Israeli-Made Spyware Used to Monitor Journalists and Activists Worldwide

They Are Watching You: Israeli-Made Spyware Used to Monitor Journalists and Activists Worldwide

By OCCRP

In Hungary, Szabolcs Panyi exposed spy intrigue and murky arms deals. In India, Paranjoy Guha Thakurta probed the ties between business and political interests. In Azerbaijan, Sevinj Vaqifqizi caught vote-rigging on tape.

Separated by thousands of miles, these journalists have one thing in common: their governments considered them a threat.

All three were among dozens of journalists and activists around the world whose smartphones were infected by Pegasus: spyware made by Israeli firm NSO Group that is able to secretly steal personal data, read conversations, and switch on microphones and cameras at will.

The attacks were revealed by The Pegasus Project, an international collaboration of more than 80 journalists from 17 media organizations, including OCCRP, and coordinated by Forbidden Stories.

What Does ‘Selected for Targeting’ Mean?

The phones of Panyi, Thakurta, and Vaqifqizi were analyzed by Amnesty International’s Security Lab and found to be infected after their numbers appeared on a list of over 50,000 numbers that were allegedly selected for targeting by governments using NSO software. Reporters were able to identify the owners of hundreds of those numbers, and Amnesty conducted forensic analysis on as many of their phones as possible, confirming infection in dozens of cases. The reporting was backed up with interviews, documents, and other materials.The strongest evidence that the list really does represent Pegasus targets came through forensic analysis.

Amnesty International’s Security Lab examined data from 67 phones whose numbers were in the list. Thirty-seven phones showed traces of Pegasus activity: 23 phones were successfully infected, and 14 showed signs of attempted targeting. For the remaining 30 phones, the tests were inconclusive, in several cases because the phones had been replaced.

Fifteen of the phones in the data were Android devices. Unlike iPhones, Androids do not log the kinds of information required for Amnesty’s detective work. However, three Android phones showed signs of targeting, such as Pegasus-linked SMS messages.

In a subset of 27 analyzed phones, Amnesty International researchers found 84 separate traces of Pegasus activity that closely corresponded to the numbers’ appearance on the leaked list. In 59 of these cases, the Pegasus traces appeared within 20 minutes of selection. In 15 cases, the trace appeared within one minute of selection.The strongest evidence that the list really does represent Pegasus targets came through forensic analysis.

In a series of responses, NSO Group denied that its spyware was systematically misused and challenged the validity of data obtained by reporters. It argued that Pegasus is sold to governments to go after criminals and terrorists, and has saved many lives. The company, which enjoys close ties to Israel’s security services, says it implements stringent controls to prevent misuse. NSO Group also specifically denies that it created or could create this type of list.

But instead of targeting only criminals, governments in more than 10 countries appear to have also selected political opponents, academics, reporters, human rights defenders, doctors, and religious leaders. NSO clients may have also used the company’s software to conduct espionage by targeting foreign officials, diplomats, and even heads of state.

Based on the geographical clustering of the numbers on the leaked list, reporters identified potential NSO Group clients from more than 10 countries, including: Azerbaijan, Bahrain, Hungary, India, Kazakhstan, Mexico, Morocco, Rwanda, Saudi Arabia, Togo, and the United Arab Emirates. Journalists and Activists in the Crosshairs

In the coming days, OCCRP and other Pegasus Project partners will release stories highlighting the threat of surveillance through misuse of NSO Group software around the world. But to start with, we will focus on some of the most egregious cases: the use of spyware to surveil, harass, and intimidate journalists and activists — and those close to them.

Among those on the list were multiple close relations of Jamal Khashoggi, the Washington Post columnist who was murdered and dismembered by Saudi operatives in the country’s Istanbul consulate. Forensic analyses show that Khashoggi’s Turkish fiancée, Hatice Cengiz, and other loved ones and colleagues were successfully compromised with NSO Group software both before and after Khashoggi’s 2018 killing. (NSO Group said that it has investigated this claim and has denied its software was used in connection with the Khashoggi case.)

Sandra Nogales, the assistant of star Mexican journalist Carmen Aristegui, was also targeted with Pegasus through a malicious text message, according to a forensic analysis of her phone.

Aristegui had already known that she was a Pegasus target. Her case was featured in a 2017 report by Citizen Lab, an interdisciplinary laboratory at the University of Toronto. Still, “it was a huge shock to see others close to me on the list,” Aristegui told The Pegasus Project.

“My assistant, Sandra Nogales, who knew everything about me — who had access to my schedule, all of my contacts, my day-to-day, my hour-to-hour — was also entered into the system.”

Several reporters in OCCRP’s network were among the at least 188 journalists on the list of potential targets. They include Khadija Ismayilova, an OCCRP investigative journalist whose uncompromising reporting has made her a target of the kleptocratic regime of the country’s president, Ilham Aliyev. Independent forensic analysis of Ismayilova’s Apple iPhone shows that Pegasus was used consistently from 2019 to 2021 to penetrate her device, primarily by using an exploit in the iMessage app.

Ismayilova is no stranger to government surveillance. Roughly a decade ago, her reporting led her to be threatened with compromising videos that she learned to her horror had been shot with hidden cameras installed in her home. She refused to back down, and as a result had the footage broadcast across the internet.

But even after this, Ismayilova was shocked by the all-consuming nature of her surveillance by Pegasus.

