>> Further validating our finding of targeting, our forensic analysis shows Kouloglou received multiple Apple threat notifications about targeting with mercenary spyware on three occasions: March 2, 2023, August 29, 2023, and April 10, 2024. It is important to note that threat notifications from Apple and other companies are not real-time alerts. They are typically sent to users in batches, often months or more after targeting takes place.
>> Kouloglou reports to us that he did not recall receiving the Apple notifications we observed.
Am I understanding this correctly that Apple sent him notifications that he was being monitored and he ignored them?
That is kind of surprising given he is on the comittee investigating pegasus. I'd assume someone on the comittee would be paying much more attention to this than a normal person.
I wonder what triggered him to suspect he was hacked then. Since presumably something triggered him to have his phone forensically investigated.
Have you seen notifications on iOS? There are even notifications for the notifications.
But this type of notification I believe is delivered via iMessage and email. So unless you’re actively using iMessage or your icloud email then chances are all this is practically invisible.
People seem to have this fiction that parliamentarians working on a committee actually have some expertise. This can happen but is actually rare. They are not elected for skill but for political reasons, and then the parties pawn them to different committees.
So in other words he probably speaks about security, whatever his staffers feed him, but most likely has no clue whatsoever what it's about.
Or that Apple could either run searches on the names of affected users against publicly known members of government or have close relationship with governments to flag exactly this.
If he knew he was compromised, and was okay with it for one reason or another (like money or other coercion), this is what his cleanup would look like.
Not saying this is likely. Just another possibility.
It's possible, if the attacker controls the device enough. I don't think a big "you're being targeted" warning is something you don't notice, or forget.
Do they send them via notification infrastructure or email? Personally I almost never check the email associated with my Apple ID so I would miss those. But if all my Apple devices were notifying me and I had a badge in Settings.app, I’d notice.
Then again, you’d think that’s the kinda thing malware developers would spend some time learning to hide from the user.
I wonder how they detect it, is it for known IOCs that they've already found elsewhere, or do they have heuristic detection that flags things that might need further investigation.
If a notification is dismissed on iphone, there's indeed no central UI to see it again on the phone. That's a sad state of iphone. Many people have asked, but Apple just doesn't care enough to do it. Now I hope this kind of high-profile security incidents could nudge Apple towards taking action.
Any source for that “Apple just doesn’t care”, as opposed to thinking there are security/privacy tradeoffs or other considerations that cut against such a feature?
If Apple can store the sms/iMessage, and email history, and health/journal history, and my Wallet payment history, in a safe manner I would think Apple can store notification history in a safe manner. How would notifications be meaningfully different from these?
I think the proof of Apple’s level of care is in their lack of attention to this issue.
With modern cryptography techniques, Apple could certainly do it if they cared enough. I guess the potential benefit doesn't justify the potential effort and cost related to the change, from Apple management point of view.
Kouloglou is a famous investigative journalist, not you and me. Yes you and I might think we're being scammed, but someone who actually spent a lot of their life getting death threats probably would pay more attention.
Fairly sure that if anybody using a advanced piece of hacking software, they are also going to delete any messages that are related to detection of such hardware.
PC viruses used to do that stuff going back so many years ago. Suppressing any notification under Windows, by disabling the AV software, its notifications, windows notifications related to it.
So it will amaze me that this is not done by any modern espionage software. Especially as the notification methods are known. Given that his device is hacked, that means a lot of avenues are under control of the espionage software. Even mails etc ... So impersonating the end user, to confirm they read a warning, is extreme easy.
I find it rather odd that people are so fixated on the idea if Kouloglou read it or not.
If i was going to write software on this level, that will be used by governments. There is no way, its going to be a nice little program that only extract information.
Its going to have every trick in the book (and outside it), to stay hidden. And it will have payloads to alter its behavior, updates, etc...
Nobody is going to pay you big fat money envelops for software that anybody can write in a afternoon. You want it to be as capable as ever, and you do not want it found!
That seems to be the case, although he claims to have somehow missed them. Overall this is one of those stories that's obviously an outrage, except for the fact that every country on Earth spies on the rest, and quite a few private entities do as well. Still the way the game is played if you get caught you have to act ashamed, and the people catching you get to gloat.
It's silly, but it's a show the public never tires of.
