Yusuf al-Jamri had every reason to believe he was safe when he arrived in Britain in October 2017 and applied for asylum protection.
The 41-year-old Bahraini activist had experienced sporadic periods of detention and torture beginning at the age of 16, when he was first held for five months without charge. In 2011, during the Arab spring, al-Jamri faced regular questioning and harassment by authorities because of his work as a protest organiser. But it wasn’t until 2017 – after multiple episodes of detention; alleged torture by Bahrain’s notorious intelligence agency, the National Security Apparatus; sexual assault; interrogations; and threats of rape – that he decided to flee Bahrain with his family.
“It was not a light decision to take. I was a civil servant in Bahrain and I was surrounded by loving family. All of this has gone and I had to start a new life in the UK,” al-Jamri said. “The UK authorities granted me asylum and this gave me a real sense of safety.”
Now, legal filings suggest that the activist’s belief that he was out of harm’s way was short-lived. Al-Jamri, who has not left the UK since his arrival, has taken preliminary steps towards filing legal action in England against the government of Bahrain and NSO Group, the Israeli spyware company, after the discovery that his phone was infected with Pegasus, the military-grade spyware made by NSO, in August 2019.
Lawyers acting for al-Jamri have alleged in pre-claim letters to the government of Bahrain and NSO that the hacking, which was verified by researchers at the Citizen Lab at the University of Toronto, led to personal injury, distress, anxiety and a loss of privacy. Researchers have said the attack on the activist was targeted by servers connected to Bahrain, or a threat actor acting on its behalf.
The legal letter – a procedural step claimants take in the UK before formally filing a legal complaint – comes as NSO Group is already facing legal challenges in the US.
The company licenses its powerful Pegasus spyware to governments around the world. The software can hack into any phone undetected, enabling users to read encrypted messages and remotely control access to a phone’s camera and recorder. The company has claimed it only licences to governments and the technology is only meant to be used by them to track down serious criminal and terrorists, but dozens of cases documented by the Guardian and other media outlets have shown that the spyware has been used by authorities to hack the mobile phones of dissidents, journalists, political opposition leaders and diplomats.
Last year, the Biden administration put NSO on a blacklist after finding the company had acted “contrary to the foreign policy and national security interests of the US”. The company is being sued by WhatsApp in the US and by journalists at El Faro, the Salvadoran digital newspaper, who have also alleged they were targeted by authorities using the spyware.
A spokesperson for NSO declined to respond to specific allegations about the Bahrain case, but suggested in a statement that the legal claim was being brought by “politically motivated organisations intentionally releasing misleading information” and that the allegations were based on speculation as part of an “ongoing campaign against NSO”.
The spokesperson added: “NSO is a software provider. The company does not operate Pegasus, has no visibility into its usage, and does not collect information about customers or who they investigate.”
An analysis of al-Jamri’s phone suggests the hacking occurred days after al-Jamri began tweeting about a 26 July 2019 incident in which police in London took the unusual step of forcibly gaining entry into the embassy of Bahrain in order to save a protester who had climbed on the roof and alleged he was assaulted. The rooftop activist, Moosa Mohammed, was protesting against executions that were taking place in Bahrain that were widely condemned by human rights activists.
About 2 million people saw al-Jamri’s tweets about the executions between the 26 and 28 of July. He was hacked, experts claim, between 3 and 5 August that year.
For surveillance experts, the case exemplifies how spyware offers authoritarian regimes and some democracies the ability to track protesters and political opponents around the world.
“These sorts of technologies allow governments to reach far past their borders,” said Bill Marczak, a researcher at Citizen Lab who worked on al-Jamri’s case. “Physical distance is no guarantee of safety.”
The legal action follows a separate ruling in August in which a British judge ruled that a case against the kingdom of Saudi Arabia brought by a dissident satirist in London who was targeted with spyware can proceed, rejecting Saudi’s attempt to have the case dismissed on sovereign immunity grounds.
It also comes as the UK government itself has failed to take any public action against NSO or any of the company’s foreign government clients that are believed to have targeted the mobile phone numbers of UK-based individuals.
“Yusuf has undertaken a heroic action by taking on both the Bahraini government and NSO Group and starting the process of launching a lawsuit against them, despite the grave risk of reprisals for himself and those close to him,” said Sayed Ahmed Alwadaei, director of advocacy at the Bahrain Institute for Rights and Democracy.
“It is the right decision to take. While there is a precedent set by UK courts which gives individuals the right to sue states for hacking their devices, the case against NSO Group is yet to be tested.”
Maryam al-Khawaja, a Bahraini human rights activist who lives outside the kingdom, and whose father, Abdulhadi al-Khawaja, is in prison in Bahrain, said the hacking of al-Jamri’s phone illustrated his importance as an activist and purveyor of information about what is happening inside Bahrain through his network of sources, especially as independent news outlets have stopped reporting out of the country.
Noting attempts by the government to paint a picture of Bahrain as having adopted reforms, she said: “People like Yusuf are really making it difficult for the Bahraini government to make themselves look better internationally. That’s where the hacking comes into place.”
A Bahrain government spokesperson declined to comment on specific questions about al-Jamri’s case. But said in a statement: “The kingdom of Bahrain will continue to comply with the rule of law and all its international legal obligations. Freedom of expression is a constitutional right and no one is detained because of their political views or activism. The government of Bahrain does not tolerate mistreatment of any kind and has put in place internationally recognised human rights safeguards, including the establishment of independent bodies to conduct investigations and undertake periodic inspections of prison conditions and inmates’ welfare.”
The US state department’s 2021 human rights report into Bahrain found that significant human rights issues in Bahrain have included credible reports of torture, arbitrary detentions, serious restrictions on freedom of movement and unreasonable restrictions on political participation.