“It’s horrifying, because you think that this tool is encrypted, you can use it… but then you realize that no, the moment you are on the internet they [can] watch you,” Ismayilova said. “I’m angry with the governments who produce all of these tools and sell it to the bad guys like [the] Aliyev regime.”

Panyi and his colleague András Szabó, both OCCRP partner journalists in Hungary, also had their phones successfully hijacked by Pegasus, potentially granting their attackers access to sensitive data like encrypted chats and story drafts. As investigative journalists at one of the country’s few remaining independent outlets, Direkt36, they had spent years investigating corruption and intrigue as their country became increasingly authoritarian under the rule of Prime Minister Viktor Orban.

Now they found out that they were the story.

For Panyi, the descendant of Jewish Holocaust survivors, something stung in particular: that the software had been developed in Israel, and exported to a country whose leadership regularly flirts with antisemitism.

“According to my family memory, after surviving Auschwitz, my grandmother’s brother left to Israel, where he became a soldier and soon died during the Arab-Israeli war of 1948,” Panyi wrote in a first- person account of learning he had been hacked. “I know it is silly and makes no difference at all, but probably I would feel slightly different if it turned out that my surveillance was assisted by any other state, like Russia or China.”

The alleged surveillance list includes more than 15,000 potential targets in Mexico during the previous government of President Enrique Peña Nieto. Many were journalists, like Alejandro Sicairos, a reporter from Sinaloa state who co-founded the journalism site RíoDoce. Data seen by The Pegasus Project show Sicairos’ phone was selected as a target for NSO Group’s software in 2017 shortly after his colleague, prominent journalist Javier Valdéz, was shot dead near RíoDoce’s office.

Others on the list were regular people thrust into activism by Mexico’s chaos and violence. Cristina Bautista is a poor farmer whose son, Benjamin Ascencio Bautista, was one of 43 students abducted in Iguala, in the Mexican state of Guerrero, in 2014 and remains missing until this day. The case shook Mexican society to its core and prompted Bautista and other parents to take to the streets in protest, and to assist independent experts in their own investigations.

The vocal stance taken by Bautista and other parents put them directly in the sights of Mexican authorities and Peña Nieto, who denounced the protests as destabilizing the country.

“Oh yeah, they were watching us! Whenever we went, a patrol followed us,” she said.

“They were chasing us.”

A “Natural Tool” for Autocrats

While The Pegasus Project exposes clear cases of misuse of NSO Group’s software, the company is just one player in a global, multi-billion-dollar spyware industry.

Estimated by NSO managers to be worth approximately $12 billion, the mobile spyware market has democratized access to cutting-edge technology for intelligence agencies and police forces that, in years past, could only dream of having it.

“You’re giving lots more regimes an intelligence service,” said John Scott-Railton, a senior researcher at Citizen Lab. “Like a foreign intelligence service in a box.”

Like many private spyware companies, NSO Group’s stock in trade is so-called “zero-day exploits” — previously undiscovered flaws in commercial software that can allow third parties to gain access to devices, such as mobile phones. Pegasus and other top tools enjoy a particular strength: They are often able to infect devices silently, without the user even having to click a link.

Such tools have given governments the edge amid the widespread adoption of encrypted messaging applications, such as WhatsApp and Signal, which otherwise supposedly allow for users to communicate beyond the reach of state surveillance. Once devices are successfully compromised, however, the contents of such apps become readily available, along with other sensitive data like messages, photographs, and calls. Meanwhile, the ubiquity of mobile phone cameras and microphones means they can be easily accessed by spyware clients as remote recording devices. While The Pegasus Project exposes clear cases of misuse of NSO Group’s software, the company is just one player in a global, multi-billion-dollar spyware industry.

“In order to bypass [encrypted messaging] you just need to get to the device at one or the other end of that communication,” said Claudio Guarnieri, head of Amnesty International’s Security Lab. Pegasus does just that. “Pegasus can do more [with the device] than the owner can. If Signal, for example, encrypts the message… [an attacker] can just record using the microphone, or take screenshots of the phone so you can read [the conversation]. There is virtually nothing from an encryption standpoint to protect against this.”

In fact, there isn’t much anyone can do to protect themselves from a Pegasus attack. Guarnieri is skeptical of applications that claim they are completely secure, and instead recommends mitigating the risks of spyware by practicing good cybersecurity hygiene. “Make sure to compartmentalize things and divide your information in such a way that even if an attack is successful, the damage can be minimized.”

At its heart, The Pegasus Project reveals a disturbing truth: In a world where smartphones are ubiquitous, governments have a simple, commercial solution that allows them to spy on virtually whoever they want, wherever they want.

“I think it’s very clear: Autocrats fear the truth and autocrats fear criticism,” said Scott-Railton of Citizen Lab.

“They see journalists as a threat, and Pegasus is a natural tool for them to target their threats.”

Published by the good folks at The Elephant.

The Elephant is a platform for engaging citizens to reflect, re-member and re-envision their society by interrogating the past, the present, to fashion a future.

They Are Watching You: Israeli-Made Spyware Used to Monitor Journalists and Activists Worldwide

By OCCRP

Since the devastating explosion of a store of ammonium nitrate in Beirut’s port on August 4, Lebanese citizens have taken to the streets in shock, outrage, and grief.

Above all, they have demanded answers: Where did the nearly 3,000 tons of explosive chemicals come from, and who owned it? Why did the rickety ship that brought the hazardous material to Lebanon end up stranded in the city’s port in late 2013? And how could the impounded chemicals sit for over half a decade in an unsafe warehouse before tragedy finally struck?

