This Is How They Tell Me the World Ends: The Cyberweapons Arms Race

Adriel Desautels was one of the foremost brokers in the early zero-day market. He began by selling exploits that he discovered himself. Then he moved on to helping friends to sell their discoveries; this endeavor soon expanded to become a business. Desautels gave excellent terms to hackers who were willing to sign nondisclosure agreements (NDAs), and he was confident in his innate ability to judge the trustworthiness and morality of a person within minutes of meeting them—his so-called “sniff test.” Desautels’s work relied on a Bushido code of honor, which eventually became incompatible with the ever-expanding and increasingly less discerning zero-day market. He tried to sell only to reputable sources from the USA and to American allies, but he slipped up when he failed to do due diligence on an Italian company called HackingTeam. In 2015, Desautels’s company was hacked, and leaks showed that HackingTeam had been selling exploits to groups perpetrating grave human rights abuses. Horrified, Desautels closed his business immediately. Although Perlroth reported on the HackingTeam story herself at the time in an effort to hold those involved accountable, she came to regret the role that such media attention played in the publicization of the zero-day market, as this endeavor alerted other interested parties.

In 2015, Perlroth reported on a major Israeli spyware company called NSO Group that had hitherto kept itself completely out of public notice, with practically no online presence. Perlroth received information from an anonymous source that NSO Group had the ability to install sophisticated spyware on any smartphone, and that they’d developed an untraceable tool known as Pegasus, which was capable of hacking a phone remotely and with no action on the part of the phone’s user. Pegasus hardware cost millions of dollars to install, with each target costing hundreds of thousands of dollars more. It had already earned its creators tens of millions of dollars, particularly from buyers in the United Arab Emirates (UAE) and Mexico. 

Ethical “white hat” hackers in the security watchdog organization CitizenLab contacted Perlroth when they discovered the first evidence of Pegasus in the wild, putting her in contact with the target, the so-called “Million Dollar Dissident” Ahmed Mansoor. Mansoor was a poet from UAE who criticized the Emeriti royal family and had therefore been subject to consistently brutal persecution by the state. He was practically under house arrest, perpetually under surveillance, and was regularly harassed, arrested, and attacked. Despite these hardships, he was unwilling to leave his native country because he wanted to fight for his principles. (In 2018, he was sentenced to 10 years in prison for causing damage to “social harmony.” At the time Perlroth’s book was written, he was still suffering solitary confinement, regular beatings, and other privations in prison.) 

In 2016, NSO flatly denied Perlroth’s accusations in an absurdly unconvincing interview. Perlroth and her colleague at the New York Times broke a major story about the president of Mexico Enrique Peña Nieto’s use of Pegasus to hack his political opponents. Targets included anticorruption activists, influencers commenting on the recent soda tax, and any journalists critical of the president. The news story sparked major protests in Mexico and caused Perlroth herself to become a target of the same cyberespionage tactics.