As part of the investigation, reporters obtained a list of over 50,000 numbers throughout the world believed to have been selected by NSO Group clients for targeting with Pegasus – a malicious software manufactured by Israeli tech firm NSO Group.
According to research by OCCRP and The Pegasus Project, a global consortium of journalists coordinated by Forbidden Stories, Reporters were able to identify dozens of numbers belonging to Rwandans or other people of likely interest to Rwanda’s government from neighboring countries. They included activists, journalists, dissidents, and government officials.
Reporters were unable to conduct forensic analyses to verify infection on these phones, but the extent and nature of the Rwandan numbers in the data strongly suggests that the Rwandan government was a client of NSO Group.
There’s also a history of Pegasus being used against Rwandan dissidents. In 2019, a number of Rwandans were among 1,400 victims of Pegasus attack using a vulnerability in the messaging application WhatsApp that became the basis of a lawsuit by Facebook against NSO Group.
Three Western government officials told OCCRP, on the basis of anonymity, that they were aware that Rwanda had access to advanced Israeli spyware technology, and that there was concern at how it was being deployed.
The list of selected numbers also shows the Kagame government may have used Pegasus to target high-ranking political and military figures in neighboring countries.
Several numbers for high-profile figures in Uganda, Burundi, and the Democratic Republic of Congo (DRC) feature in the data.
Rwanda has had frosty relations with these neighbors over the years. It has sponsored armed groups in the east of DRC, criticized Uganda for harboring anti-RPF militias, and been accused by Burundi of plotting to overthrow its president.
Telephone numbers for Ruhakana Rugunda, the prime minister of Uganda until last month, and Alain-Guillaume Bunyoni, the prime minister of Burundi, appear on the list. Bunyoni was added before he was appointed prime minister, when he was Burundi’s interior minister.
Among the Ugandans on the list, OCCRP has identified numbers belonging to longtime senior cabinet member Sam Kutesa, former Defense Forces Chief General David Muhoozi, senior intelligence officer Joseph Ocwet, and leading opposition figure Fred Nyanzi Ssentamu. The selections coincided with a visit by Kagame to Uganda.
In DRC, OCCRP identified numbers in the data for Lambert Mende and Albert Yuma, both powerful allies of longtime former President Joseph Kabila, who stepped down in January 2019. Reporters also found a number belonging to Jean Bamanisa Saïdi, a prominent provincial governor in DRC’s gold-rich east. These numbers were selected around the time of a political crisis in DRC over whether Kabila would respect constitutional term limits.
“There is already enormous, well-founded suspicion between the governments in the Great Lakes region and Rwanda,” said journalist Michela Wrong. “[Evidence of spying] will certainly encourage the view that Rwanda is not a partner playing by the rules.”
Spokespeople for the DRC and Burundi declined to comment. A Ugandan government spokesperson, Ofwono Opondo, said that it is “up to Uganda to strengthen its cyber security protocols, otherwise the world is full of spying and espionage even among allies.”