In Lebanon itself, the causes of the disaster appear to be tied to bureaucratic ineptitude. Just two weeks before the warehouse exploded, Lebanon’s president received an urgent report from the country’s security services warning him that the situation was critically dangerous.

The international side of the affair, on the other hand, quickly became lost in a maze of corporate and financial intrigue. Igor Grechushkin, the Russian man variously described as the owner or the operator of the Moldovan-flagged MV Rhosus, is said to have abandoned the vessel in Lebanon after declaring bankruptcy. The vessel’s deadly cargo had been purchased from the country of Georgia by a Mozambican firm that produces commercial explosives, via a British middleman trading firm linked to Ukraine.

The ownership of the Rhosus, and the companies that ordered the nearly 3,000 tons of ammonium nitrate to be transported halfway around the world in a rickety ship, are obscured by layers of secrecy that have stymied journalists and officials at every turn. Even the Lebanese government does not appear to know who actually owned the ship. A man stands next to graffiti at the damaged port area in the aftermath of a massive explosion in Beirut, Lebanon August 11, 2020. Credit: Hannah McKay / Reuters

But an international team of investigative journalists has uncovered new facts about the lead-up to the explosion, which killed at least 182 people, injured over 6,000 and caused hundreds of thousands to lose their homes.

Reporters found that the circumstances for the tragedy were set in the baffling nowhere-world of offshore trade, where secretive companies and pliant governments allow questionable actors to work in the shadows.

Among those secretly connected to the Rhosus and its final voyage: a hidden shipping tycoon, a notorious bank, and businesses in East Africa previously investigated for ties to the illicit arms trade.

In their joint investigation spanning ten countries, reporters found that:

Igor Grechushkin did not own the Rhosus but was merely leasing it through an offshore company registered in the Marshall Islands. Instead, documents show that the true owner of the Rhosus was Charalambos Manoli, a Cypriot shipping magnate. Manoli denies this, but declined to provide documents to back up his claim. Manoli owned the ship through a company registered in the notoriously secretive jurisdiction of Panama, which received its mail in Bulgaria. He registered it in Moldova, a land-locked Eastern European country that is notorious as a jurisdiction with lax regulations for vessels that fly its “flag of convenience.” To do this, he worked through another of his companies, Geoship, one of a handful of officially recognized firms that set foreign owners up with Moldovan flags. Then, yet another Manoli company, this one based in Georgia, certified the ship as seaworthy — even though it was in such bad shape it was impounded in Spain days later. At the time of the Rhosus’ last voyage, Manoli was in debt to FBME, a Lebanese-owned bank that lost multiple licenses for alleged money laundering offenses, including helping the Shia militant group Hezbollah and a company linked to Syria’s weapons of mass destruction program. At one stage, the Rhosus was offered up as collateral to the bank. The ultimate customer for the ammonium nitrate on the ship, a Mozambican explosives factory, is part of a network of companies previously investigated for weapons trafficking and allegedly supplying explosives used by terrorists.The factory never tried to claim the abandoned material. The intermediary for the shipment, a British company that was dormant at the time, convinced a Lebanese judge in 2015 to get the ammonium nitrate tested for quality with the intent of claiming it. The stockpile was found to be in poor condition, and the company, Savaro Limited, did not try to take back the ammonium nitrate in the end.

The new revelations show how, at almost every stage, the Rhosus’ deadly shipment was connected to actors who used opaque offshore structures and lax government oversight to work in the shadows.

The revelations also expose the particular dangers posed by the lack of transparency in the maritime shipping industry, according to Helen Sampson, the director of Cardiff University’s Seafarers International Research Centre.

The findings “highlight all the weaknesses of the [maritime shipping] system and how they can be exploited by those who want to exploit them,” Sampson said.

Offshore companies and convoluted ownership structures helped obscure the true ownership of the MV Rhosus. Credit: Edin Pašović The Rhosus’ True Ownership

The Moldova-flagged ship that set out from the Georgian port of Batumi in September 2013, carrying over 2,750 tons of ammonium nitrate made by a local factory and bound for Mozambique, was in poor shape. The decks were corroded, it lacked auxiliary power, and had problems with radio communication. The vessel stopped in Beirut to pick up more cargo and never left. It was detained first by creditors seeking debts from its operator, and later by port officials who considered it unsafe to sail.

The MV Rhosus in Istanbul in 2010. Credit: Hasenpusch/picture-alliance/dpa/AP Images

After the ship was abandoned and impounded in 2014, leaving Ukrainian and Russian crew members stranded on board for 10 months, the ammonium nitrate was moved to a warehouse at the port. The ship eventually sank behind a breakwater, where its wreckage remains.

Following the Beirut explosion, media reports and government authorities have focused on one man as responsible for abandoning the ship and its cargo: Igor Grechushkin. A 43-year-old Russian citizen living in Cyprus, Grechushkin has been repeatedly identified as the Rhosus’ owner. He has avoided all attempts by OCCRP and other outlets to speak to him, although he was interviewed by Cypriot police at the request of Lebanese authorities on August 6.

Igor Grechushkin has attracted attention around the world for his role in the Lebanon explosion. But public records suggest that he has a history of acting as a corporate officer in companies run by others. He was also convicted of aggravated theft in the mid-2000s in Russia’s far east, for reasons that remain unclear. At different times between 2006 and 2013, Greschushkin served as the secretary of two Cyprus- registered companies: Lyncott Enterprises and Hogla Trading, which provided ship chartering and maritime services. Both companies listed another Russian citizen, Alexander Galaktionov, as the director.

