Zero-click spyware poses existential crisis for journalism: A Q&A with CPJ Technology Editor Madeline Earp
CPJ recently released its special report, “How zero-click surveillance threatens reporters, sources, and global press freedom.” For this month’s Insider, we spoke to Madeline Earp, CPJ’s technology editor, about how governments use spyware against journalists–and what CPJ is doing to protect them.
Does the term zero-click software mean that governments can remotely access my phone without my knowledge?
Yes, which is why we’re calling it an existential crisis for journalists. Governments with the right resources have, unfortunately, long been able to hack into our devices without our being aware of it. What’s changed is that companies are now packaging that capability so that governments without the in-house expertise can buy it off-the-shelf and watch everything we’re doing.
There’s very limited oversight into how they’re using these tools. The few that apply for warrants are doing so under archaic laws that don’t account for cameras, location data, online banking, cloud storage–the myriad ways our phones capture our daily lives. And far more invoke national security as a reason to keep their activity secret and spy on their perceived opponents with no repercussions.
Hackers used to trick people into installing surveillance software–for example, by sending someone a link or attachment that they would be likely to click on. They still do.
But the past few years have seen more and more spyware installed via weaknesses in software on the phones themselves instead of rogue links–hence, “zero click,” since you don’t have to take any action yourself. This makes surveillance even harder to detect and prevent. It’s still quite an investment to spy on people this way, but historically we know that technology just gets better and cheaper!
For the report, CPJ spoke to many journalists targeted by spyware. What are they saying, and what are they doing to protect themselves going forward?
Protecting sources is a fundamental tenet of journalism, so everyone we interviewed was acutely aware of the challenge of doing so when you can’t trust your phone, your primary communication method. It’s striking how many journalists were not surprised to learn that they were under surveillance – like Szabolcs Panyi in Hungary or Soulaiman Raissouni in Morocco. It’s a reminder that journalists have to factor that threat into their daily lives, and that serious repercussions can follow on from it. Raissouni, who used to report on corruption, is now behind bars.
Discouragingly, journalists everywhere expressed little optimism about the future of privacy. Those monitoring official investigations into spyware abuses in places like Mexico are seeing no meaningful progress. There’s also a pervading sense that security precautions are futile in the face of this sophisticated technology. Importantly, we talked to experts who caution individuals not to despair–we can still separate our work phones from our personal lives to limit our exposure. Journalists in India told us they keep phones and computers out of the room when they’re having sensitive conversations. There’s always pen and paper!
CPJ has a long list of recommendations for global leaders and institutions to end the use of spyware to surveil the press. Has CPJ advocacy had any impact so far, and what is CPJ doing to help?
Writing for our report, the former U.N. special rapporteur David Kaye calls for a permanent ban on spyware. But in Washington and Brussels we’re also pushing for interim measures, like stepping up export controls and finding better ways to notify victims of spyware and provide them with legal recourse.
CPJ’s role is to remind the world that journalists’ lives and livelihoods are on the line–Jamal Khashoggi’s 2018 death was a tipping point for us in that respect, since people began to realize how many of his close associates were spyware targets, and how much of the brutal plot to murder him depended on advance knowledge of his plans. We are starting to see some real movement, like the U.S. export controls on the NSO Group spyware company last November, and of course the E.U.’s regulation on dual-use surveillance exports. There’s a long way to go, but we’re lucky to be working alongside Citizen Lab, Amnesty International, Access Now, and many others to keep spyware control on the international agenda.
CPJ in action around the world
With more than 60 staff, representatives, and correspondents, CPJ’s international presence extends from Abuja to Vilnius. During the last month, CPJ participated in conferences, provided safety workshops for journalists on the ground, engaged in a fact-finding mission, and monitored court proceedings. For this issue of Insider, we’re taking a look at a few of those trips and how they inform our work.
CPJ’s Deputy Emergencies Director Kerry Paterson traveled to Tbilisi, Georgia to participate in ZEG, an annual conference organized by independent online media group Coda Story and the Tbilisi Impact Hub. This year the conference focused on the needs of Ukrainian journalists, and Paterson took part in a panel to discuss the safety concerns of journalists covering Russia’s war on Ukraine. CPJ also met with journalists, editors and media safety professionals from around the world to discuss the state of press freedom and learn more about how CPJ can support journalists in distress.
Understanding the needs of journalists in the field is a key component of our work, and we also provide journalists with safety workshops and one-on-one consultations. CPJ’s India Representative Kunal Majumder and safety specialist Colin Pereira conducted a series of workshops across four cities in India–Chennai, Guwahati, Tezpur and New Delhi–for around 500 journalists. CPJ conducted additional workshops at The Hindu newspaper in Chennai and the Press Trust of India (PTI) news agency in New Delhi. Pereira also participated in “The Media Rumble” conference hosted by media outlet Newslaundry, where he discussed the need to create a culture of safety in Indian newsrooms. Majumder hosted a Twitter Space chat with senior journalists N. Ram and Sashi Kumar on the need for a legal guide for Indian journalists and previewed the upcoming legal handbook CPJ is working on with the Thomson Reuters Foundation’s global pro bono legal service, TrustLaw.
