Andrew MacAskill, Michael Holden

LONDON (Reuters] – Fiona Shackleton was one of Britain’s top divorce attorneys when Cherie Blair called her late at night.

Blair is an internationally renowned human rights lawyer and told Shackleton her phone was possibly hacked together with her client Princess Haya bint Al-Hussein.

The two women spoke out in subsequent conversations and believed that there was one reason: Haya was Haya’s London custody lawyer. Haya was married to Dubai ruler Sheikh Mohammed bin Rashid al-Maktoum. Court rulings reveal that he was responsible for the hacking.

On Wednesday, the rulings https://www.reuters.com/world/middle-east/dubais-sheikh-mohammed-ordered-phones-ex-wife-lawyers-be-hacked-uk-court-says-2021-10-06 by a senior British judge that the sheikh had hacked his ex-wife’s phones as well as those of her lawyers and security team were published after reporting restrictions were lifted.

A reconstruction of how the hacking was uncovered – based on expert testimony initially given in private and hundreds of pages of court documents – offers a rare account of an operation which would normally be shrouded in secrecy.

According to documents, Blair was hired by NSO as an adviser external to Israel’s security organization. On Aug. 5, Blair sent Shackleton an email to inform him that there was an urgent need to talk with her tonight and that it didn’t really matter when.

Blair was “incredibly anxious”, Shackleton stated in his witness testimony to the court.

Blair testified in her witness testimony that she was informed by an NSO senior manager that they were worried about the misuse of its powerful and sophisticated spyware tool Pegasus. This is only for nation states and can be used to fight terrorists.

She was asked by the firm to contact Shackleton.

Blair stated that “the NSO Senior Manager informed me that they had taken steps for ensuring the phones couldn’t be accessed again,” in a statement made to the High Court of London.

According to the Israeli firm, while it was unable to comment directly on the situation immediately, they stated that it will take appropriate action should it receive evidence regarding misuse of Pegasus.

Blair stated that she worked for NSO, and Pegasus was involved.

Blair spent the following week researching the NSO investigation.

Blair was told by the NSO manager in a WhatsApp conversation that “Cherie” there is no evidence of other participants in the operation, which was apparently referring specifically to Fiona Shackleton and Princess Haya.

Blair spoke with Shackleton on August 11, and although she was not told the identity of the NSO client, she assumed it to be Dubai.

Blair explained that Blair made the statement in court.

“During an interaction with the NSO Senior Manage, I remember asking if their client was the ‘big state’ or the ‘little state’. According to the NSO Senior manager, it was the little state’. I believed this state to be Dubai.

Blair and Shackleton did not immediately respond to our request.

Mohammed, who claimed the findings of the court were wrong and that they were based on an incomplete view, rejected them Wednesday.

“I’ve always refuted the charges against me. I do not believe them. “These matters concern pretended operations of state security,” he stated in a statement.

MR.X

Separately on the other shore of the Atlantic was Bill Marczak. He was a researcher at Citizen Lab in Toronto and had been following the usage of Pegasus against an UAE activist known only as “Mr X”, the court heard.

He discovered that there was an increase in activity around Pegasus since July 2020. This sophisticated wiretap system is used to extract data from mobile phones of certain suspected terrorists and major criminals.

Marczak observed that between July 12, and Aug. 3, Mr. X downloaded data to four domain addresses, which he believed were related to Pegasus.

Pegasus’ misuse was discovered by NSO on Aug. 4, when he found out that it was being used to attack lawyers at Payne Hicks Beach, Shackleton’s law firm (PHB).

Martyn Day from London, who Day knew, was informed. Day sent PHB an email the following day to inform them of possible hacking. This was just hours before Cherie Blair called.

Marczak then had a conversation with Dominic Crossley from PHB’s Head of Dispute Resolution.

“Looks like UAE government. According to court records, Crossley wrote a handwritten note about the conversation that was difficult to pin down.

Marczak sent Crossley an email in the wee hours of August 7, 2007.

His words were: “We were able to locate the few people connected to Princess Haya’s case, whose phones seemed to have been spy on recently by Pegasus.”

According to the court, he found that 6 devices had been compromised by September, including the phones of Haya Shackleton and Nick Manners (a fellow lawyer) and the Princess’ security staff.

Marczak discovered that Haya had uploaded 265 Megabytes of data to his phone. This is equivalent to 24 hours voice recording and 500 photos. He was not able to determine exactly what data had been uploaded from Haya’s phone.

VENDETTA MALICIOUS

NSO conducted its own investigation during August. Staff members visited clients they suspect were behind the misuse of Pegasus.

“Baroness Shackleton stated that Her Royal Highness will probably be seen as an enemy of the UAE state. Cherie Blair stated that she believed it to be a malicious vendetta against Princess Cherie. They were also in violation of their software license,” Haya’s lawyer Charles Geekie informed the court.

Shackleton heard it from Claire Blair. She said that they didn’t use the software to locate genuine terrorists. The client didn’t want to be tied to such behavior and wanted to do something to change it.

NSO sent a court letter in December 2020 claiming that their software allowed governments to violate human rights.

The investigation could not determine if hacking occurred before July 7, or when.

The letter stated that “While the Investigation couldn’t make any definitive conclusions about what actually happened, it was recommended that the customer’s contract be ended and that all systems that that customer owned be closed down.”

The contract ended on December 7.

Geekie said to the court that Haya’s staff had only one link with Shackleton.

He said, “That’s Sheikh Mohammed.”