Previous reporting showed that Pegasus was used against Hungarian targets in 2018 and 2019. Now there is evidence that Zoltán Páva, a former politician who is a news publisher now, was under surveillance in March and May this year.

In recent months, it has been revealed that several Hungarian journalists and critics of Viktor Orbán’s government have been targeted in 2018 and 2019 with the spyware Pegasus. Direkt36 now also has evidence that the program has been in use in Hungary as recently as a few months ago.

This spring, Zoltán Páva, a former politician of the opposition party MSZP who is now the publisher of the news portal Ezalenyeg.hu, was under surveillance for weeks. His publication, which is known for its harshly critical coverage of the government, was launched during the 2019 municipal election campaign and played an important role in the success of the opposition thanks to its strong social media presence. Ezalenyeg.hu has since launched several new local versions and is planning to support the opposition in the 2022 parliamentary election campaign.

Traces of Pegasus on Páva’s smartphone have been found by security experts from two organizations, the human rights group Amnesty International and the Canada-based Citizen Lab. According to the forensics analyses, the spyware was present on the device between March 16 and 24 and May 23 and 27 this year.

“During those ranges, the phone was infected. It is really hard to say what data is pulled out in these cases, but we can say that Pegasus had access to anything that Zoltán had access to,” John Scott-Railton, senior researcher at Citizen Lab, told Direkt36. The spyware could access messages, photos and videos stored on the device, or even remotely turn on the phone’s microphone and camera.

In July, a team of international journalists published stories as part of the Pegasus Project, which was based on a database of 50,000 phone numbers selected for monitoring by NSO customers. Forbidden Stories and Amnesty International had access to the database, which they shared with 16 other news organizations, including The Washington Post, the Süddeutsche Zeitung and The Guardian. From Hungary, Direkt36 was the only participant.

Páva’s phone number was not on the leaked list, but the reason for that is presumably that the database may have leaked even before he became a target. Direkt36 has no information on when exactly the database was leaked, but the in the spring of 2021, the international collaboration was already underway.

Evidence gathered so far strongly suggests that Hungarian state actors are behind the use of Pegasus in Hungary. A security officer formerly with one of Hungary’s intelligence services told Direkt36 that, according to his knowledge, Hungarian services started using Pegasus in 2018 as a direct result of strengthening ties between Israel and Hungary. A former NSO employee also confirmed to one of the project’s partners that Hungary indeed procured the Pegasus software.

The Hungarian government has not denied that they use Pegasus, nor did they deny the surveillance of the people Direkt36 has reported about. The government did not respond to questions about the surveillance of Zoltán Páva. 

Strange phone calls

Páva had approached Citizen Lab to have his phone examined even before the Pegasus Project stories were published in mid-July. He told Direkt36 that he made that decision because he had experienced several oddities with his phone in the spring. He said his calls were often disrupted even in places where he didn’t usually have a problem with signal, and he sometimes heard sounds as if the caller on the other end had “fallen underwater” during a conversation.

Páva said he sent his phone data to Citizen Lab professionals on July 14, with whom he came in contact through one of his acquaintances. Páva said he had no idea at the time that his phone had been infected with Pegasus, he simply suspected that he was being under some kind of surveillance.

Citizen Lab’s analysis found traces of Pegasus in the files and notified Páva in late July. The results of that forensic examination were also confirmed by security experts from Amnesty International who performed the analysis of the phone at the request of Direkt36. Páva said that he had asked Citizen Lab to check the phones of his colleagues at Ezalenyeg.hu too, but no infections were found on those devices.

According to Páva, it is “dire and frightening” that it can be a cause for surveillance if a journalist, lawyer, or businessman is critical of the government and dares to express it. “I am very hopeful that those who were under surveillance are not afraid. I’m definitely not afraid, and that is why I would like to go public because I have nothing to hide,” he said.

Páva has never been in the front lines of politics but has had ties to prominent players in the current opposition. His father was one of the most influential politicians of the Socialist Party in Baranya County for a long time. He was also a member of the same party but said he had quit in 2010 and has not joined any other political organization since. Between 2008 and 2010, he served in the government led by the Socialists as political advisor.

