Szabolcs Panyi: I was hacked with Pegasus software

2021-07-19

Interviews More from the Region

Orban put me at the same level as a dangerous criminal – says Panyi, a surveilled Hungarian journalist and a member of the international team revealing Pegasus Project.

Szabolcs Panyi is one of five Hungarian journalists who have been spied on by the Israeli spyware Pegasus. The spying was triggered by his work on the International Investment Bank – the story was also part of a cross-border series published by VSquare in July 2019.

Warnings that he might be followed came from several sources. As he himself admits, he was sure that he was careful and used encrypted communication. However, Israeli spyware Pegasus, designed to track terrorists, can also break encryption. Hungarian journalist from the independent outlet Direkt36 describes what it is like to be the target of the Hungarian government and whether Viktor Orbán knew about the warrant itself.

The media around the world published several stories about how the governments tapped mobile phones. It affected fifty countries. You were one of the victims. Why you?

First of all, I would like to stress that there were more than hundred eighty journalists, who were identified as victims of surveillance and wiretapping. I am a really lucky one because my surveillance was not followed up by imprisonment or physical harassment. So I am really grateful. I read the stories of what happened to other journalists being surveilled with different methods or finished in jail.

From time to time, I received friendly warnings years ago that I may be under surveillance because I am covering sensitive topics and I am writing articles that are not favorable to the government. It seems that somebody in Hungary targeted me with surveillance.

It is very clear: that has happened because of my journalistic work and there is proof that my colleague from Direkt36 András Szabó was also targeted with the same spyware around the same time as me. It means that our outlet and the investigations which we are carrying out called the attention of someone. 

You mention you got some friendly warnings from your sources. Do you know when the surveillance was happening?

There were different kinds of warnings. In late 2015 my closest friend and colleague and very good journalist was blackmailed by Hungarian intelligence, presumably for a long time. They tried to get some dirt on him and later used it for blackmailing. They wanted him to cooperate with them. They wanted him to reveal his sources. He refused to cooperate, he held the pressure. This was the end of 2015 and the beginning of 2016. And I believe since I was a close friend of his I was on the scope of this surveillance. 

In the following years, there were other instances. For example, I was supposed to meet a government source. The source messaged me through the intermediary that we are not gonna meet because I am under surveillance and he doesn’t want to be compromised by that meeting. And there were other instances when I received a friendly warning that I should be careful with my phone. There was an occasion when my sources told me that even encrypted applications such as Signal could be hacked by the Hungarian government. And now I know what these messages meant because it was around the time I was actually hacked with Pegasus software. But of course, back then, this was ludicrous. I didn’t know if it’s true or just my sources are paranoid.

As you explained the sources gave you friendly warnings, but at the same time you believed that the Signal is encrypted and somehow you are protected.

Yes, you know, I am really not a tech guy. (smile) I truly admire people who understand technology. What everyone told me is that the only way to compromise any kind of encrypted correspondence is if the end device is compromised. I was pretty sure that I keep my phone with me all the time and I don’t click on suspicious links. Well, now I know that I could have done very little in that time.

Have you ever noticed any physical surveillance or did you have a feeling that you could be surveilled in that time?

There was a case at the beginning of 2017 when I was working on a very sensitive topic. It was related to espionage, murder, and the responsibilities of Hungarian authorities. I remember that I was coming back to Budapest from a meeting with a source outside of the city by train. I was sitting alone and there was a guy in his late 30thies or 40thies in a leather jacket, with short hair, standing in a cabin door. He didn’t look at me directly, but he was looking at me through a reflection of the window. I was seeing his back, he was standing alone, basically preventing me from going out of the door. There was no suitcase next to him, he got on the train when I got it, he left the train a few minutes before I did. That was a very clear signal that my meeting was compromised and eventually, it prevented me from using the information that I got from the source because I didn’t want to get my source into trouble. In the Hungarian language, we call it demonstrative surveillance. It’s a type of surveillance when they want you to know that you are being followed and they even give you a sign – you should be careful about the information you have.   

Have you ever had security training or did you just notice that it could be surveillance?

I never had formal, proper training. But since I was reporting on national security issues for a long time, a couple of my sources had this kind of training and they shared knowledge with me. At this particular meeting, I was not alone. I had a company there and it was my companion who first spotted that we were under physical surveillance. Nowadays, I am still not an expert, but I guess the most suspicious things I can spot.

Szabolcs Panyi and András Szabo. Source: András Pethő/Direkt36

With your knowledge nowadays, can you link the surveillance with exact stories?

Yes and unfortunately I had bad news for VSquare. It was basically the story about the International Investment Bank that we were all working on that brought the attention of someone in Hungary. According to an analysis of my phone by Amnesty International Secure Lab, my surveillance started a day after I had sent a request to comment to ministries. A few days after my phone was hacked for the first time, I was meeting an American journalist, who was also writing about the IIB story and it turned out that his Hungarian fixer was also selected as a target for Pegasus spyware. So this was the start of surveillance we could detect.

So I was exactly surveilled from April 4th until November 7th, 2019, or at least at that time we found traces of Pegasus spyware on my phone. During that time I was working on multiple other stories. So this is just my guess: someone requested a warrant to surveil me that I am working on a national security topic, which was the IIB story. These permits are issued for a certain period of time, usually 3 months, and then they can be extended for another 3 months in Hungary. So maybe those guys said since we have this permit, why don’t we just keep surveilling him and find out what other sensitive issues he is working on?

What about your colleague András? What was he working on?

He was also working on the IIB story with me during that period of time. He was surveilled a little bit later. We can’t really understand the exact reason in his case. Unfortunately, I was selected to be the one who told him about the surveillance. András’ reaction was very cute: “Why me? I don’t understand. Why me?” 