Both Grechushkin and his wife Irina have lived in Cyprus for several years. He appears to travel often between the island and Moscow.

Grechushkin was born in August 1977 in the far-eastern Russian port town of Vanino where his extended family still lives. According to his now-deleted LinkedIn profile, he attended the Far Eastern Public Administration Academy.

But Grechuskin, on paper at least, did not own the Rhosus. Instead, through a company in the Marshall Islands called Teto Shipping, he had chartered the ship from a company in Panama, Briarwood Corporation, according to official records from Moldova’s Naval Agency. The Rhosus’ registration details from Moldova’ Naval Agency. Credit: OCCRP Panama, a notoriously secretive offshore jurisdiction, does not make public the ownership of companies registered there. But by searching through court records in Cyprus, OCCRP journalists found a 2012 document showing that Briarwood belonged to Manoli.

Three of Manoli’s other companies helped the Rhosus obtain its Moldovan flag, issued its seaworthiness certificates, and provided intermediary services that helped keep the ship at sea though it was riddled with serious defects.

Manoli’s connection to the Rhosus did not stop there. Records show that another of his companies, Geoship Company SRL, was responsible for officially registering the ship in Moldova, which has notoriously lax regulations for transparency, safety, and crewing.

Charalambos Manoli was born in 1960 in Famagusta, a coastal city in what is now the Turkish- controlled part of Cyprus. After studying shipbuilding in Scotland, he returned to Cyprus to work as a ship inspector, and went on to found multiple shipping companies.

Manoli is best known in Cyprus for his role in local football. From 2014 to 2017, he headed Anorthosis Famagusta FC, one of the country’s most popular teams. In 2015, he unsuccessfully ran for the leadership of the Cyprus Football Association.

In 2002, Manoli established Acheon Akti Navigations Limited, a Limassol-based ship management company. In 2007, he established another firm, Interfleet Shipmanagement Limited.

A Georgian company then owned by Manoli, Maritime Lloyd, acted as the ship’s “classification society” — a body responsible for certifying that ships are seaworthy. The company was sold in 2019.

In late July 2013, Maritime Lloyd issued a certification claiming the Rhosus had been safely constructed, inspection records show. But just days later, port inspectors in Seville detained the ship, citing 14 defects, including problems with its auxiliary power system. The headquarters of Charalambos Manoli’s ship management company, Acheon Akti, in Limassol, Cyprus. Credit: OCCRP

Solving that latter problem was key to getting the Rhosus back at sea one last time — and it was another of Manoli’s companies that did it. In August 2013, two months before the ship set off on its final voyage from Batumi, Manoli’s Cypriot ship management company, Acheon Akti acted as an intermediary to rent a new generator from international equipment rental firm Aggreko, a company representative said by email. The unpaid hiring cost for this generator would become one of the debts that stuck the Rhosus at the Beirut port.

According to Cardiff University’s Sampson, the complex web of companies around the Rhosus was typical of those used to minimize costs and shield owners from accountability.

“If you’re sailing a ship that you know is unseaworthy then you have an incentive to hide your identity,” Sampson said.

“The fact that it appears that the owner of the Rhosus actually owns the classification society which issued the ship with its certificate of seaworthiness — I’d say that means that the certificate isn’t worth anything, really.” Two pages from a 2011 loan from FBME to Manoli to purchase the MV Sakhalin. Credit: OCCRP

Court records in Cyprus and documents obtained by OCCRP also reveal that, just two years prior to the Rhosus’ final voyage, the ship’s owner, Manoli, took out a $4 million loan from FBME. The Tanzania-registered financial institution operated mainly via its branch in Cyprus, which has since been shuttered for allegedly acting as a major banker for groups and individuals connected to organized crime, terrorism, and weapons profilferation.

Manoli took out the loan in October 2011 to finance the purchase of another ship, the MV Sakhalin, the records show. Just a month later, a Belize company owned by Manoli, Seaforce Marine Limited, missed the first repayment, court records show. Manoli responded by offering up the Rhosus as additional collateral. In March 2012, FBME secured a freeze on Manoli’s Cyprus real estate holdings after hearing that he intended to sell the Rhosus.

Internal FBME records obtained by OCCRP show that over US$962,000 of Seaforce’s debt was still unpaid as of October 5, 2014, meaning the debt was still current when the Rhosus made its journey.

There is no evidence linking Manoli’s debt to FBME with the circumstances surrounding the Rhosus’ last journey. The existence of the loan, however, shows that Manoli had dealings with a bank that would soon become notorious as a clearing house for dirty money.

Founded by the Lebanese Saab family, FBME effectively went out of business after being sanctioned in mid-2014 by the US government. Among FBME’s clients, according to the U.S. Treasury, was a financier for Hezbollah, as well as an associate of the Lebanese Shiite militant group and his company in Tanzania. Another FBME customer was an alleged front company for Syrian efforts to acquire weapons of mass destruction. Although the Rhosus was offered to FBME as collateral, it was never used for that purpose, both Manoli and the bank told OCCRP.

“The MV Rhosus was never collateral for the loan and FBME Bank never had any involvement either with its financing or ownership,” the bank said in a statement.

It confirmed that it had made the loan to Manoli’s Seaforce for the purchase of the MV Sakhalin.

