Cartel Project stories were still rolling out three days later when Laurent and I made a previously arranged call to Dana, who was at her farm outside Washington, DC.
“Have you gotten any sleep yet?” was the first thing she wanted to know. “I was tired,” she said. “You must have been exhausted.”
Laurent didn’t spend much time on small talk or on another round of kudos on our recent mutual success. We were turning the page to a new project, and we wanted to get Dana and the Washington Post to sign on as one of the key partners.
“Basically, to explain briefly,” he told Dana, “we have access to a lot of information about a massive surveillance campaign all over the world, in many countries, targeting many, many people. A lot of people and including a lot of very big names: heads of state, Nobel Prize winners, many journalists . . . If you are interested, we really need to be able to meet physically to tell you more. We say that because it’s involving many intelligence units, and all of them would be very upset if they knew that one of us has access to that information. If we get hacked, it’s over.”
Dana was technically on a sabbatical at the time. But she generously agreed to talk to the head of investigations at the Post and then to set up an in-person meeting so we could make our pitch as soon as we could get to the States.
It was almost six weeks later, the day before the US presidential inauguration in January 2021, when Laurent and I finally arrived in Washington, DC, to make our case to Dana and the editor from the Post. We had by then grown even more anxious to lock in the renowned Washington newspaper. Die Zeit and Süddeutsche Zeitung and Le Monde had agreed to operate as reporting partners with Forbidden Stories on the cybersurveillance project. The Post would be the fourth and final member of the first circle of the investigation, the crucial US partner.
As we peered out the car window on the ride into town from the airport, it was hard to feel hopeful. The US capital city was a bleak and embattled landscape at that point, reeling from the four-year reign of Donald Trump, and braced for its last ugly spasms. The daily Covid-19 death toll in the country had passed three thousand and was still rising.
The reflecting pool had been ringed with four hundred lanterns, each representing a thousand US citizens already lost. The medical trauma was like the handmaiden of the political. The Trump-led effort to overturn the election had been punctuated, less than two weeks before our arrival, by a deadly riot at the seat of national government. News feeds were still filled with newfound footage of Confederate flag–wielding marauders storming the US Capitol, ransacking the Speaker’s office and both chambers of the legislature, chasing representatives and senators and their aides into safe rooms in the bowels of the building, beating police officers bloody, and looting camera equipment from journalists on scene to cover the story.
“Enemies of the people,” the American president had called reporters, making them (and us) just another in a long list of groups with targets on their backs.
The normally festive run-up to the presidential inauguration had all the charm of a prison-yard lockdown. The Capitol grounds were fenced by seven-foot-high chain link, said to be “unscalable.” Armored military vehicles sat at key entrances. The perimeter and streets nearby were patrolled by six thousand uniformed soldiers shouldering assault rifles.
Also read: Adani, Modi & Gujarat’s journey from ‘vibrant to flagrant, blatant, belligerent, and strident’
Laurent and I quickly aborted our one attempt to get some exercise with a run on the Mall. Then we ended up staying in our hotel to watch the inauguration on television, while the ceaseless shudder of helicopters rattled our windows. We were cheered only slightly by the performance of twenty-two-year-old poet Amanda Gorman.
I couldn’t take my eyes off her effulgent yellow overcoat and the way her hands and fingers cut powerfully through the air, measuring her cadences as she spoke.
For there is always light, if only we’re brave enough to see it.
If only we’re brave enough to be it.
The rest of the pallid pared-down ceremony felt like a sad reminder of what the world becomes when autocrats begin to use their chosen weapons to chip away at even the strongest of democracies.
When we met Dana at her home the day after the inauguration, she seemed a little perturbed by our request that she turn off her cell phone and laptop and put them in another room before we got started. In fact, I wasn’t sure she was sold on this new cybersurveillance project. But we were now able to access the data by remote hookup, so it was easy to show her the scope and scale of the data in the leaked list. The reservations she had about the potential of this story seemed to melt away as she scrolled down that massive list, and we highlighted some of the names we had already identified as targets selected for cybersurveillance.
