Thai activists sue government agencies for allegedly using Pegasus spyware against them

BANGKOK — Two prominent Thai activists filed a lawsuit on Tuesday accusing the government of using the internationally notorious Pegasus spyware to infiltrate their mobile devices during a period of political unrest almost three years ago.

Law reform advocate Yingcheep Atchanont and human rights lawyer Arnon Nampa accuse nine state agencies in the administration of Prime Minister Prayuth Chan-ocha of unlawfully violating their privacy by spying on their smartphones using the spyware produced by the Israeli-based cybersecurity company NSO Group.

They requested an immediate court injunction barring the use of Pegasus against them and other citizens, and for the court to order the government to release the data on its use of Pegasus. They also demanded compensation of 2.5 million baht ($72,000) each.

Pegasus spyware can be installed remotely onto a target’s phone without the target having to click any links or download software to become infected. It can obtain any data on the devices, including contact lists and group chats, making it very useful for surveillance of political activists and groups.

NSO Group’s products, including the Pegasus software, are typically licensed only to government intelligence and law enforcement agencies to investigate terrorism and serious crime, according to the company’s website. Cybersecurity researchers have tracked the use of the spyware in 45 countries and claim those guidelines are not always honored.

The company has rejected accusations that its snooping software helped lead to the killing of U.S.-based Saudi journalist Jamal Khashoggi at the Saudi consulate in Istanbul in 2018, perhaps the highest-profile accusation of its abuse so far. It maintains that its sales involve a rigorous ethical vetting process, and that Pegasus spyware is sold to governments only for security purposes.

The U.S. government has blacklisted the NSO Group, and iPhone maker Apple Inc. sued the company in 2021. Apple notified Pegasus victims and several government critics in Thailand received a warning email from Apple that they had potentially been targets of “state-sponsored attackers” during that time.

Among the agencies named in the Thai lawsuit are the Office of the Prime Minister, the Royal Thai Police, the Digital Economy and Society Ministry and the three branches of the military. Asked about the lawsuit, the prime minister’s office and the national police agency declined to comment, saying they were unaware of it.

The lawsuit alleges that Yingcheep’s phone was penetrated at least 10 times by the spyware, while Arnon’s was attacked at least five times from late 2020 to late 2021. That's when pro-democracy protests erupted across Thailand demanding Prayut’s resignation and sweeping reform of several institutions, including the monarchy, which conservative elements of Thai society consider sacrosanct..

An investigation last year by international internet watchdog groups including Canada’s Citizen Lab found at least 30 individuals in Thailand, many of them activists and scholars, were targeted by government surveillance using Pegasus during that period.

Yingcheep, director of non-profit Internet Law Reform Dialogue or iLaw, is a staunch critic of what many consider to be repressive laws issued under the government led by Prayuth, who as army commander in 2014 led a coup ousting an elected government. Arnon is one of the most outspoken advocates for reform of the monarchy.

“You can see that this is one of the legacies of Prayuth Chan-ocha, who exercises absolutism through staging a coup without any accountability," Yingcheep said. “And the mechanism of checks and balances also doesn’t work.” Prayuth after staging the 2014 coup headed a junta that assumed near-absolute power. He became head of an elected government that began a four-year term in 2019.

In 2022, the spyware became a subject of censure debates. Opposition lawmakers accused Prayuth's government of spending millions of dollars from the national budget on spyware, including Pegasus, to spy on citizens.

In response, Digital Economy Minister Chaiwut Thanakamanusorn acknowledged Pegasus had been used by state agencies he did not identify for activities related to “security or narcotics.” He said his ministry does not have the authority to conduct surveillance, but “there are those with such authority.”