Pegasus-Ausschuss: EU-Kommission bestätigt Hacking-Spuren auf Geräten

Die EU-Kommission hat Anhaltspunkte für eine Infektion mit Spähsoftware auf Geräten ihrer Mitarbeiter:innen gefunden. Das geht aus einem Brief von Justiz-Kommissar Didier Reynders und Haushalts-Kommissar Johannes Hahn hervor. Zuerst hatte Reuters über das Schreiben an die Berichterstatterin des Pegasus-Untersuchungsausschusses Sophie in ’t Veld berichtet. Wir veröffentlichen den Brief im Volltext.

Im April berichtete Reuters, die Geräte von Reynders und anderen EU-Beamten seien gehackt worden. Apple habe den Betroffenen mitgeteilt, dass es Hinweise auf einen Angriff mit dem Staatstrojaner eines israelischen Herstellers gäbe. Daraufhin habe die EU-Kommission eine Untersuchung gestartet.

Aus dem Brief vom 25. Juli geht hervor: Reynders und andere Kommissionsmitarbeitende hatten die Benachrichtigung von Apple am 24. November 2021 erhalten. Einen Tag zuvor hatte das Unternehmen angekündigt, den israelischen Staatstrojaner-Hersteller NSO Group zu verklagen. Ebenso wollte Apple Betroffene informieren, deren Geräte über eine bestimmte Sicherheitslücke angegriffen wurde. Diese wurde von Pegasus und anderen Staatstrojanen ausgenutzt.

Indicators of compromise

Das Untersuchungsteam der EU-Kommission konnte in der bis heute laufenden Untersuchung keine endgültigen Beweise auf eine versuchte oder erfolgreiche Infektion mit Pegasus finden. Aber: „Mehrere Geräteüberprüfungen führten zur Entdeckung von technischen Spuren einer Kompromittierung.“ Das bedeutet, wahrscheinlich wurden Geräte erfolgreich gehackt. Es sei jedoch nicht möglich, anhand dieser Anzeichen mit „völliger Sicherheit“ auf einen bestimmten Versursacher zu schließen, heißt es in dem Brief.

Weitere Details wollen die Kommissare aber wegen des „öffentlichen Charakters des vorliegenden Schreibens“ nicht nennen, um keine Hinweise auf die Untersuchungsfähigkeiten der EU-Kommission zu offenbaren.

Damit bleibt vieles unbeantwortet: Bei wie vielen Beamten fand die Kommission Anzeichen einer versuchten oder erfolgreichen Kompromittierung? Sind Daten abgeflossen? Gibt es Vermutungen, von wem die Infiltrationsversuche ausgingen? Diese und weitere Fragen hatte die liberale Europaabgeordnete in ’t Veld ursprünglich gestellt.

Sie und die anderen EU-Abgeordneten im Pegasus-Untersuchungsausschuss haben sich vorgenommen, bis zum nächsten Frühjahr aufzuklären, wie EU-Mitgliedstaaten industrielle Staatstrojaner wie Pegasus eingesetzt haben und ob sie dabei gegen Gesetze verstoßen haben. Mittlerweile ist bekannt, dass 14 Mitgliedstaaten Kunden von NSO Group waren, mehr als die Hälfte der 27 EU-Länder.

Ob dabei Mitgliedstaaten selbst die EU-Kommission ins Visier genommen haben, ist für die Parlamentarier von besonderem Interesse. Wenn sich herausstellt, dass ein EU-Land dahinterstecke, sei das besonders skandalös, so in ’t Veld gegenüber Reuters.

Hier ist der Brief in Volltext:

• Date: 2022-07-25
• Institution: European Commission
• From: Johannes Hahn, European Commissioner for Budget and Administration
• From: Didier Reynders, European Commissioner for Justice
• To: Sophie in ’t Veld, Member of the European Parliament

Honourable Member, Dear Ms in ’t Veld,

We have received your letter of 16 June 2022 containing follow-up questions on the Pegasus software and the corresponding impact on the Commission.

We would like to provide the following elements in answer to your questions.

