You’ve been targeted by government spyware. Now what?

One day, Jay Gibson received a startling alert on his iPhone: "Apple detected a targeted mercenary spyware attack against your iPhone." Having previously worked with companies that developed such spyware, Gibson was taken aback by the notification on his own device. In a panic, he reached out to his father, powered down his iPhone, and rushed to purchase a new one. "It was a mess. A huge mess," he recounted to TechCrunch. Gibson's experience is becoming increasingly common as tech giants like Apple, Google, and WhatsApp intensify their efforts to notify users about potential spyware attacks by government hackers, particularly those involving spyware from firms like Intellexa and NSO Group. While these companies provide alerts, they often stop short of offering direct assistance afterwards, directing users instead to resources that can help. So, what should you do if you receive such a warning? First and foremost, take it seriously. The companies have extensive data regarding their users and the activities on their devices. If they indicate that you are at risk, it is likely that they have credible reasons for their concerns. However, a notification does not necessarily mean that a successful hack has occurred; it may simply indicate that an attempt was made. For instance, if you receive a warning from Google, it's often a sign that the company successfully blocked an attack and is advising you to enhance your account's security, such as by enabling multi-factor authentication and turning on the Advanced Protection Program. In the case of Apple, users are advised to activate Lockdown Mode, which implements enhanced security measures designed to thwart potential hacking attempts. Apple has claimed that no user with Lockdown Mode enabled has ever been successfully hacked, although no security system is infallible. Mohammed Al-Maskati, director of Access Now’s Digital Security Helpline, shared practical advice for those concerned about potential spyware threats. This includes keeping device software up to date, activating security features like Lockdown Mode and Advanced Protection, exercising caution with suspicious links, and regularly restarting devices to refresh security settings. For individuals who suspect they may be targeted, there are open-source tools available, such as the Mobile Verification Toolkit (MVT), which requires some technical knowledge to use. Alternatively, you can seek help from organizations like Access Now, Amnesty International, or The Citizen Lab, especially if you belong to vulnerable communities like journalists or human rights activists. For those outside of these groups, such as business leaders or politicians, options are more limited. They may have access to internal security teams or private security firms like iVerify, which offers forensic investigations for suspicious activity on devices. When reaching out for help, organizations may request a diagnostic report from your device to conduct an initial forensic check remotely. Depending on the findings, further investigation may require a complete device backup or even the device itself. Unfortunately, modern spyware often employs tactics to erase its traces after an attack, complicating investigations. As noted by Hassan Selmi from Access Now, the current trend among spyware developers is to execute a "smash and grab" strategy, stealing as much data as possible before erasing any signs of their presence. If you are part of a community that is at risk, the organizations assisting you may suggest publicizing the attack to raise awareness. However, the choice to go public remains yours, and they will provide support regardless of your decision. Receiving such a notification can be alarming, but with the right guidance and precautions, you can take steps to secure your digital life.