In addition to safety advice, CPJ continued to seek justice for journalists under attack. CPJ’s U.S. and Canada Program Coordinator Katherine Jacobsen traveled to Nevada to visit with the Las Vegas Review Journal, the newspaper where slain reporter Jeff German worked. During her trip, Jacobsen spoke with local journalists about what German’s killing means for the community. She attended a court hearing in the ongoing legal battle to prevent law enforcement agencies from accessing German’s devices – a measure that could provide information about the veteran reporter’s confidential sources.
Some 1,600 miles south of Las Vegas, CPJ’s Mexico Representative Jan-Albert Hootsen participated in an event in Morelia in central Mexico, where civil society groups dedicated a new mural to disappeared journalists. Organized by Mexico civil society group Propuesta Cívica, which provides pro bono legal assistance to journalists and human rights defenders, the event included a panel discussion with Hootsen and other press freedom defenders who raised concerns about the impunity crisis in Mexico. Murals are a long and powerful tradition in Mexico and have often been employed effectively in campaigns to bring information to or spread awareness amongst communities there. For Hootsen, it was also an opportunity to reconnect with the families of the journalists depicted in the mural as CPJ continues to fight for justice in their cases.
As CPJ works to end impunity in places like Mexico, it also continues to call for accountability in murders of journalists elsewhere. CPJ’s EU Representative and Advocacy Manager Tom Gibson was in Malta for the fifth anniversary of the murder of Maltese investigative journalist, Daphne Caruana Galizia, who was killed by a car bomb on October 14, 2017. Gibson and other civil society partners attended the hearing against the two brothers–Alfred and George Degiorgio–who each received 40-year jail sentences after pleading guilty to the bombing. CPJ welcomes this long overdue accountability, but is still awaiting legal proceedings against the alleged mastermind of the murder, Yorgen Fenech, and two men who allegedly supplied the bomb. CPJ has worked with the Caruana Galizia family for five years, campaigning for a public inquiry into her death and pushing the EU and the Council of Europe to scrutinize the steps taken by the authorities. CPJ will continue to its campaign to find justice for Caruana Galizia.
CPJ also continued to do on-the-ground research in countries where press freedom is threatened. CPJ’s Europe representative Attila Mong conducted a fact-finding mission in Greece, speaking with journalists and editors about the country’s changing press freedom climate and the forces having a chilling effect on journalists: two recent and unsolved journalist killings, increasing use of surveillance and the sensitivity of Greek Prime Minister Kyriakos Mitsotakis and his administration to critical reporting.
Wherever there are journalists, CPJ is standing with them–whether we’re assessing the situation on the ground, demanding justice from the courtroom, or offering crucial safety advice to as many journalists as we can.
CPJ interviewed a long-time press freedom advocate and journalist, José Zamora, the son of Guatemalan journalist and founder of elPeriódico, José Rubén Zamora. Zamora’s father–who won CPJ’s International Press Freedom Award in 1995–was arrested in late July and remains in pre-trial detention in Mariscal Zaval prison in Guatemala City. “My dad is an example,” Zamora told CPJ, “but the broader message is for everyone, and that is that they are going to persecute any critical voice.“
CPJ’s North America Program Coordinator Katherine Jacobsen wrote a briefing on the legal battle over slain Las Vegas Review-Journal reporter Jeff German’s devices, why they need to be protected, and why it’s concerning that they are still in police custody. “German’s colleagues and press freedom groups, including CPJ, want to protect the slain reporter’s confidential sources, cultivated over a decades-long career covering local politics and organized crime.“
Aleksei Obukhov, co-founder and senior editor of SOTA, spoke with CPJ via messaging app about what it’s like to be one of the few independent media outlets still reporting from inside Russia, the links between journalism and activism, and what he expects Russian journalism to look like in the future. “We stopped putting bylines on stories written by journalists in Russia,” Obukhov tells CPJ, “as a way to minimize their risks. We refused to self-censor.“
CPJ in the news
“‘This Time Is Different Because Iranian Women Are Willing to Sacrifice Everything,’” Harpers Bazaar
“Philippines becomes global case study of media repression,” Rappler
“Hong Kong media mogul Jimmy Lai convicted of fraud,” Axios
“CNN reporter explains why journalists are being arrested for covering protest,” CNN
“India Bars Kashmiri Photographer From Traveling to Receive Pulitzer,” The New York Times
“Spyware Poses Dire Threat to Journalists, Media Watchdog Says,” VOA
“Murder of Jeff German brings historic challenge to reporter shield laws,” Las Vegas Review-Journal
“Japanese filmmaker sentenced to 7 years in jail by Myanmar junta,” Yahoo! News
“Philippines: Killing of journalist sparks protests,” DW
“Us Hits Iran With More Sanctions Over Mahsa Amini Death,” The Associated Press