On June 24, 2021 in Amalfi, near Naples in Southern Italy, Lőrinc Mészáros showed up in a T-shirt with the word ‘ICON’ printed on it, walking in the street with his new partner, former TV presenter Andrea Várkonyi. The appearance of Prime Minister Viktor Orbán’s childhood friend, a former gas fitter who has become one of Hungary’s richest men in the last few years, was not entirely unexpected. A Bombardier private jet with the call sign OE-LEM, previously used by the billionaire’s family and Orbán himself, as well as a luxury yacht named Lady Mrd (‘Lady Billion’) also arrived in the Naples area just that day.

That’s what made photographer-journalist Dániel Németh think that it might be worth traveling to the Southern Italy this summer. Németh has spent years investigating and documenting the luxury lifestyle of Hungary’s ruling elite, following them with his camera as they travelled around Europe. This time, however, someone was watching him too.

A Direkt36 investigation has found that in early July, the journalist’s two phones were hacked with Pegasus spyware, a tool that has been used against several other Hungarian journalists and critics of the government in recent years. The spyware, developed by the Israeli cybersecurity firm NSO, could access messages, photos and videos stored on the device, or even remotely turn on the phone’s microphone and camera.

In July, a team of international journalists published stories as part of the Pegasus Project, which were based on a database of 50,000 phone numbers selected for monitoring by NSO’s customers. Forbidden Stories, a Paris-based journalism outlet, and the human rights organization Amnesty International (AI) had access to the database, which they shared with 16 other news organizations, including The Washington Post, the Süddeutsche Zeitung and The Guardian. From Hungary, Direkt36 was the only participant and as part of the project we have already revealed how influential lawyers, opposition politicians, and two state secretaries of the Orbán government were also targeted with Pegasus in Hungary.

Németh’s phone number did not yet appear on this leaked list, but the reason for that is that the list was generated before he became a target. After the Pegasus story broke in mid-July, Németh approached Citizen Lab at the University of Toronto in Canada through an acquaintance and asked them to analyze his phones. Citizen Lab’s experts have found traces of Pegasus on the journalist’s devices. Németh then turned to Direkt36, and we asked Amnesty Tech, the security lab of AI, to conduct a second, independent analysis of the phones.

Amnesty’s forensic analysis showed that Dániel Németh’s two phones were successfully hacked with Pegasus spyware, one from July 1 to 9, 2021, and the other from July 5 to 9. During this period, Németh was in Hungary just after returning from the reporting trip to Southern Italy. He was in the middle of planning his next trip by observing the route of the luxury vehicles used by the Fidesz elite.

“Amnesty Tech’s confirmation of a Pegasus infection on Dániel Németh’s device is yet another outrageous example of how NSO Group’s spyware is being used as a tool to silence journalists,” said Likhita Banerji, researcher at Amnesty Tech, calling the Hungarian authorities for conducting “an independent, transparent, and impartial investigation of any cases of unlawful surveillance revealed by the Pegasus Project.”

“This case is a clear warning sign that surveillance abuses are out of control in Hungary,” said John Scott-Railton, senior researcher at Citizen Lab. He added that “the competent European Union bodies need to take a close look at the growing list of Pegasus cases in Hungary.”

Evidence gathered so far strongly suggests that Hungarian state actors are behind the use of Pegasus in Hungary. A security officer formerly with one of Hungary’s intelligence services told Direkt36 that, according to his knowledge, Hungarian services started using Pegasus in 2018 as a direct result of strengthening ties between Israel and Hungary. A former NSO employee also confirmed to one of the project’s partners that Hungary indeed procured the Pegasus software. The Hungarian government has not denied that they use Pegasus, nor did they deny the surveillance of the people Direkt36 has reported about. The government did not reply to questions about the surveillance of Németh.

On July 22, in an Israeli radio show, NSO founder Shalev Hulio responded to a question from Direkt36 that if Pegasus was indeed used to monitor journalists in Hungary, it would be unacceptable and the case would be investigated. And if the abuse is confirmed, Hulio claims that their client monitoring Hungarian journalists will be cut off from using their spyware. However, NSO never comments on who their customers are, nor did Hulio answer questions about whether the Hungarian state indeed uses Pegasus.

The Pegasus infections found on Dániel Németh’s phone occurred just two weeks before the radio show and the publication of the first Pegasus Project stories. He is not the only one in Hungarian media whose phone was compromised with Pegasus very recently. Zoltán Páva, the publisher of the opposition news site ezalenyeg.hu, was surveilled with the spyware in March and May this year.

Tracking the pro-government elite

Dániel Németh has contributed to some of the most groundbreaking investigative stories in Hungary in recent years, but his name is still not widely known, as he deliberately tries to keep a low profile. For years, this may have helped him follow politicians and pro-government businessmen unnoticed.

In 2012, for example, Németh took the famous cover photo for the magazine Magyar Narancs, depicting Lajos Simicska, the oligarch who was at the peak of his power at the time. Simicska was hiding from the public for years – in fact no new photo of him had appeared in the Hungarian press for more than a decade. Németh also managed to take photos of the Prime Minister Viktor Orbán’s son-in-law, István Tiborcz, as he talked to associates of Ghaith Pharaon, a businessman who was on the FBI’s wanted list at the time. Németh also documented when Ráhel Orbán, the oldest daughter of the prime minister and wife of Tiborcz, met with Turkish billionaire Adnan Polat on the terrace of Gresham Palace, one of Budapest’s most exclusive hotels.

Németh has tried to stay in the background so much that he even decided not to take credit for some of his photos and videos that were published as part of explosive investigative stories. Such were, for example, the video footages published in an article on the news site Index. These videos showed that Árpád Habony – the spin doctor of Viktor Orbán, Antal Rogán – one of Orbán’s closest aides, and Balázs Kertész – Rogán’s longtime associate, met regularly in Kertész’s downtown office. Later, Németh took photos, including drone shots, of Kertész’s luxury villa on Gellért Hill, one of Budapest’s wealthiest areas.