Possible cases inside the Commission

Following the Forbidden Stories and Amnesty International revelations, a dedicated Commission team of in-house experts launched on 19 July 2021 an internal investigation, as in any suspected case of spyware infection. The investigation’s aim was to verify whether Pegasus had targeted devices of Commission staff and members of the College. As part of the investigation, the devices of the College members and their closest collaborators were checked.

Apple sent an official notification about Commissioner Reynders device’s possible compromise by the Pegasus software on 24 November 2021. Neither the checks done by the investigators before nor after this date confirmed that Pegasus had succeeded in compromising the Commissioners‘ personal or professional devices. Moreover, the Commission’s competent services inspected devices of additional Commission staff, who received similar notifications from Apple on that day; none of the inspected devices confirmed Apple’s suspicions either.

The Commission’s investigation is still ongoing; several device checks led to the discovery of indicators of compromise. It is impossible to attribute these indicators to a specific perpetrator with full certainty. The present letter’s public character does not allow further elaboration on the investigation’s present-day findings, as they would reveal to adversaries the Commission’s investigation methods and capabilities, thus seriously jeopardizing the institution’s security.

To mitigate the threat emanating from Pegasus and similar spyware, the Commission cooperates continuously with CERT-EU, the Computer Emergency Response Team of the Union’s institutions, bodies, and agencies, and issues recommendations and guidance to CERT-EU’s constituents. DG DIGIT deployed an EDR solution (mobile endpoint detection and response) on all corporate phones in September 2021 to tackle similar threats. The Commission has also been in contact with Apple, as well as with the Belgian police and other partners.

Data protection

Following press reports, letters received from Members of the European Parliament and from the President of the Supreme Audit Office in Poland (NIK), the Commission services sent letters to Hungary and Poland to gather information on the national legislative framework and on its interplay with Union legislation on the protection of personal data, in particular GDPR and the Law enforcement Directive. These administrative letters were sent on 14 February. Poland replied on 29 March and Hungary replied on 11 May. Following press reports concerning the use of Pegasus in Spain and related announcements and letters from MEPs, a letter was sent to Spain on 24 May (pending reply).

These three letters requested clarifications regarding the extent to which the investigated use of Pegasus falls under EU data protection rules and how compliance with EU Law is ensured. Polish authorities replied that they consider that the use of Pegasus by the Anti-Corruption Agency (CBA) falls under national security and that this excludes the applicability of EU Law. The answer from Poland did not specify how national security is defined under the national law. Hungarian authorities also considered that the use of Pegasus in Hungary fell under national security and not under EU Law and referred to the provisions of their national legislation which define the scope of „national security“.

The Commission does not consider that the use of spyware is per se a matter of „national security“. EU data protection rules are applicable to the processing of personal data, including by public authorities for law enforcement and criminal justice purposes, as far as it does not fall within „national security“. A mere reference to national security is not sufficient to exclude the application of EU Law. The Court of Justice of the European Union has clarified the criteria that Member States need to follow, when defining matters falling under national security. Therefore, the issue is whether the use of such spyware is genuinely justified by national security, when this is claimed by some Member States.

Next steps and outreach

The Commission will continue to gather factual and legal information, assess the interplay between national legislation and EU data protection acquis and will assess the issue in light of all available information. In particular, the Commission will follow very closely the findings of the Pegasus inquiry committee.

Regarding contacts between the Commission and Member States and Israel on surveillance technologies, the Commission has raised the issue with the export control authorities of the Member States and with Israel, with a view to mitigating the risks associated with trade in these sensitive products.

The Commission has shared with the Israeli authorities its concerns about the application of controls on the export of these items and their possible misuse in violation of human rights and called on Israel to take appropriate action. The Commission further called on the authorities to consider mitigation measures to ensure that Israeli companies, such as NSO, effectively comply with export control regulations and prevent the misuse of their products in the EU and other countries.

In closing, we would like to reassure you that the Commission continues looking into the matter seriously: the investigation into possible infections will continue, with the aim to identify vulnerabilities and address them accordingly. In addition, the lessons learned from these infections will feed into the Commission’s operational expertise and its awareness-raising campaigns towards its staff, enhancing the institution’s resilience not only vis-a-vis Pegasus, but also towards future improved iterations of this or similar spyware.

Yours sincerely,

Johannes Hahn
Didier Reynders