[Beyond Borders] This column explores the key issues shaping life in the South Caucasus, focusing on how the divergent paths of Georgia, Armenia and Azerbaijan reflect the region’s complex histories, economic developments, and political shifts. While new generations in these countries grow more isolated from one another due to language barriers and conflicting national trajectories, the same is true for local policymakers, who are often more familiar with distant capitals than their immediate neighbors. Each nation seeks its own path, sometimes in conflict with others, while international actors often treat the region as a whole, reluctant to craft policies specific to individual states. Drawing on personal experience with the region’s revolutions, conflicts and transformations, Olesya brings you Beyond Borders—a column exploring how decisions made in one corner of the South Caucasus impact all who live there. Listen to the AI generated audio article. Your browser does not support the audio element. Some facts only become clear with time. We usually associate this with the opening of secret service archives or the publication of memoirs by senior officials. But sometimes, it takes only a few years for us to learn something new about events we thought were already behind us. Six years after the war in Nagorno-Karabakh, I learned something new about that period, something that made me think about where the boundary between private and public life ends in today’s world. This summer I found myself in Oslo, the Norwegian capital. The annual Oslo Freedom Forum was taking place, and I had been invited to moderate one of the panels. During a break between sessions, I decided to walk around the glass booths lining the corridor of the large hall, where various organizations had set up exhibits. One of them was offering to run an experiment: checking your phone for potential security problems. There was more than an hour before the next session. While the scent of blooming lilacs outside was wonderful, the weather was cold and unpleasant for a walk. So I decided to “kill some time” by getting advice on how to protect my phone from viruses. After all, you can never know too much about these things. I handed over some data from my old phone and had already moved on to see what was on offer in the neighboring booths when someone suddenly came looking for me and asked me to come back. My first thought was that, if they had found a virus, I should ask them to help me avoid losing my family photos and pictures of my beloved cat; those were the most precious things on that device. But what awaited me turned out to be considerably more serious. A simple check, taking just a few clicks, was enough to reveal that my phone had been targeted with a surveillance system called Pegasus. The person working with the organization seemed alarmed and began asking who I was and how this system could have ended up on my phone. All I had to say was that I was from the South Caucasus, and the response was: “Oh, well, that explains it.” It sounded almost like a verdict: surveillance had become so commonplace in relation to the region that the specialists dealing with it had apparently grown more than accustomed to it. I was offered a formal, in-depth investigation, and I agreed. Pegasus in the South Caucasus Pegasus first appeared around ten years ago. Its developer, the Israeli company NSO Group, said the technology had been created to combat terrorism, international criminal networks and other threats. But reports of Pegasus use soon began emerging in different parts of the world, involving the devices of world leaders, political activists, businesspeople, human rights defenders, journalists, researchers, as well as their relatives and friends. Although the company insisted that it did not sell licenses to countries with poor human rights records, investigations documented the use of its technology against people in a number of authoritarian countries. In November 2021, the U.S. Department of Commerce added NSO Group to its Entity List , imposing strict restrictions on the export, re-export and transfer of U.S.-regulated items to the company. In the South Caucasus one of the most widely reported Pegasus scandals involved the targeting of individuals in Armenia during the 2020 war and the political crisis that followed. A group of researchers identified at least 12 Armenian public figures and officials, including journalists, human rights defenders and an employee of an international organization, whose devices had been targeted or infected with Pegasus at different times. The investigation identified suspected Pegasus operators in Azerbaijan, a country that had already been linked to the use of Pegasus against journalists and human rights defenders at home. But Azerbaijan is far from the only country in the region where the surveillance system has been used. Over the past few weeks I have spoken with several current and former Georgian officials, as well as international researchers specializing in cybersecurity. Previously identified cases indicate that the Georgian authorities also used a Pegasus license. And although people with connections to official institutions say the system was never used against opposition figures, civil society or journalists, and was used only against foreign diplomats, there are at least two cases suggesting