“Neither Mr Manoli nor SeaForce Marine Ltd made any repayments towards the loan, and the Bank initiated legal proceedings against them. Since the Administrators took over the Bank in July 2014, we are unaware of the current status of the case.

In a series of interviews, Manoli gave reporters changing accounts of the ship’s ownership. He initially claimed that his Panama company, Briarwood, had sold the ship to Grechushkin’s Teto Shipping in May 2012.

When later presented with documents that showed Briarwood still owned the ship — and that it had merely been leased to Teto Shipping — Manoli revised his statement. He acknowledged that Briarwood had indeed leased the Rhosus to Teto Shipping in 2012. But he claimed that later, in August 2013, just before the ship’s last voyage, he had transferred all the shares in the Panama company to Grechushkin, making the Russian the effective owner of the ship.

Manoli agreed to allow reporters to view documents showing a share transfer or a contract of sale, but subsequently refused reporters’ attempts to set up a video call to do this.

Manoli also sought to distance the ship’s owner — who he claimed was Grechushkin — from culpability in the explosion.

“The cargo went to Lebanon in 2013. Not now. They confiscated the man’s ship over there. And he declared bankruptcy because of the confiscation of the ship,” he said by phone. “Given this, what’s the responsibility of this man if Lebanese authorities didn’t properly store this fertilizer?”

Manoli denied there was any conflict of interest in his operating the companies that helped register and certify the Rhosus.

Registry documents also show that the Panama company that owned the Rhosus, Briarwood, maintained its mailing address at a now-defunct company in Bulgaria, named Interfleet Shipmanagement. The owner, Nikolay Petrov Hristov, confirmed that the company was a junior partner of a Cypriot firm of the same name owned by Manoli.

Hristov claimed he froze the Bulgarian company in 2012 after Manoli got him involved with the Sakhalin’s FBME loan without his knowledge.

Manoli, however, said that Bulgaria’s Interfleet Management had nothing to do with Sakhalin other than “technical management.”

One Last Stop

While OCCRP’s investigation shows that Grechushkin didn’t own the Rhosus, he was involved in much of the vessel’s direct operation. The ship’s captain at the time of its last journey, says Grechushkin personally ordered him to dock the Rhosus in Beirut on its way to Mozambique.

The stated reason for the last-minute stop, according to the captain, Boris Prokoshev, was to pick up trucks and other cargo in order to pay for passage through the Suez Canal. But the plan was scrapped after the first truck loaded onto the vessel almost damaged its deck, Prokoshev said.

The route traveled by the Rhosus on its last journey from Batumi, Georgia, to Beirut. Credit: Edin Pašović.

This account is backed up by a document obtained from Lebanon’s Ministry of Public Works and Transport.

Grechushkin soon abandoned the ship. Captain Prokoshev and three crew members, however, would spend the next 10 months trapped aboard the vessel by Lebanese authorities as creditors pursued Grechushkin for his debts. Lebanese inspectors who boarded the vessel in April 2014 said the crew had almost no food or money, and garbage was piling up on deck.

Correspondence held by Lebanese authorities show that on at least one occasion, in March 2014, Grechushkin did try to rescue the crew. Captain Prokoshev, however, complained soon afterwards that Grechushkin’s company had stopped paying their salaries and was avoiding all communication with them.

Lebanese authorities and the ship’s creditors apparently had no idea that Manoli was the owner of the ship. Neither Manoli nor his companies are mentioned in any Lebanese court documents obtained by reporters. Nor is there any indication that any attempt was made to contact him.

The Mozambique Connection

The owners of the Mozambican factory that ordered the ammonium nitrate did not attempt to retrieve the cargo after the Rhosus was seized.

Documents obtained by OCCRP show that the factory, Fabrica de Explosivos de Mocambique, is part of a network of companies with connections to Mozambique’s ruling elite. The companies had been investigated for illicit arms trafficking and supplying explosives to terrorists. The bill of lading for the Rhosus’ ammonium nitrate shipment. Credit: OCCRP The factory is 95-percent owned by the family of the late Portuguese businessman Antonio Moura Vieira, through a company called Moura Silva & Filhos.

In an email, Antonio Cunha Vaz, a spokesman for Fabrica de Explosivos, said it had ordered the ammonium nitrate through Savaro Limited. When the shipment never arrived in Mozambique, they simply placed another order.

Moura Silva & Filhos was previously investigated for allegedly supplying explosives used in the 2004 train bombings in Madrid that killed almost 200 people. The following year, after receiving a tip from Spanish authorities, Portuguese police raided four warehouses belonging to the company, seizing 785 kilograms of explosives allegedly concealed from its inventory system.

The company is also linked to Mozambique’s first family and military. Fabrica de Explosivos’ current head, Nuno Vieira, has since 2012 been the business partner of Jacinto Nyusi, the son of Mozambican President Filipe Nyusi, with whom he owns an events and marketing company.

The same year, Vieira, together with Mozambican state investment company Monte Binga and the country’s secret service, founded Mudemol, a munitions and explosives manufacturer that supplied the military. Filipe Nyusi was the minister of defense at the time. Monte Binga has since been flagged by the United Nations for allegedly breaking international sanctions by involving itself in military deals with North Korea.

The explosives factory that was meant to receive the Rhosus’ cargo also shares an address with ExploAfrica, a company co-owned by the Vieira family. Confidential corporate and government documents shared by the Conflict Awareness Project, a U.S.-based nonprofit, show that ExploAfrica and its affiliates were investigated by South African and Portuguese authorities for obtaining U.S. and Czech weapons that later ended up in the hands of rhino and elephant poachers in South Africa’s Kruger National Parks on the border with Mozambique.

