Viktor Orbán using NSO spyware in assault on media, data suggests
By Shaun Walker* – The
Hungary’s far-right government suspected of
hacking phones of investigative journalists and targeting owners. Since Viktor
Orbán became prime minister in 2010, Hungary has fallen from 23rd to 92nd in
the World Press Freedom Index.
Orbán’s government has deployed a new weapon in its war on the media in
Hungary, according to forensic analysis of several mobile devices, using some
of the world’s most invasive spyware against investigative journalists and the
circle of one of the country’s last remaining independent media owners.
The Pegasus project, a collaborative investigation run by
the French nonprofit journalism organisation Forbidden Stories, has reviewed
leaked records that suggest a wide range of people in Hungary were selected
as potential targets before a possible hacking attempt with the sophisticated
Pegasus spyware, sold by the Israeli company NSO Group. In a number of cases,
forensic analysis confirmed devices had been infected with Pegasus.
The leaked data includes the phone numbers of people who
appear to be targets of legitimate national security or criminal
However, the records also include the numbers of at least 10
lawyers, an opposition politician and at least five journalists.
The phones of two journalists at the Hungarian Pegasus
project partner, the investigative outlet Direkt36, were successfully infected
with the spyware, including Szabolcs Panyi, a well-known reporter with a wide
range of sources in diplomatic and national security circles.
Forensic analysis of his device by Amnesty International
stated conclusively it had been repeatedly compromised by Pegasus during a
seven-month period in 2019, with the infection often coming soon after comment
requests made by Panyi to Hungarian government officials.
enables the attacker to view all content on a phone, including messages from
apps with end-to-end encryption, photographs and GPS location data. It
can also turn the device into an audio or video recorder. NSO has claimed the
spyware is only meant for use against serious criminals and terrorists.
thinks some in the Orbán government believe independent journalists are part of
a conspiracy against them. “I think there’s widespread paranoia and they
see much more in our motives and our networks than there actually is,” he said.
“We are not aware of any alleged data collection claimed by
the request,” said a Hungarian government spokesperson in response to detailed
questions about the targeting of Panyi and others.
Group said it “does not have access to the data of its customers’
targets”, cast doubt on the significance of the leaked data and said it would
“continue to investigate all credible claims of misuse and take appropriate
Previously, Orbán’s spokesperson Zoltán Kovács has publicly
attacked Panyi, accusing him of “Orbánophobia and Hungarophobia” and
describing him as “deep into political activism”.
Since Orbán became prime minister in 2010, Hungary has
fallen from 23rd to 92nd in the World Press Freedom Index. Earlier this month,
Reporters Without Borders put Orbán on its Enemies of Press Freedom list, the
first time an EU leader has featured.
There have been almost no cases of physical violence against
journalists in Hungary; instead, Orbán’s war of attrition against the media has
used different means. These have included harassment of independent
journalists, pressure on media owners, withdrawing state advertising funds from
critical titles and aggressive takeovers by government-friendly figures.
Orbán’s covert war
against the media
When his forensics report came through, Panyi sat down in
Direkt36’s Budapest newsroom, a modest suite of offices inside a grand building
one block from the Danube, and sketched out a chart in blue pen.
On the left-hand side: dates on which he sent official
requests for comment to the Hungarian government. On the right: dates on which
forensic analysis shows his phone was compromised by Pegasus.
The correlation was hard to ignore. On 3 April 2019, for
example, Panyi sent a request for comment to several government departments in
relation to a story he was working on about a Russian bank that was relocating
to Budapest despite concerns it could be a front for Russian intelligence. One
day later, Panyi’s phone was infected with Pegasus.
There were 11 occasions when a Pegasus infection was
confirmed within a few days of a comment request from Panyi to the government,
according to Amnesty’s analysis.
More than half the comment requests he sent to various
government offices during a seven-month period were followed up with an attack.
The tactic, he assumes, was for the government to get ahead of the story, work
out what he was planning to publish and attempt to identify his sources.
Analysis carried out on the phone of one of Panyi’s
colleagues at Direkt36, András Szabó, also returned positive results. Direkt36
is one of just a few remaining Hungarian outlets not under some kind of
governmental control or influence.
Other Hungarians selected for potential targeting include a
photographer who worked as a fixer for a visiting foreign journalist, and a
well-known investigative journalist, who declined to have forensic analysis
done or to be named, citing a fear of losing sources.
Another Hungarian journalist selected as a candidate for
possible surveillance was Dávid Dercsényi, who edits a newspaper put out by the
authority of Budapest’s opposition-run eighth district and previously worked
for five years for the website of the independent outlet HVG.
Three numbers linked to Dercsényi, including one belonging
to his ex-wife that had been registered in his name, were found in the data.
He expressed puzzlement his name was in the data.
“Mostly I was working on average, not-very-sensitive topics,” he said. He
suspects a request for comment sent to the government over a story about the
trial of a former Islamic State operative could have drawn attention. He was no
longer in possession of any of the three phones appearing in the data, so
analysis was not possible.
of the major online news site Index last year, under pressure from a
government-linked businessman, left 24.hu, owned by the wealthy investor Zoltán
Varga, as the biggest independent news site in the country.
Varga has long been in Orbán’s crosshairs. In an interview
on the terrace of his grand villa in the Buda Hills, he described receiving
both enticements and threats from government-linked businesspeople to sell
24.hu and the rest of his sizeable media portfolio, which includes the
country’s bestselling women’s magazine. On one occasion, he claims, he was told
he would receive generous state advertising subsidies if he made editorial
“They think everything is about money. But I already have
money … Slowly I turned into an enemy,” he said.