So do you think Russia could be involved?

No, I don’t think so. We don’t have information that the Russian state is using this tool. The funniest thing is that I was writing something very sensitive to Russia, but it seems that it was not them. All circumstantial evidence points to Hungarian authorities being after me.

Why are you so disturbing to Orban?

We don’t know if it was him or if he knows what the security operative does. So we cannot definitely link this to him. We have a strong suspicion that the procurement of the Pegasus tool is linked to Benjamin Netanyahu’s visit in 2017. We have more evidence suggesting that half a year after the meeting, Viktor Orban national security and policy advisor József Czukor traveled to Israel and met with Netanyahu in February 2018. Czukor used to be an intelligence officer himself. We have reason to believe that someone in Hungary started using Pegasus software. So we saw a meeting between Netanyahu and Orbán and then he met Orbán’s closest co-workers, so I guess this is the link we can make. 

We have more than 300 Hungarian numbers in a database and we only identify 5 journalists, including me. In most of the cases, all of us were working on sensitive stories and all of these stories were important to the government, national security, the reputation of the country, corruption, or even terrorism. Personally, I don’t think that Viktor Orbán had anything to do with my surveillance. We have very little chance to be sure which security agency was responsible because the warrants are classified. But this is a badge of honour that someone thought that the stories I am working on are good enough to put surveillance on me.

You said that Orbán didn’t need to approve it but then you are working in a state which is surveilling you. What does it mean to be a Hungarian journalist?

When we analyzed these numbers we were surprised to some extent. We were surprised because we found only 5 journalists. But it totally makes sense, because there are not many of us left. (smile) The other thing I wanted to stress is that I am very grateful I was just surveilled, not jailed or tortured like other journalists. Some of them gave their lives in other countries. I am really lucky to be a Hungarian. Hungary is still an EU country meaning that the international and EU law applies to the country and it prevents the authorities from using force against the journalists. As long as Hungary is in the EU, we are relatively safe.

Do you think this case can negatively affect your sources?

Obviously. Who the hell wants to talk to me after this, right? (laughing) When I was meeting my sources I tried to do my best to protect my sources. I promised them to. I feel ashamed to not be able to possibly protect some of them. But I still don’t know what was accessed from my phone. I don’t know if they turned on my camera, or they accessed the videos of photos or checked passwords of my emails, or other encrypted communication. My very strong suspicion is that the biggest strength of this tool is that it cracks encrypted communication. So I do believe they were mostly interested in what I was sending through these applications. And this is the exact way we communicate within the newsroom. So they could access the company communication and the drafts I was working on. They could have an overview about our work and how the stories are developing. So it was not just me affected, but also my colleagues through our Signal messages and messages of my colleague András.

Do you want to continue as a journalist? 

Well, I really need a summer break now (laughing). Not because the news was so shocking to me, but because the whole project was lots of work. Over eighty journalists were working on it and the last few days were a huge rush. As I said before, it’s a great acknowledgment of my work, but I never wanted this kind of “fame”. I need to go through it. We have to move on and find those people who are responsible. Another important thing is that nothing will stay in secret. Even the most expensive spyware. It is not something you can hide from people. There are leaks and there will be leaks. People have to speak up and everyone who has evidence of any abuse of surveillance should leak this information to journalists. This is the only way the information comes to the surface. So, yes. I want to continue but I need to be much more cautious. That’s the lesson I learned. 

Sometimes it’s hard being cautious if on the other side is the state…

The state is not my enemy. I am suspicious about any state, especially Hungarian, but in a sense, the states are those in power and I just try to report on abuse of power. It seems that they put me at the same level as a dangerous criminal because Pegasus spyware was meant to surveil terrorists and organized crime. So I was considered an enemy of the Hungarian state.

What kind of reaction do you expect? 

Now it seems that the Hungarian government is trying to deny everything and trying to imply that we are working for intelligence agencies. But for many years I was accused of being a CIA agent and now the truth is the Hungarian government used Israeli surveillance tools on me. So who is the foreign agent now? 

What about ordinary people? 

I really hope that the reaction from ordinary people won’t be like „you shouldn’t talk to the journalists, because they are all surveilled.“ I believe that the main takeaway is that it could happen to anyone. You don’t need to be a journalist, you could just be friends with a journalist or a lawyer whose number is on the journalist’s phone. This is very random. This is most shocking. It seems that they develop the tool which is very expensive, but on the other hand, they sometimes use it as children in the playground. They don´t know how to use it and it was not meant to be used against ordinary guys. One attack costs ten thousand dollars. I do write sensitive stories, but I don’t think that I should spend such an amount of public money on me. It’s unbelievable.

Can this situation affect other Visegrad countries? Czech Prime Minister Andrej Babiš, in his new book, admires Orbán: “European politics today is characterised above all by merging into the mainstream, political correctness, zigzagging and various forms of submission. Manifestations of courage are as rare as a white crow. Hungary and the V4 are very fortunate to have a brave man, the leader of Hungary. Viktor, thank you.” Is Orbán really a brave man?

I don’t know (laughing). I am not a political reporter anymore. What is bravery? Letting your security apparatus use surveillance tools on journalists? I don’t want to comment on Viktor Orban. As I said we don´t know if he chose any of those targets, I doubt so. But regarding your question, we are seeing cases in Poland, where Kaczynski and his party is increasingly following the Orban playbook and importing methods to take over the media, the same as were introduced in Hungary. So these strong men in the Visegrad region are learning from each other. And according to the quote, it seems that Andrej Babiš is also learning from his allies. But I believe that the Czech Republic is much better than Hungary so I really hope that after this scandal there is nobody in the Czech Republic who would dare to use this kind of tool against journalists.

Interview by Eva Kubániová, Investigace

Read in Czech on investigace.cz