Pegasus in Colombia: the keys to understanding Petro’s complaint

The revelation of the possible purchase of the Pegasus spy software by the Colombian State, which President Gustavo Petro made this Wednesday during prime The television broadcast has left more questions than answers. The president read a confidential document from Israeli financial intelligence indicating that in mid-2021 the Police Intelligence Directorate (Dipol) had paid $11 million in cash for the Israeli computer program, which has the most advanced cell phone spying technology in the world. Amnesty International, a human rights NGO that has tracked Pegasus, has warned that the information of at least 50,000 people in the world has been compromised through this device, including politicians, journalists, human rights defenders and activists.

These figures, which go up to 2021, do not include Colombia. According to the information provided by the president, the purchase took place in the middle of that year, in the midst of the national strike against the government of conservative Iván Duque. The possible deal was already on the media radar. In March of this year, the Israeli newspaper Haaretz He stated that Colombia had purchased the software at the end of 2021, with a payment of 13 million dollars in cash, data similar to those read by the president. At that time, media such as W Radio consulted official sources. All denied the purchase. Beyond the source cited by the president, the most novel information compared to previous revelations is the alleged role of Dipol, which was then headed by General Norberto Mujica Jaime.

The police department has faced accusations over its contracts to conduct interceptions. In 2013, it signed a contract worth more than $335,000 with the German company Hacking Team to use its spy technology. The purchase only became known in 2015, when the company was the victim of a cyber attack in which 400 GB of information was compromised, with data from all the countries that used its system, including Colombia.

However, the information on the role of Dipol is disputed. This newspaper learned that, at the beginning of the year and after the questions following the publication of Haaretzthe Police denied to the Ministry of Defense, through an official document, having purchased Pegasus. A source from that ministry assures that they have reviewed internal documentation and have found no trace of the transaction. If the purchase is in doubt, there is also doubt about who would have used the software and against whom. “I don’t know how many people, I don’t know the exact objectives,” the president admitted in his speech. The physical device that houses the intelligence software has not been found either, a huge question mark due to the risks to privacy that it entails.

Juan Diego Castañeda, co-director of the Karisma Foundation, dedicated to the defense of rights in the digital world, explains to EL PAÍS that Pegasus “gives total control of a device of the person being tapped. It does not work like a malware, In this case, you have to access a link to get infected, you only need to have the phone number to be able to see everything that happens on the device. You can access the camera and microphones at any time, listen to calls, see what is written (whether you delete it or don’t send it), know the geolocation in real time, know which networks you connect to, access all the applications. It is capable, ultimately, of replacing a person’s identity.” He refers to the fact that, with Pegasus, actions such as sending messages from a cell phone can be done. “They have the ability to put data in another person’s name; for example, locate photos, documents or messages on a cell phone without its owner realizing it,” he says. This makes it the most powerful interception and intelligence technology in the world.

So much so that, although it is a tool that serves to identify criminal networks, some States have used it to transgress all red lines. Thanks to a global journalistic revelation led by Forbidden Stories, in 2021 it was confirmed that countries such as Spain, Mexico, El Salvador, the Dominican Republic, the United Arab Emirates, Hungary, Morocco and Indonesia have used it. The Amnesty International Security Lab has specified that “there are now at least 18 countries in which it has been confirmed through forensic analysis that journalists are attacked through spyware”, and has pointed out that “it is likely that the real scale of this abuse of surveillance technology is much higher in the world”.

In Colombia, even without knowing against whom it was used, a serious possibility is on the table: that it was directed against magistrates of the high courts, a hypothesis that has as a mirror the scandal of the wiretapping directed from the Casa de Nariño against the judges of the Supreme Court of Justice at the end of the Government of Álvaro Uribe. In his speech, President Petro mentioned the magistrates. In June it was Jorge Enrique Ibáñez, a conservative judge of the Constitutional Court, who warned that he had information that he, his wife and some of his assistant magistrates were being illegally intervened by the Government. He filed a criminal complaint in this regard. A source from the Casa de Nariño has confirmed to this newspaper that on July 10, in a proceeding directed by a delegated prosecutor before the Supreme Court for that complaint, the possibility that Ibáñez was intervened by Pegasus was discussed.

On Thursday, the Attorney General’s Office confirmed the link between Petro’s revelations and the complaint. “The Attorney General’s Office incorporated the information publicly revealed by the head of state into the investigation of the facts brought to the attention of the Attorney General’s Office by a magistrate of the Constitutional Court,” it explained in a press release. So far, no other specific complaints are known about the use of Pegasus in Colombia.

Pegasus’ dark past in the world

The Colombian Intelligence and Counterintelligence Law establishes that state agencies must respect the right to privacy and the protection of personal information. Therefore, it requires that all interventions in telephone lines or technological devices must be covered by a prior court order, and that a judge can only give this approval within the framework of an investigation and with well-founded reasons. This means that only technologies that allow control of their use can be used. For Castañeda, from Karisma, Pegasus “would hardly pass the filters framed by the Colombian Constitution.” Although no law explicitly prohibits its use, “it is a technology that does not guarantee data privacy or the control that can be given to the tool.”

These weaknesses are reflected in investigations into the misuse of Pegasus in other countries. In Mexico, for example, at least 25 journalists have been intercepted through the device. One of the cases that has been made public is that of Cecilio Pineda, murdered in 2017, who had been the victim of surveillance for two years. Although Enrique Peña Nieto’s government ended up acknowledging that it acquired it, it has argued that the purpose was to combat crime and not to persecute its opponents.

The cybersecurity group at the University of Toronto (Canada), Citizen Lab, has
one of the few forensic technology laboratories that can identify Pegasus. It is a well-known name in Spain. In 2022, a report from that center revealed that several Catalan independence leaders, and even President Pedro Sánchez, had been hacked through Pegasus between 2017 and 2020. The National Intelligence Center explained that it had used the software under court order, legally, but suspicions about its use have persisted.

One of the most recent cases was that of Dominican journalist Nuria Piera, who identified that her device was being tapped by Pegasus after she published several investigations into government corruption. Amnesty International warned that with this case, the Dominican Republic was the third country in Latin America in which misuse of the software had been identified. Colombia could be the fourth.

Subscribe here to the EL PAÍS newsletter on Colombia and Here on the WhatsApp channeland receive all the key information on current events in the country.