He began to notice men in parked cars outside his home
and unwanted eavesdroppers on his business meetings in restaurants. He said
sometimes in the middle of a phone call, he would hear a recording of the call
played back, from the beginning. On one occasion, a black helicopter
hovered above his house and made three incursions into his garden – an
intimidation tactic, he believes. Varga has round-the-clock security at his
home and has long been wary of speaking on the phone.
He was right to be worried. A few weeks after Orbán won a
third consecutive term as prime minister in
spring 2018, Varga invited six friends to dinner. Among them was Attila
Chikán, a minister in Orbán’s first government in the late 1990s, who has since
become a staunch critic of the prime minister. The others were wealthy and
Over wine and finger food on Varga’s expansive terrace, the
men discussed creating a new foundation that among other things would
investigate and expose corruption among Hungary’s ruling elite. “It was a
friendly conversation, it wasn’t a coup,” said Varga.
Two weeks later he met a government-linked acquaintance for
coffee and she demonstratively referenced the dinner, suggesting such meetings
could be “dangerous” for him. Varga suspected Orbán’s circle had somehow put
the meeting under surveillance.
Indeed, the records show all seven people at the dinner were
selected as potential candidates for surveillance. Forensic analysis carried
out on the handset of one of those present showed clear evidence of a confirmed
infection at the time of the dinner. The phone of another participant showed
signs of Pegasus activity but not of compromise.
One of those present expressed surprise the meeting had
attracted such attention. “It was a typical Hungarian discussion. We sat down,
everybody said: ‘Fuck, the situation is really bad,’ but then it did not lead
anywhere,” he said.
Along with Varga’s circle, the son and lawyer of the
oligarch Lajos Simicska, Orbán’s childhood
friend turned enemy, also appear to have been candidates for surveillance
around the time that Simicska was pressured into selling his critical media
holdings to government-friendly figures in 2018.
Ajtony Csaba Nagy, Simicska’s lawyer, recalled noticing
strange sounds or replayed conversations during phone calls in 2018. “It also
happened that some information appeared in the press that we only discussed on
the phone, nowhere else,” he told Direkt36.
Hungary, Israel and
A former NSO employee confirmed Hungary was among the
company’s clients. It apparently acquired Pegasus in the aftermath of a 2017
visit to the country by the then Israeli prime minister, Benjamin Netanyahu, a
close Orbán ally. NSO has denied it takes any direction from the Israeli
government when choosing its customers.
In response to detailed allegations about Hungary’s
acquisition and use of Pegasus, a Hungarian government spokesperson said:
“Hungary is a democratic state governed by the rule of law, and as such, when
it comes to any individual it has always acted and continues to act in
accordance with the law in force. In Hungary, state bodies authorised to use covert
instruments are regularly monitored by governmental and non-governmental
Hungary has one of the loosest legislative frameworks in
Europe for the authorisation of surveillance. There is no judicial oversight if
the request is made for national security reasons; only the signature of the
minister of justice is required.
Information released to the Hungarian outlet 168 Óra under a
freedom of information request showed the justice minister, Judit Varga,
approved 1,285 surveillance requests in 2020, which includes all forms of
surveillance, not just Pegasus.
In an earlier interview with a Pegasus project partner,
Varga said it was a “provocation” to ask whether she would authorise
surveillance of a journalist, but said “there are so many dangers to the state
everywhere” when asked why she had approved so many requests. The justice
ministry did not respond to detailed allegations about Hungary’s use of
The government communications office, when presented with
the same allegations, replied with questions of its own: “Have you asked the
same questions of the governments of the United States of America, the United
Kingdom, Germany or France? In the case you have, how long did it take for them
to reply and how did they respond? Was there any intelligence service to help
you formulate the questions?”
Orbán has built his political platform on staunchly opposing
migration and claiming Hungary
is under attack from a network directed by the Hungarian-American financier and
philanthropist George Soros.
The leaked data reveals at least one case in which Pegasus
appears to have been used in the hope of uncovering – or inventing – a “Soros
One of the numbers in the data belonged to Adrien Beauduin,
a Belgian-Canadian PhD student.
Beauduin was arrested at a protest in Budapest in December
2018 and charged with assaulting police officers, which carries a sentence of
up to eight years in prison. He denies he was in any way violent towards
Beauduin’s lawyer, Kata Nehéz-Posony, said there was “no
real evidence” against him except for police testimony that was copied word for
word from the case of another person arrested.
She said she suspected the arrest was “highly politically
motivated”. On 14 December, a few days after the arrest, the then
communications chief of Orbán’s Fidesz party publicly noted that “the
pro-immigration Soros network is organising violent demonstrations in Budapest”.
Analysis of Beauduin’s phone showed Pegasus activity on the
device shortly after this, though no sign of successful infection. Eventually,
the most serious charges against him were dropped, suggesting nothing
incriminating was found.
A former senior Hungarian counter-intelligence officer who
left the service in the early part of the last decade admitted there was a
flexible approach to concocting national security reasons for surveillance
during his time. “[But] there were two professions we kept our distance from:
lawyers and journalists,” he said.
records, and the analysis of infected devices, suggest that in Orbán’s Hungary
today, this is no longer the case. In Budapest, 18 Jul 2021