A phone linked to No 10 Downing Street was targeted by powerful spyware which can turn mobiles into 24/7 listening devices, according to reports.
According to researchers, the security breach occurred on July 7 2020, almost a year into Boris Johnson’s time as Prime Minister.
Citizen Lab, a research group based at the University of Toronto, also said that phones connected to the Foreign Office were hacked using the Pegasus spyware on at least five occasions, from July 2020 to June 2021.
The group claimed the United Arab Emirates was likely behind the Downing Street hack, based on an analysis of the servers used.
However, researchers were not able to identify the specific people within No 10 and the Foreign Office whose phones they alleged had been hacked.
The claims were first reported in the New Yorker magazine.
The magazine reported that Britain’s National Cyber Security Centre tested several phones at Downing Street, including Boris Johnson’s, but were unable to locate the infected device or determine the nature of any stolen data.
“When we found the No. 10 case, my jaw dropped,” John Scott-Railton, a senior researcher at the Citizen Lab, told the publication.
“I’d thought that the US, UK, and other top-tier cyber powers were moving slowly on Pegasus because it wasn’t a direct threat to their national security.
“I realised I was mistaken: even the U.K. was underestimating the threat from Pegasus, and had just been spectacularly burned.”
A researcher with the group, Ron Deibert, said the alleged hack of Foreign Office phones could have been related to “FCO devices located abroad and using foreign SIM cards”.
A government spokesperson said it did not routinely comment on security matters.
The Pegasus software was developed by the Israeli company NSO Group and has the capability to infect phones running both Android and iOS systems.
The group has claimed it keeps strict control over how the software is used, with staff having oversight on what information is collected.
A spokesperson told media: “The information raised regarding these allegations are, yet again, false and could not be related to NSO products for technological and contractual reasons.
“NSO continues to be targeted by a number of politically motivated advocacy organisations, like Citizens Labs and Amnesty, to produce inaccurate and unsubstantiated reports based on vague and incomplete information.”
