Thailand must thoroughly investigate the use of the invasive Pegasus spyware found on the phones of dozens of activists, Amnesty International said today, after a new report identified 30 people who were targeted or infected with the harmful software, the first time its use in the country has been confirmed through technical analysis.

The joint report by the Thai NGO iLaw, Digital Reach and The Citizen Lab found that the infections spanned 2020 to 2021 and involved prominent individuals leading the mass pro-democracy protests, which called for major political and economic reforms, as well as academics and human rights defenders who have publicly criticised the Thai government.  

These findings stemmed from alarming notifications sent by Apple to many Thai activists that they had been targeted with the spyware in November 2021. Amnesty’s Security Lab independently confirmed five of the cases in the report through forensic analysis.

According to the report, Pegasus spyware was found on the phones of leading Thai protest organizers, including Arnon Nampa, Benja Apan and Panusaya Sithijirawattanakul, also known as Rung, who authorities have targeted with multiple unwarranted criminal proceedings for peacefully exercising their rights to assembly and freedom of expression.  

NSO Group, the company behind Pegasus, claims that it only sells products to government intelligence and law enforcement agencies.  

States have binding obligations under international law to not only respect human rights, but also to protect them from abuse by third parties, including private companies.

Amnesty continues to call for a global moratorium on the sale, transfer, and use of spyware until human rights regulatory safeguards that govern its use are in place.

Etienne Maynier, Technologist at Amnesty International, said:

“We can now officially add Thailand to the growing list of countries where people peacefully calling for change, expressing an opinion, or discussing government policies may trigger invasive surveillance with a profound toll on an individual’s freedom of expression, privacy, and sense of security.

“It is worth remembering that this is only what has been found so far, and the scale of surveillance attempts could be bigger and more damaging.

“Instead of listening and engaging with these protesters, academics, and human rights defenders, intrusive surveillance has been used to harass, intimidate, and target them in an attempt to break their spirit and create a society-wide chilling effect. These new revelations are a shocking example of just how low authorities might stoop to control peaceful dissent. 

“Thai authorities must launch an independent, prompt, thorough, and effective investigation into the use of Pegasus spyware and take necessary measures to foster a safe environment for civic engagement. Such measures must include the amendments of legislation enabling state surveillance, including the Computer Crimes Act, the Cybersecurity Act, and the National Intelligence Act in line with international human rights law, as well as implementing safeguards to protect the right to privacy and freedom of expression, association and peaceful assembly.”