You’ve been targeted by government spyware. Now what?

It was a normal day when Jay Gibson got an unexpected notification on his iPhone. “Apple detected a targeted mercenary spyware attack against your iPhone,” the message read.

Ironically, Gibson used to work at companies that developed exactly the kind of spyware that could trigger such a notification. Still, he was shocked that he received a notification on his own phone. He called his father, turned off and put his phone away, and went to buy a new one.

“I was panicking,” he told TechCrunch. “It was a mess. It was a huge mess.”  

Gibson is just one of an ever-increasing number of people who are receiving notifications from companies like Apple, Google, and WhatsApp, all of which send similar warnings about spyware attacks to their users. Tech companies are increasingly proactive in alerting their users when they become targets of government hackers, and in particular those who use spyware made by companies such as Intellexa, NSO Group, and Paragon Solutions.

But while Apple, Google, and WhatsApp alert, they don’t get involved in what happens next. The tech companies direct their users to people who could help, but at which point the companies step away.

This is what happens when you receive one of these warnings. 

Warning 

You have received a notification that you were the target of government hackers. Now what? 

First of all, take it seriously. These companies have reams of telemetry data about their users and what happens on both their devices and their online accounts. These tech giants have security teams that have been hunting, studying, and analyzing this type of malicious activity for years. If they think you have been targeted, they are probably right. 

It’s important to note that in the case of Apple and WhatsApp notifications, receiving one doesn’t mean you were necessarily hacked. It’s possible that the hacking attempt failed, but they can still tell you that someone tried. 

In the case of Google, it’s most likely that the company blocked the attack, and is telling you so you can go into your account and make sure you have multi-factor authentication on (ideally a physical security key or passkey), and also turn on its Advanced Protection Program, which also requires a security key and adds other layers of security to your Google account. In other words, Google will tell you how to better protect yourself in the future. 

In the Apple ecosystem, you should turn on Lockdown Mode, which switches on a series of security features that makes it more difficult for hackers to target your Apple devices. Apple has long claimed that it has never seen a successful hack against a user with Lockdown Mode enabled, but no system is perfect. 

Mohammed Al-Maskati, the director of Access Now’s Digital Security Helpline, a 24/7 global team of security experts who investigate spyware cases against members of civil society, shared with TechCrunch the advice that the helpline gives people who are concerned that they may be targeted with government spyware.

This advice includes keeping your devices’ operating systems and apps up-to-date; switching on Apple’s Lockdown Mode, and Google’s Advanced Protection for accounts and for Android devices; be careful with suspicious links and attachments; to restart your phone regularly; and to pay attention to changes in how your device functions.

Reaching out for help

What happens next depends on who you are. 

There are open source and downloadable tools that anyone can use to detect suspected spyware attacks on their devices, which requires a little technical knowledge. You can use the Mobile Verification Toolkit, or MVT, a tool that lets you look for forensic traces of an attack on your own, perhaps as a first step before looking for assistance. 

If you don’t want or can’t use MVT, you can go straight to someone who can help. If you are a journalist, dissident, academic, or human rights activist, there are a handful of organizations that can help. 

You can turn to Access Now and its Digital Security Helpline. You can also contact Amnesty International, which has its own team of investigators and ample experience in these cases. Or, you can reach out to The Citizen Lab, a digital rights group at the University of Toronto, which has been investigating spyware abuses for almost 15 years. 

If you are a journalist, Reporters Without Borders also has a digital security lab that offers to investigate suspected cases of hacking and surveillance. 

Outside of these categories of people, politicians or business executives, for example, will have to go elsewhere. 

If you work for a large company or political party, you likely have a competent (hopefully!) security team you can go straight to. They may not have the specific knowledge to investigate in-depth, but in that case they probably know who to turn to, even if Access Now, Amnesty, and Citizen Lab cannot help those outside of civil society. 

Otherwise, there aren’t many places executives or politicians you can turn to, but we have asked around and found the ones below. We can’t fully vouch for any of these organizations, nor do we endorse them directly, but based on suggestions from people we trust, it’s worth pointing them out. 

Perhaps the most well known of these private security companies is iVerify, which makes an app for Android and iOS, and also gives users an option to ask for an in-depth forensic investigation. 

Matt Mitchell, a well-regarded security expert who’s been helping vulnerable populations protect themselves from surveillance has a new startup, called Safety Sync Group, which offers this kind of service. 

Jessica Hyde, a forensic investigator with experience in the public and private sectors, has her own startup called Hexordia, and offers to investigate suspected hacks. 

Mobile cybersecurity company Lookout, which has experience analyzing government spyware from around the world, has an online form that allows people to reach out for help to investigate cyberattacks involving malware, device compromise, and more. The company’s threat intelligence and forensics teams may then get involved.  

Then, there’s Costin Raiu, who heads TLPBLACK, a small team of security researchers who used to work at Kaspersky’s Global Research and Analysis Group, or GReAT. Raiu was the unit’s head when his team discovered sophisticated cyberattacks from elite government hacking teams from the United States, Russia, Iran, and other countries. Raiu told TechCrunch that people who suspect they’ve been hacked can email him directly.

Investigation

What happens next depends on who you go to for help. 

Generally speaking, the organization you reach out to may want to do an initial forensic check by looking at a diagnostic report file that you can create on your device, which you can share with the investigators remotely. At this point, this doesn’t require you to hand over your device to anyone. 

This first step may be able to detect signs of targeting or even infection. It may also turn out nothing. In both cases, the investigators may want to dig deeper, which will require you to send in a full backup of your device, or even your actual device. At that point, the investigators will do their work, which may take time because modern government spyware attempts to hide and delete its tracks, and will tell you what happened. 

Unfortunately, modern spyware may not leave any traces. The modus operandi these days, according to Hassan Selmi, who leads the incident response team at Access Now’s Digital Security Helpline, is a “smash and grab” strategy, meaning that once spyware infects the target device, it steals as much data as it can, and then tries to remove any trace and uninstall itself. This is assumed as the spyware makers trying to protect their product and hide its activity from investigators and researchers.  

If you are a journalist, a dissident, an academic, a human rights activist, the groups who help you may ask if you want to publicize the fact that you were attacked, but you’re not required to do so. They will be happy to help you without taking public credit for it. There may be good reasons to come out, though: To denounce the fact that a government targeted you, which may have the side effect of warning others like you of the dangers of spyware; or to expose a spyware company by showing that their customers are abusing their technology. 

We hope you never get one of these notifications. But we also hope that, if you do, you find this guide useful. Stay safe out there.