With the help of public online flight and ship tracking applications, Hungarian journalists have been trying for years to find out which Fidesz politicians or billionaires are traveling on private luxury vehicles with ties to pro-government businessmen. However, back in 2016 Németh was the first to discover the Hungarian government elite’s admiration for yachts, when he documented Lőrinc Mészáros and his then wife on vacation on a yacht called Artemy. Németh also stands out in the Hungarian media for his persistence in following the movements of the governing party’s elite abroad. Whenever it is possible, he buys a low-cost plane ticket, and, equipped with his camera, drone, and mobile phone, tries to take photos of these passengers at ports, or sometimes out at sea.

In 2018, he used a drone to record video footage of billionaire László Szíjj and his guests on board of a yacht called Lady Mrd, which is even more grandiose than Artemy. It also turned out that Szíjj is the actual owner of the luxury yacht. Two years later, in 2020, Németh approached the same yacht on a speedboat and this is how he managed to take pictures of Foreign Minister Péter Szijjártó. After these recordings were published on Atlatszo.hu, for weeks, the Orbán government was forced to explain why their cabinet member vacationed on the yacht of a businessman who had been awarded billions in public contracts.

Pro-Orbán propaganda media denounced the investigation by suggesting that it was using “intelligence service methods” and that it equals to “treason.” Moreover, a pundit even said that if one were to monitor to U.S. president in this way, one would no longer live. Another pundit proposed that Németh’s speedboat should have been sunk. A former Hungarian intelligence officer told Direkt36 that since the photographer-journalist had previously also taken pictures of a person (the Foreign Minister) under national security protection during a holiday, this could have been used as an excuse to justify Németh’s later surveillance.

Two trips, two hacked phones

Németh continued to follow the travel routes of the yachts and private jets this summer. After noticing on a tracking app that Lady Mrd was heading from Tivat, Montenegro to Naples, Italy, he quickly booked a low-cost plane ticket there as well. He finally arrived in Naples on the same day, June 24, when Lőrinc Mészáros and his entourage also appeared in the nearby town. In the following days, the photographer-journalist tried to take pictures of the yacht’s passengers. Since only a few passengers showed up, and he did not even recognize them at first, he flew back to Budapest on the evening of June 28th.

Almost immediately, Németh began to organize his return to southern Italy, but with several precautionary measures taken. For the next trip, for example, he did not buy the flight ticket himself, but asked an acquaintance to do so. He decided so because he was afraid of being surveilled. As it turned out, his concern was not unfounded: according to analyses by Citizen Lab and Amnesty International, his phone was first hacked with Pegasus spyware on July 1, a few days after returning home from Naples.

Those surveilling him must have been very determined. Németh’s other precaution was that he had decided not to take the iPhone he was regularly using on the next trip, but instead taking an older device that had a prepaid SIM card. The photographer had not used this device for months, so the money uploaded to it was lost and the card was inactivated. Németh reactivated this card on July 4 and put money on it.

However, the precaution did not help much: the next day, on July 5, according to forensic analyses, this phone was also infected with Pegasus. A former Hungarian counterintelligence officer told Direkt36 that an essential part of the surveillance toolkit is that they can see in real time when a phone number linked to a target becomes active and connects to the mobile network. He added that the agencies that carry out interceptions and observations already have a close connection with all Hungarian mobile carriers and can gain access to the information they have.

The spyware ran on both phones of Németh until July 9. This was the day he left Hungary again to board a plane and continue to follow the luxury yacht and its passengers on the coasts of South Italy.

Forensic analyses showed the last trace of Pegasus at dawn on July 9, with Németh boarding an early plane just a few hours later. During his stay in Italy, the spyware was no longer active on his phone. It is not clear why the surveillance ceased during the trip, but it may have had technical limitations. It is known that NSO would not allow customers to carry out surveillance anywhere in the world without limitations.

Blocked inquiries

Opposition parties have initiated a hearing of the parliament’s national security committee to investigate the Pegasus case, but the governing Fidesz party has blocked the inquiry. Although Minister of the Interior Sándor Pintér – who oversees several intelligence agencies – appeared before the committee at the end of July, the hearing was not held because Fidesz’ representatives, who are in majority in the committee, did not show up.

After Direkt36 reported on the surveillance of Zoltán Páva, chairman of the committee János Stummer of the Jobbik party convened another meeting for September 20, where MPs of the governing party were finally present. Among those summoned to brief the committee were Minister of Interior Sándor Pintér and State Secretary Pál Völner from the Ministry of Justice. János Stummer, however, could not provide the public with substantial information after the hearing as everything that was said has been classified until the end of 2050.

Nevertheless, Stummer was at least able to talk about what was not discussed. “There was no answer to the question whether the Hungarian state has procured such tool in recent years” – the Jobbik politician said. He claimed that neither Sándor Pintér, nor Pál Völner refuted clearly that Pegasus was used for the surveillance of journalists and politicians. To find answers to all their questions, opposition MPs of the committee János Stummer (Jobbik), Zsolt Molnár (MSZP) and Péter Ungár (LMP) then initiated a separate inquiry, but government MPs voted against it.

Late July, the prosecutor’s office announced that an investigation had been launched into “unauthorized gathering of secret information.” According to the statement at the time, the purpose of the investigation was to find out if a crime had occurred at all. The prosecutor’s office has recently told Direkt36 that the investigation is ongoing and “several journalists have been questioned as witnesses and requests for information have been made in the proceedings; so far, there is no suspect in the case.”

Illustration: szarvas / Telex