Two days later Dana was driving us across the city for our sit-down with the head of the Washington Post’s investigative units, Jeff Leen.
Jeff was working remotely from his home about thirty miles from downtown Washington at the time, but he agreed to meet us at the National Arboretum, a midway point. Laurent and I were both a bit nervous because even though Jeff had been the editor in charge of the Cartel Project at the Post, we hadn’t actually been in the same room with him yet. Dana didn’t exactly calm our nerves as she piloted us to the arranged meeting spot. She put us through our paces, rehearsing our pitch. “This guy doesn’t have much time,” she explained, and he gets pitched ‘the next big scoop’ every day. So don’t waste time.”
There was a lot about the leak we wouldn’t be able to explain until the Post agreed to become a partner in the project. We were nervous about telling Jeff that the company at the center of the investigation was NSO, but we knew we couldn’t hold back that alluring piece of information. NSO was not only the most recognized spyware developer in the world, but there were suspicions that the company’s cybertool was somehow linked to the recent murder of a journalist who had contributed to the Post’s opinion pages. We agreed with Dana that the main selling point, and the big takeaway of the project if we pulled it off, would be the revelation of the vast scale of cybersurveillance now taking place around the world—thanks in large part to Pegasus.
A strict follower of the Covid-careful six-foot rule, Jeff wasn’t interested in taking the meeting in the warmth of Dana’s SUV, so the four of us got out of our cars and marched across the parking a lot, down a sloping grade, and through the entrance of the arboretum. Nobody else was in the park, as far as I could see. The sky was a crystalline blue, but it was very cold, and the wind was whipping, so I was glad I had worn a parka and a warm hat and an extra pair of socks. Jeff was a tall guy, swaddled in a thick coat and a bulky pair of insulated trousers. He was wearing what looked like some kind of trapper hat with the flaps hanging down, and a pair of the biggest gloves I have ever seen. The head of one of the most technologically advanced investigative teams in the United States was using a clipboard you might see in a middle-school gym class circa 1980 to take notes. It felt like we were in a scene from a very odd spy movie, where one of the protagonists happens to be the foreman of a lumberjack crew from Saskatchewan.
Laurent and I led with the sheer scale of international cybersurveillance suggested by the list, but we were upfront about what we knew and what we didn’t know about the leaked data we were ready to offer to the Post. There were some remarkable names on the list, but we had a lot of work to do to determine if the people were simply selected for spyware infection or actually targeted or successfully infected.
“Okay,” he said, “understood.”
Dana was right. He didn’t waste time. He only asked a couple of questions, like if there were any Americans in the data. The whole talk lasted less than twenty minutes. It occurred to me that on any other project we could have wrapped this up in a couple of transatlantic phone calls. But our promise to protect the source at all costs meant we had had to make our way from Paris to this freezing spot in a taxpayer-funded forest in Washington, DC, for what might end up being a failed story pitch.
Jeff never said, Wow! Or, This is fantastic! Or, I can’t wait to get going!
“What do you need from me?” was all he said.
We suggested we would need a lot of resources in the coming months, but for now maybe a staff reporter to work with Dana.
“Okay,” Jeff said. “Understood.”
We took that as a yes.
So by the last week of January 2021, things were lining up. Claudio and Donncha had done a successful test run on Jorge’s phone, I had coordinated my first major international reporting collaboration, our young team at Forbidden Stories had proven themselves solid, and Laurent and I had gathered a very experienced group of partners to execute the first phase of the Pegasus investigation.
As Claudio might put it: “This, um, could work.”
This excerpt from ‘Pegasus: The Story of the World’s Most Dangerous Spyware’ by Laurent Richard and Sandrine Rigaud has been published with permission from Macmillan Publishers.