In this guest blog for the Bar Council Dr. András Szecskay, Vice-President of the Budapest Bar Association, looks at the ramifications of the Pegasus spyware cases in Hungary.

The Pegasus spy software case, which appeared in the news in Hungary during the summer of 2021, brought up pertinent questions about the rule of law and fundamental rights in the digital age, not only in Hungary but everywhere.

How the Pegasus case started

In the summer of 2021 investigative journalists from Direkt36 revealed to the Hungarian public what has been called the European Watergate scandal.

A database of phone numbers, which were revealed to have been subjected to years of surveillance, was obtained by the Forbidden Stories journalist network and Amnesty International, and then jointly processed by 17 editorial offices, including Direkt36 in Hungary, as part of an international investigation.

It was reported that, since 2018, more than 300 Hungarian citizens (including six prominent lawyers) were observed in Hungary in the course of the surveillance of rights defenders, civilians and journalists. Israeli spy software developed by the Israeli company NSO was installed undetected on phones, which could then access the content on the phones and turn on the voice recorder and camera.

What was the Hungarian government’s response?

The Hungarian government has long disputed that it even owns the relevant Israeli surveillance software. However, the Minister of Interior Affairs later admitted in a report to the Parliament's Committee on Defence and Law Enforcement that the Ministry of Interior Affairs had purchased and used it.

It is indisputable that the case raises serious concerns regarding the rule of law, fundamental human rights and freedoms. Although the available evidence indicates that the interceptions were carried out with the authorisation of the Minister of Justice, the granting of these authorisations, which happened hundreds of times, was essentially automatic without any meaningful investigation into whether such surveillance was actually necessary.

What is the rule of law?

The generally accepted characteristics of the Rule of Law are:

  • equality before the law;
  • the transparency of legislation;
  • an independent judiciary and administration of justice; and
  • the effectiveness of law enforcement.

Without the foregoing, there can be no peaceful, just and prosperous societies.

What happens when the state observes civilians, lawyers, journalists, without limitation, through executive authorisation? Where do we find respect for fundamental rights, the rule of law or legal certainty?

What is the link between intelligence gathering and fundamental rights?

The right to privacy, the right to informational self-determination and the right to human dignity as fundamental human rights are closely related to the use of covert information gathering tools and methods, as the Hungarian Constitutional Court has pointed out.

From an international legal point of view, it is also necessary to take into account the Convention for the Protection of Human Rights and Fundamental Freedoms. Article 8 states:

"everyone has the right to respect for his/her private and family life, his/her home and his/her correspondence. The exercise of this right may be interfered with by the public authority only in such cases as are prescribed by law and are necessary in a democratic society in the interests of national security, public safety or the economic well-being of the country, for the prevention of disorder or crime, for the protection of public health or morals or for the protection of the rights and freedoms of others."

Why should we be afraid of the Pegasus spyware?

A mobile phone infected with Pegasus is like an open book - the program operator has access to virtually all data and applications, all passwords and folders. Technically, it is also possible for the hacker to install files on the device or to steal the data stored on the device and with it the identity of the phone owner.

Even if the spyware is later removed from the mobile phone, the operator can retain access to the person's social media profile and email account. Furthermore, Pegasus and similar spy software has the ability to turn on the camera and microphone on the phone, leaving the owner and his or her surroundings completely vulnerable to surveillance.

It is difficult to tell whether a mobile phone has been hacked or not, and a separate tool is needed to check. It is also difficult to determine who is behind the interception, as the data is transmitted to an intermediate server to make it impossible to identify the software operator.

Have we reached the end of privacy?

The spy software is specifically designed to target terrorists and prevent organised crime.

In Hungary and other countries, however, this software has been used against civilians, journalists and lawyers, and against people who are clearly not suspected of terrorist acts or other organised crime.

In addition, the legislation setting the rules regarding these surveillance methods is too permissive when it speaks in general terms about, for example, the “economic interests of Hungary”, which may justify the authorisation of interception and surveillance.

This situation, which is a serious violation of the rule of law and the protection of fundamental human rights like those protected by Article 8, such as the right to privacy, has been addressed by various rights organisations and politicians. Numerous procedures have been launched, including by the European Parliament.

What was the result of the official investigation in Hungary?

Of course, an investigation by the competent Hungarian authority, the National Authority for Data Protection and Freedom of Information (NAIH = "the Authority"), was carried out. Unfortunately, in its 55-page report the Authority, to everyone's surprise, found no violations in the use of the surveillance software or in the authorisation of certain eavesdropping.

Statement by the Data Protection Commissioner

Meanwhile, at a press conference following the publication of the Authority's Report, the Data Protection Commissioner said that the leaked list of 50,000 phone numbers and the list of 300 Hungarian citizens' identity data and phone numbers in connection with the Pegasus application raised the issue of illegality and that a complaint would be filed, thus denouncing those whose work has actually uncovered a multi-country surveillance scandal that ignores fundamental human rights - such as privacy and the rule of law - which underpin modern democracies!

Checks and balances

As we know, secret surveillance of state organs within a well-regulated framework would not be a cause for concern, and this is somewhat agreeable, because it serves to protect society against the perpetrators of crime. However, if the authorization of such surveillance is given to the executive without checks and balances, the question rightly arises: what prevents the governing power from using it for political or other purposes, but not for law enforcement?

Unfortunately, due authorisation is not a matter for the courts, but for the ministers appointed by the political authorities, who can delegate this task to their secretaries of state under a 2010 law. It is entirely uncertain whether the authorisations in the Pegasus case complied with the applicable legislation, or indeed whether the legislation itself complied with the rule of law and the requirement to respect fundamental human rights.

Some concluding thoughts

If the matter remains truly unresolved, and those in power in any country remain free to decide who they wish to surveil, the consequences are unforeseeable. Fear of being observed can easily encourage people to practice self-censorship in their private lives, if that is even possible.

In addition, fundamental institutions of the rule of law are being violated, such as:

  • the right to a defence, if lawyers are not allowed to communicate with defendants without control;
  • the freedom of the press, if journalists cannot protect their sources; and
  • the freedom of expression, when political figures are subject to surveillance.

It clearly follows from the foregoing that we lawyers - independent lawyers - have a huge responsibility and duty to defend the rule of law, democratic values and fundamental human rights, irrespective of political affiliation.

Dr. András Szecskay is the Budapest Bar Association's Vice-President responsible for International Relations. In 2010 he was also made Vice President of the Hungarian Bar Association and the President of the Hungarian Association for the Protection of Industrial Property and Copyright.