New research paints a bleak picture of industrial-scale surveillance threats
Image: Matthew Henry @matthewhenry via Unsplash
Digital surveillance of journalists and human rights defenders has gone industrial. This is one of the key findings of a new investigative study by digital security and digital rights expert Samar Al Halal, produced for the International Federation of Journalists (IFJ).
The report, released by the IFJ on 28 April, points out that what was once the exclusive domain of military intelligence is now a thriving commercial industry, with sophisticated spyware such as Pegasus, Predator and Graphite repackaged as “lawful interception” technology and sold to governments around the world — democracies and authoritarian regimes alike. These tools silently penetrate phones, read encrypted messages, activate microphones, and extract data in real time.
The scale is staggering. The 2021 Pegasus Project revealed that at least 180 journalists across more than 20 countries had been selected for targeting by Israel’s NSO Group. But spyware is only one layer of the threat. Telecoms engineers are routinely bribed or coerced to hand over call data, fake cell towers track reporters at protests, and entire social media profiles are scraped to build behavioural maps of journalists before any direct attack. “The combined result,” the report points out, “is a new normal in which surveillance is constant, often invisible, and increasingly normalised.”
Most journalists have no idea they were targeted until they obtain confirmation of infection from specialised organisations with forensic laboratories, such as Citizen Lab, Access Now’s Digital Security Helpline or Amnesty International’s Security Lab. This tends to take place months or even years after the attack. By then it is often too late, after sources have already been compromised.
These organisations are thin on the ground and overstretched, and most newsrooms, especially in the Global South, do not have the capacity to detect spyware. “This scarcity of technical support leaves journalists in the Global South particularly vulnerable,” the report concludes.
The freedom of expression implications are profound. The Reporters Without Borders Press Freedom Index 2025 now ranks surveillance among the top three threats to journalists' safety worldwide. When reporters suspect every call may be monitored, they withdraw from investigative work and drop sources. Sources, in turn, refuse to talk.
“The sense of exposure produces psychological exhaustion and widespread self-censorship,” the report points out. “Reporters avoid sensitive topics or drop investigations altogether, undermining public trust in the press and the confidence of crucial sources.” As Hungarian journalist Szabolcs Panyi, targeted by Pegasus, told the researchers: “Who the hell wants to talk to me after this? ... I feel ashamed to not be able to possibly protect some of them.”
Basic digital hygiene and countermeasures, such as encrypted messaging and secure storage, remain essential. But these steps are insufficient as long as spyware exports remain poorly regulated, civilian oversight is weak, and political and legal accountability lacking.
The report concludes that defending freedom of expression now demands not just encryption, but collective advocacy to ensure transparency in spyware purchases, accountability in its use, and the integration of cyber security courses in journalism training. “Unless these steps are taken,” it warns, “the ability of journalists to investigate power – and of societies to know the truth – will continue to erode quietly, line by line, byte by byte.”
The report’s verdict is stark: “Each unprotected journalist weakens collective truth. Each secured newsroom strengthens democracy.”
The full report can be found here:
