On July 18, 2021, Direkt36 published the article titled “Hungarian journalists and critics of Orbán were targeted with Pegasus, a powerful Israeli cyberweapon”, and at the same time, investigations about the Israeli spyware made headlines worldwide, including in the Washington Post, Le Monde, and The Guardian.

The revelation was based on a leaked target list of more than 50,000 phone numbers. These numbers were selected as Pegasus targets by clients – various authorities of foreign governments – of the Israeli NSO Group, the spyware’s manufacturer. Pegasus is capable of remotely hacking mobile phone devices to access all their data and even secretly activate the camera and microphone. This technology has been used to spy on nearly 200 journalists worldwide, from Mexico through Hungary to India.

As a member of the Pegasus Project, an international consortium of journalists led by Paris-based Forbidden Stories, Direkt36 has revealed that journalists and media company owners in Hungary, including two Direkt36 reporters, were surveilled with the Israeli spyware. Among the Hungarian Pegasus targets we also identified prominent lawyers, opposition politicians, and then more reporters, sources assisting journalists, media company owners and attorneys, as well as former government officials, top national security officers and even President János Áder’s bodyguards.

It has been two years since the first articles of the Pegasus Project were published, sparking a huge outcry in many countries around the world. As a result, the United States has blacklisted NSO Group, making it almost impossible for the Israeli spyware company to operate. The European Parliament, through an inquiry committee, has investigated spywares abuses in EU member states, and authorities in several countries have also launched their own thorough investigations.

In Hungary, however, things have been very different, and this article summarizes what has happened over the past two years.

Politicians who were in charge are not around anymore

After the publication of the Pegasus Project revelations, the Orbán government first denied everything, then tried to keep silent. Finally, after a closed doors committee meeting, senior Fidesz MP Lajos Kósa seemingly accidentally revealed that the Ministry of Interior had indeed purchased the Pegasus spyware (in fact, it was an intelligence service overseen by the ministry that had bought it) in response to a question from RTL Klub television. The government subsequently admitted that the spyware had been used, but from Interior Minister Sándor Pintér to Prime Minister Viktor Orbán, they consistently claimed that all the surveillance was completely legal.

The spyware was operated by the Special Service for National Security (NBSZ or SSNS), which was then under the supervision of the Ministry of the Interior, but they only served the other national security services, which were also largely under the Pintér-led interior ministry, by conducting the technical surveillance. After the 2022 elections, however, all civilian intelligence services were transferred to the Prime Minister’s Cabinet Office, managed by minister Antal Rogán. Hedvig Szabó, the director-general who led SSNS during the Pegasus surveillances, also left, replaced by her deputy, Csaba Kiss.

Under the law, the Minister of Justice is responsible for authorizing secret surveillance – by signing surveillance permits – in national security related investigations. But Judit Varga, then justice minister, told Telex.hu a few days after the Pegasus surveillances were exposed that she had entrusted this task to her deputy, state secretary Pál Völner. However, the law only allows the transfer of this task in the event of the minister being prevented from doing so, and it is not possible to transfer it on a continuous and regular basis. Opposition MP Ágnes Vadai from the Democratic Coalition party tried to find out whether Varga had been investigated for what she considers an illegal practice, but received no reply.

Pál Völner was eventually caught up in an unrelated corruption scandal and resigned in December 2021 after being accused of bribery. Later, an intercepted phone conversation between György Schadl, President of the Hungarian Court Bailiffs Chamber, and Völner revealed that Völner was offended by Judit Varga’s attempts to shift the blame for the Pegasus surveillances onto him, and that he himself had started “resting” one of his phones after articles about the spyware surveillances. Judit Varga, Völner’s former boss, resigned at the end of June 2023. According to the official explanation, this was because she will lead Fidesz’s party list in the European Parliament elections next year.

However, at the time of most of the surveillance cases revealed by Direkt36, Varga’s predecessor, László Trócsányi, was still Minister of Justice and thus politically responsible for surveillance permits. Trócsányi is currently an MEP for Fidesz in Brussels, and in January 2022 he was elected rector of the Károli Gáspár University of the Reformed Church.

Journalists interrogated and investigated

After Direkt36’s first articles, several police reports were filed, leading the Regional Proscutor’s Office of Investigations of Budapest to launch an investigation into the alleged unauthorized collection of secret information. In the course of this investigation, the prosecution heard as witnesses, among others, three Direkt36 employees, Szabolcs Panyi and András Pethő, authors of the articles on Pegasus surveillance, and András Szabó, who was also surveilled with Pegasus along with Panyi.

Almost a year later, in June 2022, the prosecutor’s office closed the investigation for lack of criminality, as they considered the surveillance to be lawful. Telex.hu reported that in defense of the surveilled journalists, the prosecution added that the journalists “are not necessarily suspected of committing a crime because they were subject to secret information gathering”.

The investigation of the National Authority for Data Protection and Freedom of Information (NAIH) also cleared the state actors of any suspicion of abuse, but the full material of their findings will remain classified until December 31, 2050. However, in early 2022, NAIH President Attila Péterfalvi, presenting the main findings, revealed that the intelligence agencies cited national security risks as the reason for the surveillance of those individuals whose name was published in the media.

Péterfalvi examined, among other things, whether the surveillances were accompanied by surveillance permits and whether they were in due form. However, the European Court of Human Rights (ECHR) in Strasbourg later essentially ruled in October 2022 that Hungary lacks independent, external oversight of how surveillance is carried out and that the NAIH was not fit for this purpose either.

In the course of the investigation of the Pegasus case, however, what NAIH did find problematic was how the abuses were uncovered by the Pegasus Project investigation. The authority believed that the leaked target list underlying the Pegasus Project could have been the result of a “data protection incident”, which “could involve unauthorised data transfers and unlawful data processing operations”. Péterfalvi therefore filed a criminal complaint, which the NAIH said was dismissed by the police in March 2023 “in the absence of criminal offences”. However, the NAIH also found that Judit Varga had indeed outsourced the signing of surveillance permits to Pál Völner, contrary to the law.

A few weeks later, in the spring of 2022, the NAIH launched a separate investigation against Direkt36 journalist Szabolcs Panyi (the author of this article). The investigation was launched following a complaint filed by an intelligence officer of the SSNS, which was conducting the surveillance. Direkt36 had previously reported that this officer’s phone number was on the leaked target list. However, the reason for this was probably that the officer himself was one of the operators of Pegasus and was merely testing the spyware on his own number. The NAIH investigated this case for four months and concluded that Direkt36’s reporting “did not result in any violation of rights in connection with the processing of personal data and there is no imminent risk of such violation.”

The broker company sues

At the end of 2022, Communication Technologies Ltd, the broker company involved in the purchase of the Pegasus spyware in Hungary, filed a lawsuit against Direkt36 and several other publications that quoted our article about the company. In that article, we revealed that the Parliament’s national security committee unanimously approved, with opposition votes, that Communication Technologies Ltd would purchase Pegasus on behalf of the SSNS from a Luxembourg-based company of the NSO Group in October 2017. We also wrote that the broker company, which had won other major state procurements, later became part-owned by former state secretary László Tasnádi, a confidant of interior minister Sándor Pintér.

Among other things, Communication Technologies Ltd tried to have Direkt36 and the other four publications (Telex, 444.hu, Magyar Narancs, Menedzsment Fórum) that wrote about their role in the Pegasus purchase (following our article) retract some of our findings. However, the company’s legal representative refused to comment on the court’s specific question whether they were involved in the purchase of the spyware or not. The company’s representative tried to stress that Direkt36 had no direct information that would prove beyond doubt that Communication Technologies Ltd was involved in the acquisition of Pegasus. (The acquisition of Pegasus was classified, so we as journalists had no access to its documents. Direkt36 wrote the article based on the unanimous testimony of independent sources with knowledge of the details of the acquisition.)

