Campaigner for migrants in Libya says his phone was targeted in spyware attack

The Guardian

11-02-2025

An Italy-based human rights activist whose work supports the international criminal court in providing evidence about cases of abuse suffered by migrants and refugees held in Libyan detention camps and prisons has revealed that Apple informed him his phone was targeted in a spyware attack
David Yambio, the president and co-founder of Refugees in Libya, has been a critic of the Italian government's migrant pact with the north African country and its recent controversial decision to release Osama Najim, a Libyan police chief wanted by the international criminal court (ICC) for suspected war crimes, including torture, murder, enslavement and rape. Yambio, 27, was an alleged victim of Najim's abuses during his detention at the notorious Mitiga prison near Tripoli.
Yambio's case followed revelations that an Italian investigative journalist and two activists critical of Italy's dealings with Libya were among 90 people who received notifications from WhatsApp in late January alleging they had been targeted with spyware.
WhatsApp has said the spyware used in that breach – which affected journalists and activists and others in two dozen countries – was made by Paragon Solutions, an Israel-based company that makes cyberweapons. The Guardian reported last week that Paragon terminated its client relationship with Italy for breaking the terms of its contract, citing a person familiar with the matter.
Yambio received an email from Apple on 13 November seen by the Guardian, informing him he was being targeted by 'a mercenary spyware attack' that was attempting to 'remotely compromise the iPhone associated with your Apple account'. The message said the attack 'is likely targeting you specifically because of who you are or what you do'.
It did not specify what kind of spyware was being used against him, and Yambio was not one of the 90 people who received a WhatsApp notification.
Yambio said he contacted a digital security expert at CyberHub-AM in Armenia, who in turn connected him with the Citizen Lab at the University of Toronto, which tracks digital threats against civil society and assisted WhatsApp in tracking hacking attempts made against the 90 people, allegedly using the spyware produced by Paragon. Seven of the alleged targets live in Italy.
In a statement, Citizen Lab said it was continuing to investigate Yambio's case.
Any evidence that Yambio was targeted by spyware could have political reverberations for whoever was behind the alleged attack. The Rome statute, which established the ICC, is mandated to protect the safety and wellbeing of any witnesses and has the power to prosecute offences that obstruct witnesses.
'I already had suspicions in September when my phone started to behave strangely,' he told the Guardian. 'For examples, calls would just hang up, the phone would get warm or the battery would run out really quickly.'
Spyware made by companies such as Paragon and NSO Group generally have access to multiple so-called vectors, or vulnerabilities that enable the spyware they make to infect a mobile phone. WhatsApp has previously been vulnerable to spyware made by both Paragon and NSO Group, but individuals can also be infected via SMS messages or other apps.
Paragon has not commented on the cases that have emerged in Italy but has said it has 'zero tolerance' for clients that violate its terms of service, which includes prohibitions on targeting journalists and activists.
The office of the Italian prime minister, Giorgia Meloni, last week denied that domestic intelligence services or the government were behind the alleged Paragon breaches and has not responded to the claims that Paragon cancelled its contract with Italy.
Yambio has described the Italy-Libya migrant pact, which involves Italy funding the Libyan coastguard to capture people in the Mediterranean and bring them back to the north African country, as 'a death sentence'.
'For three months, my life has been lived under constant threat: I do not know where it's coming from, which government [is involved]. I live in Italy, I don't live in any other country. So who should I hold accountable?'
He added: 'The people who have so far come out in public are in Italy, and [some] of these people are in my close circle. We are people working to stop human suffering, to try to make a change, and yet we are being targeted. I am very afraid because the information concerns not only me but the life of people who [have been victims of abuse in Libya] and also the life of my partner and my child.'
Yambio is attending a press conference in the European parliament on Tuesday afternoon about the case involving Najim, also called Almasri, which has roiled Italian politics in recent weeks. The ICC said on Monday that it had officially asked Italy to explain why the country released Najim after his arrest in Turin instead of extraditing him to the Netherlands, where court is based.
Najim was repatriated to Tripoli onboard an Italian military aircraft. Meloni, who is being investigated over the matter by prosecutors in Rome, said Najim was immediately repatriated because he posed a risk to national security.
'We have not received any statement from the EU, from the European Commission, the European parliament or any member state on this case of an internationally wanted criminal who was smuggled away from justice,' said Yambio.
Yambio, from South Sudan, received asylum in Italy in 2022 after escaping from Mitiga prison, a facility under Najim's watch and condemned by human rights organisations for its arbitrary detention, torture and abuse of political dissidents, migrants and refugees. He later crossed the Mediterranean by boat.
The pact between Italy and Libya, first signed in 2017 and renewed since, has long been condemned by humanitarian groups for pushing people back to detention camps where they face torture and other abuses.