MPs and human rights groups have called on ministers and parliament to investigate how the ruler of Dubai was able deploy sophisticated spyware to hack the phones of his ex-wife and her legal team in Britain last summer.
Their demands follow the revelation of the spying scandal on Wednesday, which emerged after English courts concluded that agents of Sheikh Mohammed had infiltrated Princess Haya’s phone using controversial NSO Pegasus software.
Graham Stringer, a Labour member of the foreign affairs select committee, said that the body had previously inquired into “state interference in this country by China and Russia” and should now consider state-sponsored phone hacking.
“We should look at it as a Commons committee,” the MP said, adding that the British government also needed to undertake its own analysis of the fast growing practice of sophisticated mobile phone surveillance.
An investigation by the Guardian earlier this year discovered that 50,000 phone numbers had appeared on a leaked list who were believed to be persons of interest to government clients of NSO Group since 2016. At least 10 countries – including the UAE, of which Dubai is part – had entered numbers into the system.
Wednesday’s court rulings are the clearest example yet of Britons being targeted by NSO’s Pegasus spyware, which is sold to states for use against terrorists and organised criminals. It has the power to secretly take control of a person’s phone, stealing personal data or turning on the microphone to record its surroundings.
But there have been repeated criticisms that activists, journalists and lawyers were also being targeted by government security agencies using the technology, with 400 other UK numbers appearing in the leaked list having been selected by the UAE.
Others who were victims of the hacking campaign, the courts concluded, were Fiona Shackleton, a high profile divorce lawyer, and a senior colleague who both were advising Haya in an acrimonious legal battle with Sheikh Mohammed over the welfare of her two children.
Human rights watchdog Amnesty International said the “targeting of UK citizens and residents by NSO Group’s spyware” should now prompt urgent and public inquiries by both government agencies and parliamentary committees.
Danna Ingleton, deputy director of Amnesty’s technology unit, added: “Authorities in the UK – including parliamentary bodies – should conduct an immediate, independent, transparent, and impartial investigation.”
Former Whitehall insiders told the Guardian that there had been some concern about the growing availability of NSO’s spyware, but also a recognition that, in practice, little could be done once the technology had been sold.
There was an informal agreement not to sell the technology to countries opposed to the UK and other members of the Five Eyes intelligence network, but the UAE is considered an ally. If Pegasus is then misused against British targets, it was impossible to prevent, the insider added.
Publicly, the UK government only made a muted complaint. In its first statement since Wednesday’s court rulings, the Foreign Office said all countries should use cyber surveillance “in a way that is legal, responsible and proportionate”.
A government spokesperson added: “The UK-UAE bilateral relationship is strong” – and then highlighted last month’s visit of the country’s crown prince and ruler, Mohammed bin Zayed, to London, where he met prime minister Boris Johnson for a summit at Downing Street.
In response, Wera Hobhouse, the Lib Dems justice spokesperson, accused ministers of being complacent: “We need an urgent investigation into what exactly happened and how this scandalous act of phone hacking has been allowed to take place.”
Haya, who was Sheikh Mohammed’s sixth wife, fled Dubai for the UK in 2019 as their marriage broke down and she began to fear for both her and her children’s safety. The intense court battle that followed made her increasingly feel under threat.
“It feels like the walls are closing in on me,” Haya said in a witness statement to the court. “I feel like I am defending myself against a whole ‘state’”.
But Sheikh Mohammed said the findings of hacking presented “an incomplete picture” – and added: “As a head of government involved in private family proceedings, it was not appropriate for me to provide evidence on such sensitive matters”.
The judgments reveal that NSO Group alerted Haya’s lawyers on 5 August, via its ethics adviser Cherie Blair, at around the same time a digital forensics specialist has also suspected that the phone hacking was taking place. NSO said the courts had expressed their “appreciation of NSO’s cooperation, which was given although NSO is not within the jurisdiction of the court”.