A new report by the Organized Crime and Corruption Reporting Project (OCCRP) alleges Azerbaijan has been spying on hundreds of local activists and journalists, including RFE/RL reporters, using sophisticated software that gave the government access to their phones.
Azerbaijan appears to have acquired Pegasus -- spyware that can record phone calls and read text messages, access photographs and passwords, track GPS data, and secretly make audio and video recordings -- from Israeli cybersurveillance company NSO Group, OCCRP said in the report, released on July 18.
Subscribe To RFE/RL's Watchdog Report
RFE/RL's Watchdog report is a curated digest of human rights, media freedom, and democracy developments from our vast broadcast region. It arrives in your in-box every Thursday. Subscribe here.
The report on Azerbaijan came as part of sweeping research the OCCRP did on the NSO Group showing a leaked database of up to 50,000 phone numbers believed to have been identified as people of interest by clients of NSO since 2016.
Based on the geographical clustering of the numbers on the leaked list, reporters identified potential NSO Group clients from more than 10 countries, including Azerbaijan, Bahrain, Hungary, India, Indonesia, Kazakhstan, Mexico, Morocco, Rwanda, Saudi Arabia, Togo, and the United Arab Emirates.
The OCCRP project made its assessment on Azerbaijan based on the hundreds of phone numbers of local reporters, activists, and opposition members that appeared in the leaked database of phone numbers that are believed to have been targeted by the Pegasus software.
While there is “no definitive proof” that Baku is an NSO client or that the leaked numbers represent people selected for targeting, OCCRP said “a preponderance of evidence suggests that this is the case.”
President Ilham Aliyev has turned Azerbaijan into one of the most repressive former Soviet states, cracking down hard on free media and the opposition during his nearly 20-year rule.
Critics have accused his authoritarian government of using a growing array of sophisticated surveillance technology to track members of the opposition and media.
The OCCRP, a consortium of investigative centers, media, and journalists operating in Eastern Europe, the Caucasus, Central Asia, and Central America, said that forensic analysis confirmed that the phones of two Azerbaijani citizens on the list were infected with Pegasus software.
Furthermore, several other Azerbaijani citizens on the list, including prominent opposition members, had personal information from their phones leaked to the public.
In response to a question about whether Azerbaijan acquired its software, NSO Group told OCCRP it could not confirm or deny the identity of government customers “due to contractual and national-security considerations.”
However, it claimed that it does not allow its clients to abuse its software, which it said is only meant to surveil criminals and terrorists. The NSO Group also claimed that OCCRP’s conclusions were based on a “misleading interpretation” of the leaked data.
'Deliberate Campaign'
The OCCRP said that all but a few of the 245 Azerbaijani numbers identified belonged to journalists, activists, lawyers, and members of the country’s opposition.
Among them were five current and former reporters for RFE/RL, including Khadija Ismayilova, the broadcaster’s former Baku bureau chief and one of the nation’s most renowned investigative journalists.
Forensic analysis determined that Ismayilova's phone was ridden with traces of Pegasus software, OCCRP said.
Included in the broader leaked list of 50,000 phone numbers were those of journalists for media organizations around the world including Agence France-Presse, The Wall Street Journal, CNN, The New York Times, Al Jazeera, France 24, Mediapart, El Pais, the Associated Press, Le Monde, Bloomberg, The Economist, Reuters, and Voice of America, according to The Guardian newspaper.
Azerbaijan raided and closed RFE/RL’s Baku bureau in 2014 while its local website has been blocked inside the country since 2017.
RFE/RL has said the blockage of the site was "part of a deliberate campaign" aimed at silencing its reporting in the tightly controlled country.
In addition to journalists, OCCRP said it identified more than 40 Azerbaijani activists and their family members on the leaked list of supposed Pegasus targets.
The Azerbaijani activists first appeared on the list in 2019 when mass protests were held in Baku.
President Aliyev has ruled the oil-producing former Soviet republic with an iron fist since shortly before his father, Heydar Aliyev, died in 2003 after a decade in power.
He has repeatedly rejected criticism from rights groups and Western governments that accuse him of jailing his opponents on trumped-up accusations and abusing power to stifle dissent.