Rwanda is on spot for allegedly using Pegasus software to spy on critics and high ranking political and military figures in neighbouring countries.
The revelation is contained in an investigation conducted by Organization crime and corruption reporting project (OCCRP), a consortium of investigative centers, media and journalists operating in Eastern Europe, the Caucasus, Central Asia and Central America.
Pegasus software- made by Israeli firm NSO Group when implanted on a device, it effectively gives an attacker complete access to the target’s phone. It can read messages and passwords, access social media, use GPS to locate the target, listen to the target’s conversations, and even record them. End-to-end encryption, available through popular apps like Signal, does not protect against Pegasus once the phone is compromised.
According to OCCRP, several numbers for high-profile figures in Uganda, Burundi, and the Democratic Republic of Congo (DRC) feature in the data.
As part of the investigation, reporters obtained a list of over 50,000 numbers throughout the world believed to have been selected by NSO Group clients for targeting with Pegasus. Reporters were able to identify dozens of numbers belonging to Rwandans or other people of likely interest to Rwanda’s government from neighboring countries. They included activists, journalists, dissidents, and government officials.
Reporters were unable to conduct forensic analyses to verify infection on these phones, but the extent and nature of the Rwandan numbers in the data strongly suggests that the Rwandan government was a client of NSO Group.
Rwanda has had frosty relations with these neighbors over the years. It has allegedly sponsored armed groups in the east of DRC, criticized Uganda for harboring anti-RPF militias, and been accused by Burundi of plotting to overthrow its president.
The report says telephone numbers for Dr Ruhakana Rugunda, the former prime minister of Uganda until last month, and Alain-Guillaume Bunyoni, the prime minister of Burundi, appear on the list. Bunyoni was added before he was appointed prime minister, when he was Burundi’s interior minister.
Among the other Ugandans on the list, OCCRP has identified numbers belonging former Foreign Affairs Minister Sam Kutesa, former Defense Forces Chief General David Muhoozi, senior intelligence officer Joseph Ocwet, Fred Nyanzi Ssentamu, a brother to leading opposition figure Robert Kyagulanyi Ssentamu alias Bobi Wine.
In DRC, OCCRP identified numbers in the data for Lambert Mende and Albert Yuma, both powerful allies of longtime former President Joseph Kabila, who stepped down in January 2019. Reporters also found a number belonging to Jean Bamanisa Saïdi, a prominent provincial governor in DRC’s gold-rich east. These numbers were selected around the time of a political crisis in DRC over whether Kabila would respect constitutional term limits.
“There is already enormous, well-founded suspicion between the governments in the Great Lakes region and Rwanda,” said journalist Michela Wrong. “[Evidence of spying] will certainly encourage the view that Rwanda is not a partner playing by the rules.”
Spokespeople for the DRC and Burundi declined to comment.
A Ugandan government spokesperson, Ofwono Opondo, said that it is “up to Uganda to strengthen its cyber security protocols, otherwise the world is full of spying and espionage even among allies.”
In a series of responses, NSO Group said Pegasus is sold only to governments to go after criminals and terrorists, and has saved many lives. It denied that its spyware was systematically misused and challenged the validity of data obtained by reporters.
Three Western government officials told OCCRP, on the basis of anonymity, that they were aware that Rwanda had access to advanced Israeli spyware technology, and that there was concern at how it was being deployed.
Dr. Vincent Biruta, Rwanda’s Minister of Foreign Affairs and International Cooperation, said Rwanda does not use or have access to Pegasus.
Do you have a story in your community or an opinion to share with us: Email us at firstname.lastname@example.org