Predator, Pegasus and stock Android
A few years ago, I decided to switch from custom Android ROMs to the official Android version provided by Google. At the time, I was using GrapheneOS, which, from a user experience perspective, is a clean version of the Android Open Source Project with Google services removed for security reasons. Aside from getting older and starting to prefer more out-of-the-box solutions, my main motive was that, from a surveillance and security perspective, it started to seem —at least to me—a more secure choice. First, I no longer had to rely on exhaustively searching for apps and features that might come from unchecked sources. I used to install some apps from GitHub repos, which is fine, but it required time and effort to confirm the validity of the sources. Second, I could avoid the somewhat laborious process of updating the OS, often with delays of many days. In no way do I undervalue such open-source communities, and I still consider switching back from time to time. But the main benefit of switching is that, despite the commercial, personally targeted ads and constant tracking, it seems more secure against state-initiated or other exploits, which are more common than ever.
In Greece, in 2022, the national intelligence service, EYP, was accused of mass wiretaping of public figures, many of whom were targeted along with spyware known as Predator. Now it’s Italy’s turn, it seems, where some 90 people have been targeted via a WhatsApp group using Paragon’s (another Israeli “security” firm) Pegasus program. Among them is an investigative journalist who reported on young fascists in Meloni’s party, as well as activists like Luca Casarini, the founder of the NGO Mediterranea Saving Humans and also known as one of the prominent members of the Tutti Bianchi and the anti-globalization movement. The interesting fact is that Paragon offers its products only to governments and decided to end the contract with the Italian government. Spyware is alarmingly being used by governments to spy on political opponents, and the Greek case shows additionally that if there are no consequences, it will only get worse over time.
And what connects these two stories? Of course, I don’t consider myself a target of state actors, but Google’s report on protecting Android users from zero-day attacks, which in turn confirmed the Greek Predatorgate scandal, definitely played a role in my decision to outsource some of my security concerns.