Germany says lawmakers’ iPhones may have been hacked with spyware

The German government is warning politicians and public figures that they were targeted by government-backed spyware, days after Apple began sending out notifications warning victims that their iPhones may have been hacked.

Germany’s federal cybersecurity office, known as the BSI (Bundesamt für Sicherheit in der Informationstechnik), issued a significant alert over the weekend, confirming that members of the Bundestag, Germany’s national parliament, alongside other prominent but unnamed individuals, have received warnings from Apple. These alerts indicated that their iPhones may have been subjected to highly sophisticated cyberattacks, likely orchestrated by state-sponsored entities. This development underscores a growing concern among democratic nations regarding the pervasive threat of digital espionage targeting key political figures and civil society.

The BSI, which serves as Germany’s central authority for IT security, plays a crucial role in safeguarding the nation’s digital infrastructure and providing guidance on cybersecurity threats. Its public note, detailed on its official website, explicitly stated its awareness of the warnings issued to members of parliament and other notable personalities, thereby lending official credibility and urgency to Apple’s notifications. The BSI’s immediate acknowledgment and subsequent recommendations highlight the gravity of the potential intrusions and the serious implications for national security and individual privacy.

In response to these alarming revelations, a spokesperson for the German government, Stefan Kornelius, affirmed Berlin’s serious approach to the incident. As reported by the Financial Times, Kornelius stated that the government was “taking the incident and the warning very seriously.” However, consistent with the sensitive nature of such security breaches, specific details regarding the identities of the targeted individuals within the federal government were not disclosed. This included whether high-profile figures such as German Chancellor Friedrich Merz were among those who received the alerts, a standard practice in national security matters to avoid providing information that could aid attackers or cause undue alarm. The lack of specific names, while protective, also indicates the potentially broad and indiscriminate nature of such advanced persistent threats (APTs) when deployed by powerful actors.

Apple periodically dispatches what it terms “threat notifications” to individuals it believes may have been targeted by state-sponsored attackers. These alerts are not issued lightly; they represent Apple’s assessment, based on its extensive security research and threat intelligence, that a user’s device has been exposed to highly sophisticated spyware. Such spyware is typically associated with nation-state actors or well-resourced private groups due to the immense technical expertise and financial investment required to develop and deploy these tools effectively. The capabilities of this type of spyware are extensive, allowing attackers to surreptitiously steal a wide array of sensitive information, including personal messages, precise location data, call logs, contacts, photos, and other confidential data directly from a victim’s phone. The implications of such widespread data exfiltration are profound, ranging from severe privacy violations to significant national security risks, particularly when politicians, journalists, and public figures are targeted.

A particularly dangerous characteristic of modern state-sponsored spyware is its reliance on “zero-click exploits.” Unlike conventional cyberattacks, such as phishing, which require a victim to interact with a malicious link or open an infected file, zero-click exploits can compromise a device without any user action whatsoever. This means an attacker can gain complete control over an iPhone merely by sending a hidden message, making a silent call, or exploiting a vulnerability in a seemingly innocuous application that the user never even sees or interacts with. This makes detection incredibly difficult for the average user and elevates the threat level significantly, as even the most security-conscious individuals can be compromised invisibly. The sophistication required to develop and deploy zero-click exploits underscores the advanced capabilities of the entities involved, often private firms selling to governments, and highlights the critical need for constant vigilance and robust security updates from device manufacturers.

Apple maintains a policy of not attributing these attacks to specific governments or confirming whether a device has been definitively compromised. This cautious stance is likely influenced by the complexities of attribution in the cybersecurity domain, where attackers often employ obfuscation techniques, and to avoid direct political entanglements. However, the BSI, understanding the high probability of actual compromise given Apple’s stringent criteria for issuing such warnings, strongly advised anyone receiving an Apple threat notification to “assume that their device may have been compromised.” This proactive recommendation emphasizes the immediate need for recipients to take stringent security measures, which typically include updating all software, changing passwords for critical accounts, enabling multi-factor authentication, and in some severe cases, considering replacing the compromised device to ensure data integrity and prevent further exploitation.

The recent wave of Apple threat notifications reveals a global dimension to these sophisticated surveillance campaigns, extending far beyond Germany’s borders. Radwan Mortada, a Beirut-based filmmaker, publicly shared on X (formerly Twitter) that he had received a new warning from Apple, stating the detection of “another attack against your device.” This was not Mortada’s first encounter with such a threat, as he had previously been targeted by a spyware attack in 2021, underscoring the persistent nature of such threats against civil society figures. The widespread nature of these attacks was further highlighted by Apple itself, which indicated in the notice received by Mortada that its latest batch of threat notifications had been dispatched to users in an astonishing 99 countries worldwide. This extensive global footprint points to a highly organized and expansive campaign, or potentially multiple distinct campaigns, utilizing similar sophisticated tools, suggesting a pervasive international market for advanced surveillance technology.

Despite the clear indications of sophisticated state-backed activity, the precise identity of those behind this latest round of spyware attacks remains unclear. Apple’s notifications, while signaling state-sponsored threats, do not identify the specific government or entity orchestrating the targeting. This ambiguity is a hallmark of the murky business surrounding the development and deployment of “mercenary spyware.” Governments, rather than developing these highly complex tools in-house, frequently procure them from private vendors. These “mercenary spyware” makers operate in a largely unregulated global market, selling advanced surveillance capabilities to various state clients, often without sufficient oversight regarding the end-use of their powerful technologies.

The most notorious example of such a vendor is Israel’s NSO Group, infamous for its Pegasus spyware. Pegasus is a powerful surveillance tool capable of extracting virtually all data from a compromised smartphone, effectively turning it into a mobile listening device and a portable tracking tool. Its controversial use has been extensively documented in numerous cases globally, often targeting journalists, human rights activists, lawyers, political dissidents, and opposition figures, leading to international condemnation, sanctions, and legal challenges. The dual-use nature of such technology – ostensibly developed for fighting terrorism and serious crime, but frequently abused for political surveillance and repression – raises significant ethical and human rights concerns, prompting calls for stricter international regulation.

The complexity of the issue is further compounded by the revelation that Germany itself has a history with such tools. Germany’s central federal law enforcement agency, the BKA (Bundeskriminalamt), reportedly acquired access to NSO Group’s Pegasus spyware in 2019. This acquisition by a democratic government, even if for stated purposes of combating serious crime and terrorism, underscores the difficult balance nations face between security imperatives and privacy concerns. It also highlights the widespread availability and appeal of these potent surveillance technologies across the spectrum of global powers, blurring the lines between legitimate law enforcement tools and instruments of state-sponsored surveillance.

The ongoing targeting of politicians, public figures, and members of civil society with government-backed spyware represents a significant and escalating threat to democratic processes, individual privacy, and national security worldwide. These incidents underscore the urgent need for enhanced cybersecurity defenses, greater transparency in the mercenary spyware industry, and robust international cooperation to address the proliferation and misuse of these powerful surveillance tools. The reliance on “zero-click” exploits means that even the most vigilant users are vulnerable, necessitating a multi-layered approach to security that includes robust detection mechanisms, rapid response protocols, and continuous public education on the evolving landscape of cyber threats. The digital battleground is expanding, and the latest warnings from Apple and the BSI serve as a stark reminder of its pervasive nature and the high stakes involved in protecting digital sovereignty and individual liberties.