The Ongoing Battle for Opposition: Egyptian Politician Unwittingly Becomes Target of Surveillance Software

*By *

—

### Introduction

In a shocking revelation, security researchers at Citizen Lab and Google’s Threat Analysis Group have discovered that a prominent Egyptian opposition politician, Ahmed Altantawy, was targeted with spyware multiple times after announcing his presidential bid. The researchers believe that the Egyptian authorities are likely behind these attempted hacks. The discovery of this malware prompted Apple to release urgent operating system updates to patch the associated vulnerabilities. The implications of this incident are significant, as it not only highlights the vulnerability of individuals in high-risk positions but also raises questions about the role of telecommunications companies in such cyberattacks.

### The Targeted Attacks

According to Citizen Lab’s blog post, the attempts to hack Ahmed Altantawy began in August, with the attackers configuring his phone’s connection to the Vodafone Egypt mobile network. If Altantawy visited certain websites that did not use the secure HTTPS protocol, his phone would be automatically infected with the Predator spyware. However, it appears that these efforts failed due to Altantawy having his phone in “lockdown mode,” a security measure recommended by Apple for individuals at high risk, such as activists and dissidents.

Prior to the network injection attempts, the attackers also made several unsuccessful attempts to infect Altantawy’s phone with the Predator spyware via links in SMS and WhatsApp messages. Clicking on these links would have resulted in the infection. Once infected, the Predator spyware turns a smartphone into a remote eavesdropping device, allowing the attacker to intercept data.

### Egypt‘s Government Involvement

Citizen Lab has expressed “high confidence” that the Egyptian government is behind these targeted attacks, citing Egypt‘s known customer relationship with Cytrox, the maker of Predator spyware. Furthermore, the malware was delivered through network injection from Egyptian soil. It is alarming to realize that a government can selectively target individuals on a mobile network and infect their devices with a simple “flip of a switch.” This indicates a troubling level of cooperation between the government and telecom companies like Vodafone Egypt.

### The Political Context

The targeting of Ahmed Altantawy, a former journalist and lawmaker, becomes even more significant when considering Egypt‘s political landscape. Altantawy announced his bid to challenge President Abdel Fatah el-Sissi in 2024, but his campaign has been met with harassment and intimidation by the authorities. Human rights groups have accused el-Sissi’s administration of using brutal tactics, including forced disappearances, torture, and prolonged detentions without trial, to suppress political opposition.

Altantawy, his family, and supporters have reported being harassed, which led him to seek assistance from Citizen Lab to analyze his phone for potential spyware infections. Altantawy believes that these hacking attempts were directly related to his political candidacy and his role as an opposition figure, aimed not only at surveillance but also at finding compromising material to discredit him.

### Telecom Companies’ Complicity

This incident also raises concerns about the possible complicity of telecom companies operating in Egypt. Citizen Lab has previously documented Predator infections affecting exiled Egyptians, and a joint investigation with Facebook revealed that Cytrox had customers in several countries, including Greece, Saudi Arabia, and Serbia. It is essential to determine whether these telecommunications companies are knowingly facilitating or turning a blind eye to surveillance activities.

### International Response

The international community must address the issue of governments using spyware against political opponents and human rights activists. It is concerning that companies like Cytrox, which develop surveillance tools, are involved in such practices. The U.S. has already added Cytrox to its blacklist for developing surveillance tools that pose a threat to national security. Similar action was taken against the NSO Group, the maker of the Pegasus spyware, in 2021.

### Internet Security and Personal Safety

This incident serves as a stark reminder of the threats posed by surveillance technology and the need for individuals to take measures to protect their personal information. For individuals at high risk, such as activists and journalists, securing their devices and adopting practices like “lockdown mode” are crucial steps in safeguarding their privacy.

Furthermore, it is essential for governments to enact legislation that holds telecom companies accountable for their roles in facilitating surveillance activities. Robust oversight and regulations are necessary to protect individuals’ privacy while allowing for legitimate law enforcement activities.

### Conclusion

The targeted attacks on Ahmed Altantawy, a leading Egyptian opposition politician, highlight the extent to which governments can exploit surveillance technology to suppress political opponents. The involvement of Predator spyware and the suspected complicity of telecom companies raise significant ethical and legal questions. As internet security becomes an increasingly critical issue, it is imperative for individuals, governments, and technology companies to collaborate in promoting online privacy and safeguarding the democratic values of free speech and political dissent.