In light of dozens of incidents in which journalists and those close to them have been targeted with spyware, the Committee to Protect Journalists (CPJ) hasy launched a campaign calling on governments to stop the use of spyware and to take steps to prevent states with bad press freedom records from getting such tools.

CPJ mapped dozens of incidents in which journalists and those close to them were targeted with spyware since 2011. The project draws on published research and CPJ interviews to demonstrate the global press freedom implications of surveillance using advanced tools sold to governments for law enforcement and intelligence gathering.

“A secretive spyware industry has enabled the powerful to spy on journalists and their loved ones and we urgently need transparency and accountability,” said Robert Mahoney, CPJ’s deputy executive director.

“That’s why we’re calling on governments to ban spyware attacks on the press and sanction those who continue to authorise, conduct or facilitate them – including companies and third parties supplying technology and expertise behind closed doors.”

Many countries suspected of spying are notorious for repressing the media and CPJ research shows that some of the journalists targeted, or those connected with them, have also faced arrest and physical violence in reprisal for their work.

In 2015, Electronic Frontier Foundation (EFF) published a long list of countries that have invested in the spyware technology.

Predictably, most of the countries have a history of violations of press freedom.

EFF observed in its report, “This list of clients includes a number of regimes known for violating the human rights of their citizens: Azerbaijan, Bahrain, Egypt, Ethiopia, Russia, Saudi Arabia, and Vietnam. Most egregiously, Hacking Team provided spyware to Sudan, a violation of a UN embargo on the sale of arms to the country, and appears to have misled a UN representative as to whether it had business relations with the country. Sudan was also designated a state sponsor of terrorism throughout the 2012-2014 period, which raises the question of whether Hacking Team (which has US operations) violated the US ban on material support for terrorism.

Team Hacking has also reportedly sold the technology to Kenya, Uganda, Zimbabwe, South Sudan, Congo (Brazzaville), the Democratic Republic of Congo, Nigeria, Eritrea, Tanzania and Cameroon, among others.

Spyware can expose communications with sources, track a journalist’s movements, or steal private information, putting targets at risk of physical attack and other forms of censorship.

CPJ’s interactive map lists 38 journalists, commentators and their close associates targeted with spyware – often successfully – as well as the states suspected in each case and the companies that allegedly supplied them.

Researchers have attributed the attacks to actors in the UAE, Saudi Arabia, Morocco, Ethiopia, Mexico, and India.

The spyware targets were located in nine countries including the United States, Canada, the United Kingdom and France.

Four companies accused of supplying the spyware are based in Israel, Italy, and Germany.

Some of the targets have been jailed for their work, including Omar Radi and Maati Monjib in Morocco, according to CPJ research.

Non-journalist targets include Griselda Triana, widow of murdered Mexican journalist Javier Valdez; and Omar Abdulaziz, confidante of slain Saudi Arabian columnist Jamal Khashoggi of The Washington Post.

CPJ’s recommendations to governments and companies on how to stop the misuse of spyware are available in a detailed policy brief. CPJ also has digital safety advice for journalists on how to keep their information safe, as well as specific guidance on NSO Group’s Pegasus spyware.  

Full report of CPJ research will be unveiled on Wednesday March 18. The finding will shed light on the impact of spyware on press freedom and journalist safety at an online event.

The discussion titled, “An Invisible Threat: Press freedom and the dangers of spyware,” will feature CJP experts, Saudi blogger Omar Abdulaziz, Al-Jazeera journalist Ghada Oueiss and Bryan Fogel, who is the director of “The Dissident.”

• A Tell/CPJ report