After Viktor Orbán’s party defeated the socialists by a landslide and came back to power in 2010, Páva quit politics and worked in a street advertising company he runs together with his wife, he said. He returned to politics in 2019, when he became the publisher of a newly launched news portal, Ezalenyeg.hu. The site, which strongly criticized the government, stood out in the municipal election campaign with a very strong social media presence. 

According to investigative outlet Atlatszo, Ezalenyeg.hu and its various local versions spent more than 68 million forints (194 thousand euros) on Facebook advertisements, which was much higher than what Gergely Karácsony, the opposition’s candidate in Budapest, spent himself (22.5 million forints or 64.2 thousand euros). Karácsony eventually won the mayoral race, and the opposition won in several other larger cities. Sources from the opposition campaign told Direkt36 previously that the secret of their success was partly their social media presence, and Ezalenyeg.hu contributed significantly to this.

“In the opposition media, we play the role of those who dare to publish anything, but our main rule is that we never lie. We have won more than 95 percent of the lawsuits against us,” Páva said. He added that they speak “in such a free spirit that the other outlets do not speak.”

Páva gave a general answer to questions about the news site’s financial background, including the one about how they were able to spend nearly 70 million forints during the 2019 campaign. He said that, in addition to advertising revenue, they also have private supporters like more and more other newspapers. He added that although he is the sole owner of Oraculum 2020, the publisher of the outlet, there are several other investors behind the company, but he refused to reveal their names.

Páva said that he does not understand why he was under surveillance between March 16 and May 27. He had just fallen ill with coronavirus the day his phone was hacked, so he went on sick leave and attended only a few online meetings in the weeks that followed. He considers it possible that he was not the main target. “I have a lot of friends who think that change is needed in Hungary,” he said, and added that he regularly speaks with politicians as well.

Páva said he has not seen any signs of confidential information leaking while he was under surveillance. He added, however, that a suspicious episode had taken place earlier this year.

Páva recalled being approached by a former business partner who wanted to hire a communications specialist for a project at one of Hungary’s universities. They had preparatory meetings, but those were confidential, and they did not involve anyone else.

At some point, however, Páva said that his business partner sent him a message through someone else that he wanted to meet him in person. He then told him that he had been told not to work with Páva. The partner found this very suspicious because he had not told anyone about the planned cooperation.

Blocked inquiries

NSO claims to sell Pegasus exclusively to foreign governments and state agencies to fight terrorism and organized crime. However, the identification of leaked phone numbers revealed that the spyware was also used against journalists, human rights defenders, politicians, and businessmen from Mexico through Azerbaijan to India.

The database also contains more than three hundred Hungarian telephone numbers, including four Hungarian journalists (Brigitta Csikász, Dávid Dercsényi, Szabolcs Panyi, András Szabó), a Hungarian photographer, media company owner Zoltán Varga and six of his acquaintances (including former minister of economy Attila Chikán), as well as the son and lawyer of former oligarch Lajos Simicska. But opposition politician György Gémesi, Hungarian Bar Association president János Bánáti, and nine other lawyers, as well as former state secretaries Attila Aszódi, and Balázs Weingartner also show up. (Details in these stories.)

Opposition parties have initiated a parliamentary national security committee to investigate the Pegasus case, but the governing Fidesz party has blocked the inquiry. Although the Minister of the Interior, Sándor Pintér, who oversees several secret service agencies, appeared before the committee at the end of July, the hearing was not held because Fidesz’ representatives, who are in majority in the committee, did not show up.

Late July, the prosecutor’s office announced that an investigation had been launched into “unauthorized secret information gathering.” According to the statement at the time, the purpose of the investigation was to find out if a crime had occurred at all. The prosecutor’s office has now told Direkt36 that the investigation is ongoing and “several journalists have been questioned as witnesses and requests for information have been made in the proceedings; so far, there is no suspect in the case.”

Szabolcs Panyi contributed reporting.

Cover picture: Szarvas/Telex