Pegasus spyware used to target Togolese journalists Loïc Lawson and Anani Sossou

New York, January 23, 2024—The Committee to Protect Journalists is alarmed by findings that the phones of Togolese journalists Loïc Lawson and Anani Sossou were infected with Pegasus spyware in 2021, and repeats its calls for an immediate moratorium on the use of such surveillance technologies and for legal proceedings against the journalists to be dropped.

On Tuesday, press freedom group Reporters Without Borders published findings that phones belonging to Lawson and Sossou had been infected with Pegasus. Those findings were independently confirmed by Amnesty International, the report said.

Pegasus spyware, produced by the Israeli company NSO Group, can take over a phone without a user’s knowledge or interaction. CPJ has documented how this zero-click spyware poses an existential crisis for journalism and press freedom around the world.

Lawson is the publisher of the newspaper Flambeau des Démocrates, and Sossou is a freelancer who has reported for various outlets, including as a correspondent for the Belgian investigative website L-Post and a commentator for the Togolese satellite broadcaster New World TV. He also publishes commentary on Facebook. Both journalists currently face criminal prosecution for their work and told CPJ they were surprised to learn they had been targeted.

“The targeting of journalists Loïc Lawson and Anani Sossou with Pegasus spyware makes even more real the fear of surveillance felt by many journalists in Togo, the existential threat that spyware poses to press freedom, and the imperative for an immediate moratorium on the use and sale of this technology,” said Angela Quintal, CPJ’s Africa program coordinator. “Lawson and Sossou currently face criminal prosecution for their reporting and now have to grapple with the fact that they were targeted with some of the world’s most aggressive spyware. They should have never had to deal with either of these threats.”

In mid-November 2023, Togolese authorities arrested and charged Lawson and Sossou with disseminating false news and attacking the honor of a minister, before granting them provisional release on December 1. Sossou was also charged with inciting a revolt. Their arrest and prosecution relate to a complaint by Togo’s Minister of Urban Planning and Land Reform, Kodjo Sévon-Tépé Adédzé, over posts by the journalists on social media—which have since been deleted—about the alleged theft of a large sum of money from Adédzé’s home.

Lawson and Sossou appeared in court on January 3 and January 17, when their case was transferred to the court of appeal in Lomé, the capital, according to media reports. The next hearing date has not been set.

In 2021, the phone numbers of at least three other Togolese journalists—Ferdinand Ayité, Luc Abaki, and Komlanvi Ketohou, who goes by Carlos—appeared on the Pegasus Project list of phone numbers allegedly selected for surveillance with Pegasus spyware, but the use of the spyware on those journalists’ phones was not confirmed. Ketohou told CPJ that the thought of his private activities in the hands of strangers was “torture,” and Ayité described the looming threat of surveillance as a “permanent fear.”

Citizen Lab, a University of Toronto-based research group, previously found other Togolese civil society members, including clergy, had been targeted with Pegasus in 2019. An unnamed Togolese activist was also targeted with a different spyware in late 2019 and early 2020, according to Amnesty International.

NSO Group, which produces and sells Pegasus spyware, previously told CPJ that it licenses Pegasus to investigate serious crime and terrorism. The company has said it investigates “all credible claims of misuse and take[s] appropriate action,” including shutting down a customer’s access.

CPJ’s calls to Yawa Kouigan, Togo’s minister of communication and media, as well as a spokesperson for the government, rang unanswered.

CPJ offers guidance for journalists and newsrooms on spyware targeting and general digital safety.