A South African front company that was allegedly used to buy the weapons, Investcon, is closely tied to Maputo-based Bachir Suleman, designated by the US government as an alleged “drug kingpin”.

In an email, Antonio Cunha Vaz, a spokesman for Fabrica de Explosivos, said that staff members from Moura Silva & Filhos were interrogated by police but were cleared of any wrongdoing. He said the company’s business links to the Mozambican president’s son were transparent, and denied any connection to alleged drug kingpin Suleman.

“All the deals made by ExploAfrica were perfectly legal and …If there was any use of weapons for purposes not complying to the law, ExploAfrica is not responsible for them,” Cunha Vaz added. Firefighters spray water in the aftermath of the August 4 explosion. Credit: Mohamed Azakir / Reuters

The Middleman

While the Mozambican factory made no apparent effort to claim the material, another company did: the trading firm that acted as a middleman in the deal.

Company records show that the middleman, United Kingdom-based Savaro Limited, ordered the ammonium nitrate at a time when it reported no official business activity to U.K. authorities. It has remained dormant since.

Savaro Limited is linked to another company called Savaro in the Ukrainian city of Dnipro, via a series of shareholders and directors in Cyprus and the United States. The Ukrainian company’s director is Vladimir Verbonol, a local businessman. He told OCCRP he had no connection to the shipment.

Court documents show that Savaro in February 2015 hired a Lebanese lawyer to petition a local court to inspect the quality and quantity of the ammonium nitrate then being held in the port warehouse. That expert report concluded that most of the one-ton bags containing the ammonium nitrate — approximately 1,900 — were ripped and had their contents spilling out.

A 2015 letter from the Lebanese lawyer for Savaro Limited asking to have the ammonium nitrate stockpile checked. Credit: OCCRP

The documents show that Savaro declined to carry out chemical testing of the ammonium nitrate, and there is no record of the company attempting to recover the material after that point.

In Savaro’s place, a new potential buyer was sought for the dangerous stockpile.

First the Lebanese Customs Department asked the country’s army to take it, but they refused, instead suggesting that it be offered to a local manufacturer, Lebanese Explosives Co, owned by businessman Majid Shammas. There is no record of the company accepting the offer.

The army then suggested simply sending the ammonium nitrate back to Georgia at the expense of the importer. This, too, never happened, for reasons that remain unclear.

By February 2018, Lebanese authorities appear to have given up on their efforts to offload the ammonium nitrate.

But the stockpile remained in an unsecured warehouse — an explosion waiting to happen.

In a July 20, 2020, report to the president and prime minister — just two weeks prior to the explosion — Lebanese security services warned that there were serious security flaws at the facility that left the ammonium nitrate open to theft.

One door of the unguarded warehouse was missing, while there was also a hole in the southern wall, the report said.

“In case of theft, the thief could turn these goods into explosives,” the report warned.

According to three European intelligence sources investigating the blast, who spoke to reporters on the condition of anonymity, the amount still stored in the warehouse by August may have been smaller than the initial 2,750 tons. They said the size of the explosion was equivalent to as little as 700 to 1,000 tons of ammonium nitrate.

But the blast was big enough to destroy large parts of eastern Beirut. It was one of the strongest non-nuclear explosions ever recorded.

–

Reporting by Aubrey Belford, Rana Sabbagh, Stelios Orphanides, Sara Farolfi, Eli Moskowitz, Sarunas Cerniauskas, Antonio Baquero, Roman Shleynov, Riad Kobeissi, Diana Mukalled , Eman Qaisi, Giannina Segnini, Ana Poenariu, Atanas Tchobanov, Assen Yordanov, Ion Preasca, Yanina Korniienko, Dmitry Velikovsky, Karina Shedrofsky, Khadija Sharife, Nino Bakradze, Aderito Caldeira, Juliet Atellah, Alexey Kovalev, Fritz Schaap, and Christoph Reuter.

This story was produced in collaboration with Daraj.com (Lebanon), ARIJ.NET (Jordan), Meduza (Russia), iStories (Russia), Der Spiegel (Germany), RISE Moldova, RISE Romania, Bivol (Bulgaria), ifact.ge (Georgia), aVerdade (Mozambique)

Published by the good folks at The Elephant. The Elephant is a platform for engaging citizens to reflect, re-member and re-envision their society by interrogating the past, the present, to fashion a future.

They Are Watching You: Israeli-Made Spyware Used to Monitor Journalists and Activists Worldwide

By OCCRP

In March 2017, Guatemalan fishermen noticed that some parts of the country’s largest lake had turned a strange reddish colour. Fearing that the apparent pollution would scare customers away from buying fish, they asked the local government to investigate.

Lake Izabal is near the Compañía Guatemalteca de Níquel mine, which is owned by the Switzerland- based Solway Group. After weeks passed with no response, the locals became desperate. Hundreds of protestors from the closest town of El Estor blocked the roads that led to the mine, preventing ore deliveries to the port of Puerto Barrios. About 41 per cent of the nickel mined was slated for export to Ukraine.

Twelve days into the blockade, on May 27, clashes broke out after the government broke an agreement to meet with the fishermen. Riot police fired tear gas and dispersed the protesters; multiple gunshots were reported.

