Full Report
Last month, the Supreme Court of the United Kingdom issued a highly anticipated decision in The Kingdom of Bahrain v. Shehabi and another (Shehabi). The claimants, two Bahraini dissidents living in the U.K., allegedly suffered psychological harm after Bahrain used FinSpy spyware to hack into their devices. In an important step towards accountability, the court […] The post U.K. Supreme Court Opens Door for Spyware Victims to Sue Foreign States appeared first on The Citizen Lab.
Analysis Summary
# Morning News Roll-up October 24, 2024
## Overview
Today's report covers significant legal and technical developments in the landscape of state-sponsored targeted surveillance. The primary focus is a landmark U.K. Supreme Court ruling regarding the use of FinSpy against dissidents, alongside new findings of Pegasus spyware targeting European parliamentary members and a massive surge in Apple threat notifications.
## Top Stories
### U.K. Supreme Court Opens Door for Spyware Victims to Sue Foreign States
- Summary: The U.K. Supreme Court ruled in *The Kingdom of Bahrain v. Shehabi* that foreign states do not enjoy state immunity in U.K. courts when their use of spyware causes harm on U.K. soil. This case involves Bahraini dissidents targeted with FinSpy, setting a major precedent for legal accountability in transnational repression.
- Source: hxxps://citizenlab[.]ca/uk-supreme-court-opens-door-for-spyware-victims-to-sue-foreign-states/
### Member of EU Spyware Investigating Committee Hacked with Pegasus
- Summary: Forensic analysis confirmed that Stelios Kouloglou, a former Member of the European Parliament, was targeted with Pegasus spyware while serving on the PEGA committee—the very body tasked with investigating spyware abuses. The breach potentially exposed confidential committee deliberations and documents.
- Source: hxxps://citizenlab[.]ca/research/member-of-committee-investigating-spyware-hacked-with-pegasus/
### Apple Issues Unprecedented Number of Mercenary Spyware Alerts
- Summary: A recent wave of threat notifications from Apple has reached a record number of users globally. These alerts warn individuals that they have been targeted by sophisticated "mercenary spyware" attacks, highlighting an intensification of targeted digital espionage campaigns.
- Source: hxxps://citizenlab[.]ca/unprecedented-number-of-apple-users-received-recent-spyware-alert/
***
# State-Sponsored Hacking and the Shehabi Decision
## Key Points
- **Legal Precedent:** The U.K. Supreme Court ruled that state immunity is not a "blunt defense" for foreign governments who use spyware to cause psychological or physical harm to individuals within U.K. borders.
- **Transnational Repression:** The case highlights the growing trend of "cross-border hacking," where states target exiles and dissidents living in democratic nations.
- **PEGA Committee Breach:** Beyond the Bahrain case, researchers confirmed that high-level political figures (MEPs) are being targeted by Pegasus to disrupt oversight of the surveillance industry.
- **Apple Notifications:** There is a significant uptick in Apple's detection of these sophisticated attacks, indicating broader deployment of these tools than previously recorded.
## Threat Actors
- **The Kingdom of Bahrain:** Attributed as the entity behind the hacking of U.K.-based dissidents.
- **Unidentified State Actors:** Entities utilizing Pegasus (NSO Group) and FinSpy (FinFisher) to target political figures and civil society.
- **Motivations:** Surveillance of political dissidents, suppression of opposition, and intelligence gathering on legislative oversight committees.
## TTPs
- **Remote Device Exploitation:** Deployment of sophisticated spyware capable of complete device takeover.
- **FinSpy Deployment:** Used for hacking into personal devices of dissidents to monitor communications and location.
- **Pegasus Exploits:** Zero-click or one-click exploits used to gain access to confidential documents and microphone/camera functions.
- **Psychological Warfare:** Use of digital intrusion as a tool of transnational repression to intimidate victims living abroad.
## Affected Systems
- **Mobile Platforms:** iOS (Apple) and potentially Android devices.
- **Victims:** Bahraini dissidents (Sayed Ahmed Alwadaei and Saeed Shehabi), Members of the European Parliament (Stelios Kouloglou), and numerous Apple users worldwide.
- **Data at Risk:** Confidential legislative documents, encrypted communications, and personal metadata.
## Mitigations
- **Legal Redress:** The ruling enables victims to pursue civil litigation against foreign states, serving as a deterrent against future operations.
- **Platform Alerts:** Apple’s threat notification system serves as a primary detection mechanism for victims of mercenary spyware.
- **Device Isolation:** High-risk individuals are encouraged to use "Lockdown Mode" on iOS devices.
- **Forensic Audits:** Regular forensic analysis of mobile devices for individuals in high-risk sectors (government, journalism, activism).
## Conclusion
The U.K. Supreme Court's decision marks a critical shift in the risk landscape for state actors using commercial spyware. By removing the shield of state immunity for domestic harms, the court has created a new pathway for accountability. However, the discovery of Pegasus on a PEGA committee member's device demonstrates that threat actors remain undeterred, actively targeting those who attempt to regulate the industry. Analysts recommend that high-risk individuals maintain rigorous digital hygiene and heed manufacturer security alerts immediately.