Meet the team that investigates when journalists and activists get hacked with government spyware

For over a decade, a growing number of journalists and human rights activists have found themselves under siege by government forces using advanced spyware across various nations. Countries including Ethiopia, Greece, Hungary, India, Mexico, Poland, Saudi Arabia, and the United Arab Emirates have employed these sophisticated tools to infiltrate the mobile devices of their targets. Unfortunately, these individuals often face severe repercussions, including intimidation, harassment, and, in extreme instances, even murder. In response to this alarming trend, a dedicated team of digital security specialists—primarily based in Costa Rica, Manila, and Tunisia—has emerged as a crucial line of defense. Operating under the nonprofit organization Access Now, specifically through its Digital Security Helpline, this team is committed to assisting journalists, human rights defenders, and dissidents who suspect they have fallen victim to hacking. Their mission is to provide immediate, 24/7 support to those facing cybersecurity threats, particularly from mercenary spyware developed by companies like NSO Group, Intellexa, and Paragon. Hassen Selmi, who leads the incident response team at the Helpline, highlighted the importance of their work, stating, "The idea is to provide this service so civil society and journalists can reach out whenever they experience a cybersecurity incident." Bill Marczak, a senior researcher at the University of Toronto's Citizen Lab, echoed this sentiment by calling Access Now’s Helpline a vital resource for individuals potentially targeted by spyware. In fact, the helpline has become a pivotal channel for victims seeking assistance. Notably, Apple has directed users who receive “threat notifications” about potential spyware targets to Access Now’s team. Selmi elaborated on the significance of this partnership, explaining how having a knowledgeable resource can greatly alleviate the stress for victims. "Having someone who could explain what the notification means and advise on next steps is a big relief for them," Selmi remarked. Despite the optics of a major tech company relying on a small nonprofit team, many digital rights experts commend Apple for its approach. Access Now’s Helpline now reviews approximately 1,000 suspected spyware cases annually, with about half leading to formal investigations. However, only around 5% of these cases, equating to about 25, have confirmed spyware infections, according to Mohammed Al-Maskati, the helpline’s director. When Selmi began this work in 2014, the organization was handling roughly 20 cases each month with a small team. Today, despite only having around 15 staff members, their outreach and recognition have significantly expanded. The rise in reported cases can be attributed to various factors, including increased awareness of the helpline, the global proliferation of government spyware, and proactive outreach efforts to vulnerable populations. Selmi emphasized that each case is unique, requiring tailored responses that consider the victim's cultural context and specific circumstances. In addition to offering support, the helpline is also collaborating with similar organizations worldwide through a coalition called CiviCERT. This initiative aims to equip civil society members with the necessary knowledge and tools to address spyware threats effectively. "No matter where they are, victims have people they can talk to and report to," Selmi affirmed, highlighting the critical support the network provides to those in need.