The Bahraini Government has hacked nine activists using NSO’s Pegasus spyware between June 2020 and February 2021. The disclosure was made in a report published by Citizen Labs on Thursday.
The report details the numerous types of exploits used and information on the hacked activists, which include three members of Waad, three members of the Bahrain Center for Humann Rights, two exiled Bahraini dissidents, and one member of Al Wefaq.
As per the report, some of the aforementioned activists were hacked using two different zero-click iMessage exploits == the 2020 KISMET exploit and a 2021 exploit that has been termed FORCEDENTRY. In addition, at least four activists were hacked by LULU, a Pegasus operator attributed to the Bahraini government with a high degree of confidence.
Crushed human rights and demolished internet freedom
The first mention of Pegasus and the Bahraini government goes back to 2017, when the authorities purchased the spyware. Citizen Labs’ report place a Pegasus operator referred to as PEARL spying entirely in Bahrain in Qatar, which has been active since July 2017. Since 2010, Bahrain has purchased spyware from FinFisher and Hacking Team as well.
During the spike in Pegasus activity in July 2020, several tests were conducted in various countries, including Bahrain. The targets were asked to forward their call logs to Citizen Labs for analysis. They also set up VPNs for key targets to monitor internet traffic.
The analysed phone calls revealed nine devices belonging to Bahraini activists were hacked. Out of the nine targets, activist Moosa Abd-Ali and blogger Yusuf Al-Jamri consented to be named. Both of them are currently in London in exile. The remaining targets wished to be named by affiliations only.
While the Bahraini government is a constitutional monarchy on paper, all key power resides with the ruling Al-Khalifa family in practice. The government in power heavily censors the internet with the help of a website-blocking technology coming from Netsweeper, a Canadian company.
To avoid protests, the government uses targeted internet disruptions in various parts of the country. Citizens who post critical content online have been investigated and arrested by the Ministry of Interior’s Cyber Crime Unit.