In this case he was investigating misuse of Pegasus spyware specifically, and was targeted with it while doing so. That's obstruction of justice, morally speaking, and would feel very scary, in that it would make you feel that this company might be so powerful that investigating it is personally dangerous.
The US does not spy on Five Eyes government leadership or that of Israel. And perhaps more: in the wake of Snowden, which obliterated many diplomatic relationships the U.S. has with other countries, Obama issued a directive that the U.S. would not monitor heads of state and government of close friends and allies (even outside Five Eyes) unless there was a compelling national security reason. As far as we know that directive has remained in force with each successive administration as well.
They spy on most others though. Germany’s Merkel, successive French presidents etc all had their phones hacked by US there is widely reported news of.
"In December 2010, leaked US diplomatic cables indicated senior New Zealand Defence Ministry officials had been spying for the United States, secretly briefing the United States embassy on Cabinet discussions about the Iraq War."
Nothing has changed post-Snowden, other than that the general public have gone back into a state of apathy on the subject of reigning in their out of control surveillance state.
Absolutely, and there's the same compelling reason for them to spy on the on the US in turn. I can't emphasize this enough, everyone is spying on everyone else. Close alliances give the impression that they don't because they tend to handle scandals in-house, it's for everyone's benefit to do so in most cases. Snowden's disclosure was a very unusual event and put everyone in a position of needing to act shocked, appalled, and put on a big show for the public; sweeping it under the rug was impossible. For all that many here would wish otherwise, Snowden wasn't a watershed though, it was a blip.
Sure. The NSA exists, and it routinely violates the rights of the USA's own citizens, the ones that actually have constitutional rights. The idea that it would suddenly draw the line on foreigners is just absurd.
You can probably share specific evidence of NSA violating U.S. citizen rights.
But can you share specific evidence if NSA spying on a five eyes nation or Israel post-Snowden?
Yes, the US has an intelligence agency called the NSA, which works with intelligence agencies in the five eyes. There is something called the five eyes agreement that does draw that line.
> In 1951, Mossad and the Central Intelligence Agency agreed not to spy on each other and US and Israeli services cooperated closely since then.
> Nevertheless, there were strong indications afterwards of ongoing Israeli espionage against the United States, confirmed by the 1985 arrest of Israeli spy Jonathan Pollard, one of the most damaging security leaks in US history.
> Israeli espionage reached a high-profile peak in the mid-1980s, shattering assumptions that allies "do not spy on each other".
The peril of sleeping easy at night, comfortable in the fantasy where no one would ever spy on me just because they pinky promised not to. Not keen on believing evil bits either.
1. I think burden of proof is on the opposite side. (Previous legislations/directives were circumvented without problem)
2.Asking for hard evidence of top spies secretly spying on heads of other states is … (not sure if there is a word for it; some blend between: unrealistic, unreasonable and oxymoron’ish. If they do their job well, you will not find it out, also it might be illegal or punishable to present such evidence)
> As far as we know that directive has remained in force with each successive administration as well.
People can state a lot, as long as your not caught.
Nothing prevent you from having the UK spy on the Germans, and feeding that intel back. Or Israel, or ... Hey, the US did not spy on a EU ally. Well, not directly and it neatly bypassed any official statements.
They might have simply gone to one of those secret court hearings and have it bypassed with a gag order in place. Officially its not done, unofficially, its been approved.
The whole "as long as you do not tell me your doing it" approach, and the politicians involve maintain deniability (even if they had the wink).
And you do not need to specific target the head off state. Plenty of side routes to still get information on meetings, that involve those heads of states. Even if your not "directly" spying on them.
So no, its a naïve way of thinking. Maybe in 20 years from now we find out, that they did spy on EU leaders. Maybe directly, maybe indirectly ... even with that directive in place. I will be amazed if they did not. Its the US we are talking about.
There is some directive (not law, not constitution - not that those are untouchable now) and we expect current us government to adhere to it, just because it would be nice?
It's entirely possible an EU country did this; they're only vaguely guessing Belarus or whoever. In most countries, it's a big deal if the spies are caught spying on the domestic government.
> quite a few private entities do as well.
It's a risky game, doing that. You don't get any of the professional courtesies, and you're not usually eligible for the prisoner exchanges.
>> Kouloglou reports to us that he did not recall receiving the Apple notifications we observed.
Am I understanding this correctly that Apple sent him notifications that he was being monitored and he ignored them?