Fisherman Carlos Coc Maaz was shot and killed that day. His lifeless body lay on the road for hours, according to his widow, Cristina Xol Pop. “We called the prosecutor’s office to pick up his body, but they didn’t arrive,” she told Forbidden Stories. “He had already spent half a day lying on the ground, so we picked him up. We took him home.”

The prosecutor of the Human Rights Office, Hilda Pineda, told reporters that an investigation about possible police involvement was ongoing. Authorities initially denied that anyone was killed that day, but local journalists Carlos Choc and Jerson Xitumul with Prensa Comunitaria took photos and a video showing that a protestor had indeed been shot.

Barely a month after the clashes, the prosecutor’s office accused the journalists, along with five fishermen, of six offences: threats, instigation to commit a crime, illicit association, illicit meeting and demonstrations, damages, and illegal detention. According to the indictment, the reporters allegedly participated in a protest in which four Solway workers were held illegally for several hours.

Xitumul was arrested, and both journalists faced harassment and threats.

At least 13 journalists have been killed while reporting on environmental stories around the world in the past decade, and 16 more suspicious deaths are being investigated, according to the U.S.-based Committee to Protect Journalists. Forbidden Stories – a consortium of 40 journalists from 15 media outlets, including OCCRP – also found that journalists investigating environmental issues often face arrest, harassment and violence.

“When journalists are reporting on environmental issues, they are often reporting on companies or corrupt actors who are in complete alliance with the government,” says Bruce Shapiro, executive director of the Dart Center for Journalism and Trauma.

“This means that their enemies become some of the most dangerous people in the world, and I’m hard put to think of a category of investigative reporters who are routinely dealing with more dangerous actors than environmental journalists,” Shapiro says.

In Choc’s case in Guatemala, a group of armed men attacked his sister’s home and started shooting. The journalist went into hiding for several months and was forced to sell his camera and motorbike to support his family. He kept the computer where he stores his work.

Trouble in Tanzania

Forbidden Stories conducted investigations in Guatemala, India and Tanzania this year to report on the dangers journalists face when reporting on multinational mining companies. In Tanzania, local and foreign journalists have struggled to report on the impact of a remote gold mine owned by Acacia Mining, whose majority shareholder is Canadian mining industry giant Barrick Gold Corp.

“The North Mara Gold Mine is more than a thousand kilometres from Dar es Salaam, where almost the entire press is [based], and therefore it is very difficult to have reporters keeping [tabs] on what is happening in these remote places,” said Tundu Lissu, a Tanzanian opposition politician and lawyer who previously represented small-scale miners in the region.

Residents near the mine have suffered from the environmental consequences of gold mining for more than a decade. The industrial mining techniques produce harmful heavy metals, high levels of which have been found in the local water supply.

Mark Nega, who worked in the area as a district medical officer in 2013, said he saw about six patients apparently affected by the water near the mine. “They go to wash [in] that water [near] the mining area and they get [a very bad skin reaction].”

In 2009, a study found high levels of heavy metals and cyanide in the mine’s vicinity. Heavy metals such as arsenic, cadmium and lead are frequently found near gold mining sites in elevated concentrations.

In May, authorities fined Acacia Mining $2.4 million for allegedly violating the country’s environmental regulations and for failing to comply with government directives to fix the mine’s leaking tailings storage facility where waste is kept.

Locals have also alleged human rights abuses for years.

Samuel Muchugu Wambura, a father of six from Kerende village, was killed in 2016 by an officer of the Tanzanian police force, which contributes to the mine’s security, after he crept onto the property searching for gold. Local artisanal miners lost their primary source of income in 2002 when the North Mara Gold Mine began commercial production.

Wambura’s death came about two years after Acacia Mining settled out of court with people from the region who sued the company over alleged injuries and fatalities at the mine, and after Acacia announced its commitment “to promoting human rights and appropriate conflict resolution practices.”

In a statement, Barrick Gold said it doesn’t exercise operational control over Acacia and that it encourages those who do to implement policies and programmes in line with the U.N. Guiding Principles on Business and Human Rights.

Acacia told Forbidden Stories that “the Mine has not yet received any supporting reports, findings or technical data in relation to the environmental protection order or the recent statements by the Minister of State in the Vice President’s Office for Union Affairs and Environment or the Minister for Minerals.”

Tanzania’s Minister in the Vice President’s Office for Union Affairs and Environment, January Makamba, told OCCRP that part of the blame for the mine’s negative impact on neighbouring communities lies with the government.

“It’s been ten years [since we noticed the problem] and the tailing storage facility is still polluting, is still seeping,” he said, referring to the Acacia waste storage facility that was sanctioned. “We have a bit of responsibility and part of our blame is to consistently believe what the mine was telling us.”

Makamba placed most of the responsibility with Acacia, whose “non-compliance, over a long period of time, of government’s directives […] have been all ignored,” he said.

A difficult environment for journalists

But the government has also created a difficult environment for journalists to act as watchdogs. In Tanzania, press freedom has been on the decline, especially since the election of President John Magufuli in 2015. The country currently ranks 118th out of 180 on Reporter Without Borders’ World Freedom Index, dropping 43 places since 2015.

Tanzania’s 2015 Cybercrimes Act authorised imprisonment for at least three years, a fine of not less than 5 million Tanzanian shillings ($2,175), or both for knowingly publishing information or data deemed “false, deceptive, misleading, or inaccurate,” which has led to prosecutions of reporters and regular citizens.

