• Carine Kanimba, victim of spyware, daughter of the Rwandan politician Paul Rusesabagina
• Dominique Simonnot, victim of spyware, journalist
• Catherine Van de Heyning, Professor, University of Antwerp

Carine Kanimba is the youngest daughter of the Rwandan politician Paul Rusesabagina and is Belgian and US-American. After a flight from Texas, her father was arrested in Rwanda and sentenced to 20 years in prison in a show trial. Human rights organisations criticised this and, like the European Parliament, called for her release. Paul’s story was told in the film „Hotel Rwanda“. He has always called for democracy, freedom of expression and freedom of the press. For years, attempts were made to silence him or make him untrustworthy. The family home in Brussels was also breached. After the flight from the USA, however, the regime managed to get hold of Paul Rusesabagina.
Carine Kanimba was also attacked with Pegasus, probably because she campaigned for the release of her father. Citizen Lab has provided evidence of this in a forensic analysis. If her current phone was also infiltrated, which is here now, the regime in Rwanda could even listen to this hearing. A year ago, she had a conversation with the Belgian Foreign Minister that may have been intercepted because of active spyware. It is even possible that emails with MPs were intercepted. The spyware got on her phone without her clicking on a link. She has lost her sense of security in her private life.
70% of Rwanda’s income comes from abroad. An EU review is to analyse whether this has no impact on human rights. Rwanda is seen as an ally of the EU, for example in the military field, and gives €260 million to the country. EU citizens need to know that this money is being used for human rights violations. A journalist friend of hers, who lives with her in same house in Brussels, was also bugged. So there were two people in one house who were attacked with Pegasus.
She no longer feels safe after the espionage was uncovered, Kanimba explains when asked, it affects her entire life and her family. She is now also being physically persecuted. There is also no reason for her to feel safer: Might she being abducted and maybe tortured? Nothing has actually happened to make her feel safer, except that she was invited here today. The Belgian government must do more to protect them. Rwanda has close relations with the EU, so it is possible to set political boundaries so that the message is understood. She is happy to continue discussing solutions so that people like me can feel safer. She has taken the floor that no one needs to feel like her and her family. This technique needs to be understood. A country like Rwanda with its dictator must stop using it to spy on people.

Catherine Van de Heyning is touched by Carine Kanimba’s remarks. Pegasus is only one of the spywares, currently known for example became Predator. Prime Ministers and politicians have also been spied on. We see that spyware is not only available to governments, but also to citizens. It is advertised on the internet that it can be used to spy on former partners or employees. It costs less than 10 dollars a month; on the manufacturers‘ website, for example, company owners thank them for their successful use. Pegasus is only the worst expression of this and therefore a serious threat to the privacy of us all. There is already a court ruling in favour of the victims of such spy software.
As early as 2008, there were calls to regulate the export of spyware. What is shocking, however, is how states use the technology not only against their own citizens, but also in other states. What became public in Greece as violations of privacy [with Predator] is the result of whistleblowers and journalists, which shows that state regulation does not work. Development and sales must therefore be strictly regulated. In her view, the spy tools must be treated like weapons.
In criminal investigations, it may be okay to use this technology as a targeted use. But national security [i.e. work of intelligence services] is not covered by EU regulations. Only victims can initiate civil complaints, but the nature of spying with mercenary spyware makes this inherently unknown. Therefore, there needs to be an obligation to notify victims, this needs to be checked at least for cases that are closed. Victims must be able to appeal to the courts.
In order to support victims, they also need advice from experts, here there is a lack of possibilities for legal assistance. Individuals may be able to afford this and have their mobile phones examined, this must be broadened.
Legal remedies would be good, as she described, but prevention is of course much better, Van de Heyning explained after being questioned. This also includes the obligation to notify the estimated up to 1.5 million victims, which she calls for; this would also deter secret services. However, some of the areas of application of mercenary spyware fall under national law. She doesn’t mean that victims always have to be informed, secrecy is sometimes important, but the problem is that in some cases investigations are never finished.
As far as exports are concerned, however, the EU can take action. As with weapons, this is cutting-edge technology that has been developed by a military industry, so to speak. We should therefore apply the mechanisms of arms export controls. The e-Privacy Directive could also be applied. Besides the EU, industry can also do something, and then of course the individual states. This national responsibility is important. We may think this is naïve, but it is part of the nature of democracy. But industry could also take action by immediately fixing vulnerabilities and immediately reporting findings to the manufacturers.
The EU has hardly any possibilities for regulating secret services. However, it is not only intelligence services that make use of technology. Finally, supervision must also be improved, as the ECJ also affirmed with its call for more supervisory authorities. It also points out that metadata is collected, the importance of which the EU has already recognised.

Dominique Simonnot was a victim of Pegasus as a court reporter for satirical newspaper Le Canard Enchaîné when she was working on investigative research. A year ago, French President Emmanuel Macron awarded her the post of controller of custodial measures. Simonnot admits to having been naïve about the possibilities of tapping her computer and phone. However, there are no more public telephone booths in Paris from which it is possible to communicate anonymously. Forensic analysis of her phone revealed that the attack was carried out by Moroccan authorities. Simonnot, however, has no connections to the country.

See here the stream of today‘s hearing.