The court hearings, which took place at the beginning of 2023, were led by several judges and were all lost at first instance by the broker company. The court ruling in in the case against Telex.hu, for example, ruled that a plaintiff cannot claim retraction or rectification of a statement that it does not even claim to be untrue. Since the judgments were not appealed, they became final and Communication Technologies Ltd had to pay the costs of the litigation.

Seeking justice

In the meantime, the Hungarian Civil Liberties Union (HCLU) has launched various legal proceedings on behalf of several journalists, lawyers and activists who were targeted with the Pegasus spyware. Among the proceedings were various complaints and requests for access to information (read about them here).

For example, the legal proceedings include a request for access to classified information, through which the HCLU tries to find out who has gathered what data about their clients, and why. In November 2022, for example, in a case against the Constitution Protection Office (AH, the civilian counterintelligence agency), where HCLU represented the author of this article, the court ordered the AH to repeat their own procedure that ended in the refusal of the request for access.

According to HCLU lawyer Ádám Remport, the attitude of the authorities is well illustrated by the fact that HCLU does not even receive the full originals of the rejection decisions, only extracts, which do not reveal, for example, the fact of data processing or the identity of the data controller (which intelligence service initiated the surveillance).

At the EU level, however, there has been some progress. In February 2023 the European Court of Human Rights in Strasbourg accepted a lawsuit brought by HCLU on surveillances against Hungarian civil society organizations and independent journalists. However, Remport says this is only the first stage of a long process, and it could even happen that the application is rejected without any substantive investigation. HCLU has also produced a short documentary about surveillance in Hungary, using the example of their clients (English subtitles available):

Meanwhile in Brussels

In mid-June 2023, the European Parliament adopted by a large majority the report of the Committee of Inquiry to investigate the use of Pegasus and equivalent surveillance spyware (PEGA Committee), as well as a separate non-binding resolution. The European Parliament has called on Hungary to ensure that any use of spyware is authorized by an independent court before it is used, instead of by the Minister of Justice, and that the Hungarian authorities credibly investigate suspected abuses and guarantee meaningful legal options. The debate on the PEGA report in the European Parliament was boycotted by Fidesz MEPs, just as Minister of Justice Judit Varga had earlier refused to meet the PEGA Committee during their visit to Hungary in February 2023.

Along with Hungary, Poland and Spain were also condemned by the PEGA report, which found that Pegasus was also misused in those countries – the spyware was used to monitor Polish opposition members and the Catalan leadership and independence movement. The third EU Member State to have serious problems was Greece, where another Israeli spyware, Predator, was used for the surveillance of journalists and the leader of one of the main opposition parties. In addition, the PEGA Committee has also singled out Cyprus, which is acting as a hub for the export of various types of spyware into the EU, but has been found not to be doing so in accordance with European law.

However, the Hungarian government has stated well in advance that the European Parliament and the EU in general do not have any mandate to investigate the surveillance in Hungary, as national security is a national, not an EU competence. The PEGA Committee’s report and the EP’s decision are not legally binding. In order to strictly regulate the use of spyware in the EU, it would need the support of the European Commission and the European Council, which includes the leaders of the Hungarian, Polish, Greek and Spanish governments accused of abuses.

Although the forthcoming EU media regulation, the European Media Freedom Act (EMFA), would have at least allowed for stricter regulation of the surveillance of journalists, the original draft has started to be watered down.

Article four of the proposed law would clearly state that journalists’ mobile phones and computers cannot be surveilled by spyware. However, Investigate Europe and other European investigative outlets have reported, based on leaked information about the negotiations on the law, that France is proposing that journalists could still be monitored by spyware for “national security reasons”. The French initiative is backed by Germany, the Netherlands, the Czech Republic, Greece and Luxembourg, among others, according to a diplomatic note obtained. Sixty press freedom and human rights groups have joined forces to protest against the amendment allowing surveillance of journalists on national security grounds.