n\n\n\n

The CNIL has published its position regarding the mandatory extension of the \u201chealth pass\u201d in certain places.<\/strong><\/p>\n\n\n\n

Without calling its principle into question, it recalls the need to limit its use in a context of demonstrated health emergency, requests an evaluation of the system by parliament in the autumn and underlines the ethical aspects of the problem, which go beyond questions of data protection.<\/p>\n\n\n\n

She requests that the legislator take into consideration "the risk of habituation and trivialization of such devices that infringe on privacy<\/strong> and of a shift, in the future, and potentially for other reasons, towards a society where such controls would be the norm and not the exception."<\/p>\n\n\n\n

Also in connection with the health crisis, the CNIL has reiterated the principles to be respected when communicating to doctors the list of their unvaccinated patients.<\/p>\n\n\n\n

Two sanctions are worth noting.<\/strong>, imposed by the CNIL on July 22 and 28 against<\/p>\n\n\n\n