“Since coming into force, the law has been invoked to persecute dozens of individuals and journalists,” civil society groups wrote in a 2018 statement to the president. “In one week alone, five private citizens were charged under the Cybercrimes Act for statements made on Facebook, WhatsApp and other social media platforms, including a three-year sentence handed down to a private citizen for insulting President John Magufuli on Facebook.”

In March, the East African Court of Justice ruled that parts of Tanzania’s 2016 Media Services Act — which civil society groups say allows the government to decide who is a journalist and which criminalises defamation and so-called sedition — violate the East Africa Community treaty’s commitment to good governance, principles of democracy and the rule of law. The court directed Tanzania’s government to bring the Act in line with the treaty.

“There is great fear among journalists nowadays – especially those who criticise the government,” says Jabir Idrissa, a journalist from Zanzibar, an island off the coast of Tanzania. Around two years ago he was working for the Swahili-language weeklies MwanaHalisi and Mawio, both of which have since been banned by the government and are part of the same newspaper group. In 2009, he started to report on environmental pollution in Tarime, the district where the North Mara gold mine is located.

“We had a long discussion in the newsroom when we were choosing which stories to [go] with,” Idrissa says. Reporting on them was deemed risky because “the top big shots did not want the public to know about it – what was inside the contracts between Acacia and the government.” Even so, they went ahead and published. “Journalism is a job of telling the truth to the people,” he says.

In June 2017, Mawio published an article linking two former presidents to alleged irregularities in mining deals decades earlier. The same day, Tanzania’s minister of information, culture, arts and sports, Harrison Mwakyembe, banned the newspaper for two years.

The editor-in-chief of Mawio, Simon Mkina, told a news agency that he began receiving threatening phone calls. Idrissa lost his job and was unable to find work in journalism again. He started working in a clothing shop in Zanzibar so he could support his children.

Forbidden Stories has identified a dozen journalists who have been arrested, threatened or censored by Tanzanian authorities for reporting on mining.

“In emerging economies where people depend on natural resources and those natural resources are very valuable to industry or to the government, that can become a very dangerous situation for journalists who are covering the extraction of those natural resources,” said Meaghan Parker, executive director of the U.S.-based Society of Environmental Journalists.

‘A real chilling effect’

The problems of mining-related pollution and journalistic risk aren’t confined to Africa and Latin America. Indian businessman S. Vaikundarajan heads V.V. Mineral, which extracts more beach sand than is allowed by his company’s permit in India, according to an expert report submitted to the Madras High Court.

“About, say, 85 percent to 90 percent of beach sand mining, legal and illegal, is monopolised by this one family,” says Sandhya Ravishankar, a journalist based in the southern state of Tamil Nadu, where illegal sand mining is rampant.

Forbidden Stories has identified a dozen journalists who have been arrested, threatened or censored by Tanzanian authorities for reporting on mining.

In a statement to Forbidden Stories, S. Vaikundarajan indicated that “stoppage of mining until the inspection is completed does not amount [to a] ban of mining.” Regarding the expert report filed in court, Vaikundarajan indicated that “all the allegations made … is without any basis and not in accordance with [the] law.”

It is estimated that between September 2013 and 2017, over 2 million metric tonnes of sand minerals were exported from Tamil Nadu, despite a temporary ban on sand mining in the state, according to the report. Importers included construction material companies from around the world, including from the United States and Germany.

In a report published in May, the U.N. Environment Programme said that sand “extraction in rivers has led to pollution, flooding, lowering of water aquifers and worsening drought occurrence.”

Ravishankar started reporting on illegal beach sand mining in 2013. After she published an investigation in India’s Economic Times in 2015, a defamation suit was filed within hours, she says, and together with the newspaper she was personally named as a defendant.

Ravishankar struggled to find an outlet that would publish further reporting, at least until 2017 when the Indian non-profit news website The Wire finally published her investigation.

The journalist says she received threatening phone calls, was followed, and had CCTV footage of her meeting a source posted on the Internet. In a letter to the Chennai City Commissioner of Police dated Sept. 24, 2018, Ravishankar wrote that she had “strong reason to believe that a senior IPS [Indian Police Service] officer is colluding with the mining mafia in order to follow me, film and photograph me.”

Despite the intimidation, Ravinshakar says “not for a second” did she think about stopping the investigation.

Such tactics and attacks on journalists reporting environmental stories can have “a real chilling effect,” says Saul Elbein, an American journalist who has reported on murders of environmental journalists for the Pulitzer Center on Crisis Reporting.

“As more and more of the world lurches toward environmental crisis, there is less and less meaningful reporting coming out of the rural places where environmental crime happens,” Elbein told Forbidden Stories. “The lights, in other words, are going out just as they’re most needed.”

Published by the good folks at The Elephant.

The Elephant is a platform for engaging citizens to reflect, re-member and re-envision their society by interrogating the past, the present, to fashion a future.

They Are Watching You: Israeli-Made Spyware Used to Monitor Journalists and Activists Worldwide

By OCCRP Published by the good folks at The Elephant.

The Elephant is a platform for engaging citizens to reflect, re-member and re-envision their society by interrogating the past, the present, to fashion a future.

They Are Watching You: Israeli-Made Spyware Used to Monitor Journalists and Activists Worldwide

By OCCRP Published by the good folks at The Elephant.

The Elephant is a platform for engaging citizens to reflect, re-member and re-envision their society by interrogating the past, the present, to fashion a future.