Top Regime Opponents Under Fire
Of the 245 Azerbaijani phone numbers on the list that were identified, a fifth belonged to reporters, editors, or media company owners.
This might come as little surprise to the human rights watchdogs and international organizations who have long condemned President Ilham Aliyev’s government for its years-long suppression of press freedom.
But the extent of the spying is shocking.
Aside from Ismayilova — who could almost be considered an entire media outlet in her own right — one of the best-known independent Azerbaijani news sources is Meydan TV, an online broadcaster that reaches its audience primarily through YouTube and Facebook, where it has more than 750,000 subscribers.
In the wake of a massive crackdown in 2013, Meydan’s founders decided to establish the organization’s headquarters in Berlin, though it relies on local correspondents and freelancers who must often work in secret.
One of its best-known reporters, and a close friend of Ismayilova, is Sevinj Vaqifqizi. Her number was among those that appeared on the leaked list. Since she is currently in Berlin on a fellowship, OCCRP was able to meet with her to conduct a forensic analysis of her phone.
Just as with Ismayilova, it was ridden with traces of Pegasus software. In fact, the results went even beyond the period covered in the data, showing that her phone was actively infected at least until this May.
Vaqifqizi has long known that she was under surveillance. She has been detained, placed under a travel ban, and harassed for her reporting.
“I thought that our security service followed our phone calls and wanted to get our information,” she said. “But I never imagined that they would follow all my steps on the internet and could get my private photos, my contact lists.”
Like Ismayilova, her main concern was that she could have endangered others, especially her Meydan colleagues who are not publicly affiliated with the outlet. Since Meydan operates undercover in Azerbaijan, revealing their names could have dire consequences.
As it turns out, numbers belonging to four of her current and former colleagues, including Baku-based editor Aynur Elgunash, were also on the leaked list, although no forensic analysis has been done to determine whether they were infected.
In addition to journalists, OCCRP identified more than 40 Azerbaijani activists and their family members on the list. Their presence on the list begins in 2019, coinciding with mass protests and calls for the release of political prisoners.
Though the demonstrations had some success, with many political prisoners released under a presidential amnesty, the regime appeared eager to keep its enemies under surveillance.
The Azerbaijani government has many digital surveillance tools at its disposal.
“They want to be in control of everything,” said Arzu Geybullayeva, a journalist living in exile and the founder of Azerbaijan Internet Watch, an online platform that tracks internet censorship and surveillance in the country.
Since the crackdown in 2008, Geybullayeva says, she has seen the government use a growing array of sophisticated surveillance technology and documented dozens of cases of misuse.
“They had the money back in the day,” she said. “They spent so much of it on surveillance technology — and it’s not cheap.”
In one case, the state ordered “black boxes” to be installed on equipment belonging to Azercell, a mobile operator then majority-owned by Swedish telecommunications giant TeliaSonera. The boxes allowed police and security services to monitor internet traffic and phone calls in real time — and to identify dozens of people who dared to vote for Armenia, Azerbaijan’s regional rival, in the 2009 Eurovision Song Contest. “‘You have no sense of ethnic pride,’” one of them recalled being told. “‘How come you voted for Armenia?’”
Despite being widely recognized as a repressive government, Azerbaijan was able to acquire surveillance technology from the world’s leading network intelligence and security companies, including U.S.-based Verint Systems, Canada-based Sandvine, and Israeli firm Allot Communications.
“The government proved that it is not just this classical authoritarian government,” Geybullayeva said. “It is actually a digitally authoritarian government. Because they want to have tabs on everyone and use that information.”
Oppression Through Shame
In Azerbaijan, women who stand up to the regime face especially grave personal risks.
A frequent tactic, which has been deployed repeatedly by government agents in the last few years, is to drive dissident women out of the public sphere through sexual shaming.
One recent victim is Fatima Movlamli, a young activist and journalist. While still a teenager, she became a vocal critic of the regime, gaining a large social media following for her daring and creative protests.
“I wanted someone watching me from the other side to say ‘Aha, it is possible to protest. I have to do the same,’” she said.
In April 2019, when she was just 18, Movlamli’s intimate photographs and a video of her dancing on a chair in revealing clothing were released in an orchestrated campaign.
“At an age when I didn’t fully realize I was a woman, I was ashamed that I had a female body and that people saw it naked,” she said.
She even thought of commiting suicide. “In this country, women are doomed to live within the limits of what men want, and they can lynch a woman just because they see her body.”
Movlamli suspected that the authorities had obtained the photos in 2018, when she was kidnapped by plainclothes agents and held incommunicado for five days. She was beaten and forced to give up her phone password.
What she didn’t know was that, just over a month before her images were released, she had been selected for targeting by Pegasus.
In another high-profile case, the authorities’ tactics broke up a new marriage.
Ilkin Rustamzade is a youth activist and leading member of Azad Genclik (“Free Youth”), a pro-democracy movement. An outspoken critic of the government, Rustamzade and his fellow activists used social media to organize peaceful protests.
In 2013, he was charged with “organizing mass violent disorder” and sentenced to eight years in prison.
But though he received an amnesty in 2019, his troubles weren’t over. In March 2020, he was contacted on Facebook by an anonymous account who threatened to publish compromising photos of his new wife, Amina. His only way out, the stranger said, was to take down a Facebook petition calling on the government to provide social assistance to people affected by the COVID-19 pandemic.
After Rustamzade refused, photos of Amina, along with her name and telephone number, were published on social media and on an escort website.
A flurry of stories in the pro-government press followed, with headlines like “Ilkin Rustamzade married a girl with a history” and “Rustamzade’s wife was not a virgin.”
The young woman attempted suicide that summer. According to Rustamzade, the same anonymous account threatened the couple again, writing “If Ilkin is not silent, then what happened earlier will happen again.”
Sure enough, more of Amina’s photos were released in video collages posted on YouTube and Instagram. Absurdly mild by Western standards, they depict the young woman posing on the beach in a bathing suit and kissing an ex-boyfriend. But in conservative Azerbaijan, the social pressure that followed was so intense that the couple divorced.
“It poisoned our relationship with each other,” Ilkin Rustamzade wrote on Facebook. “It has become impossible to tolerate this constant terror. So we decided to break up.”
“I was condemned for ruining the family’s reputation,” Amina Mammadova told OCCRP. “My now ex-husband’s family reacted very negatively. My family was very upset too.”
There is no proof that the leaks of Amina’s photos had anything to do with NSO Group or its Pegasus software. But in the wake of her divorce, conversations she had with others about the situation were leaked online, leading her to suspect her phone had been hacked.
“I spoke to so many people that I can’t even say who exactly could [have leaked it],” she said. “Could it have been recorded from my phone? Or I spoke to someone in person and it was recorded? Maybe my phone is compromised.”
Amina’s number did not appear on the leaked list, perhaps because the data does not cover 2020. But numbers of both Ilkin and his father are there.