otherwise. There have also been reports of another surveillance system being used in Armenia, though not Pegasus. I have not found public reports establishing that Israel-based NSO Group provided Pegasus licenses to Russia, Turkey, or, obviously, to Iran. What Pegasus Can See Using Pegasus is extremely expensive. A license can cost millions of dollars and generally comes with a number of restrictions. Packages purchased by foreign intelligence services may limit the number of people who can be targeted or infected simultaneously, as well as the countries in which the system can be used. This means that the use of the system may have to be carefully managed to stay within the terms of a license. Put simply, Pegasus is an extraordinarily expensive tool that can be used against a limited number of people, subject to restrictions on targets, time and location. Infection can happen without any visible signs. You do not even have to do anything, like clicking on a link or answering a phone call. Some versions of Pegasus can infect a device without any interaction from its owner. Once installed, the spyware can access information on the device, including contacts, emails and messages, and may allow operators to listen to calls or activate the microphone or camera to monitor what is happening to you and around you. For a long time even specially trained experts struggled to detect that something had been installed on a device remotely. Although forensic investigations have identified traces of Pegasus infections, these can be difficult to find. Getting rid of surveillance is not that simple either. For example, changing your phone does not necessarily mean you have escaped it. Keeping your phone’s software up to date is an important precaution, but it does not guarantee that a device is free of spyware either. In my case, all the connections that investigators were able to trace dated from October 2020 to July 2021. They always occurred when I was physically in Georgia, and the electronic surveillance stopped when I crossed the border to travel elsewhere, Armenia, for example. The longest period during which the system appeared to remain active was two weeks. After that it had to be installed again for a new period of surveillance. When Work Becomes Personal After learning that Pegasus had once been on my phone, I messaged a good friend who had been through something similar herself. Her first reaction made me think about something that, for some reason, had not crossed my mind until then. “I hope they didn’t do too much damage to you personally and professionally,” she wrote. Surveillance of this kind is often used to blackmail people and force them to do things. In Georgia, this has been a familiar practice for many years. Recordings made through wiretaps and hidden cameras, including intimate footage, have been broadcast on television and leaked online. Women and LGBTQ+ people have been particularly vulnerable to this kind of abuse, with intimate material sometimes used to pressure them or force their cooperation with security services. Nothing like this has ever been attempted against me. And, to be honest, I am still not entirely sure what interest anyone could have had in monitoring my devices, given that the surveillance took place while I was in Georgia. During the period when the war in Nagorno-Karabakh was still ongoing and for several months afterwards, I usually returned to my home in Tbilisi only to rest. I wanted to switch off from work and spend time with my mother, who back then had miraculously survived Covid and continued to suffer from its effects for many months. I rarely had business meetings or conversations in Tbilisi at the time that might genuinely have been of interest to anyone. And my close friends know that I have always had an old-school habit of keeping important information off electronic devices, saving notes from meetings and interviews in large stacks of notebooks instead. The cybersecurity specialists who investigated my case say that electronic surveillance in situations like this is often accompanied by physical surveillance as well. If that was true in my case, there was probably very little for them to report beyond which shops I usually visited and which swimming pool I went to. Still, although this echo of events from several years ago leaves a deeply unpleasant feeling, it is first and foremost a reminder of how easily the boundaries between our private and professional lives can disappear. People who may have spoken to me about work at the time could later have been able to read my most personal messages, right down to my correspondence with my cat’s veterinarian. It is also a reminder of how important it is to protect the sources of information we work with. Many people around me prefer to communicate through Signal to preserve confidentiality. Others use encrypted email services. But perhaps it is also important to remind ourselves from time to time that the people we meet and who share information with us can become unwitting victims of surveillance directed at us, even if they themselves are not the target. For researchers and journalists this question usually comes up under the heading of ethical considerations. But perhaps we need to think about it even more carefully now. Protecting a source is not only about keeping their name out of a published article or avoiding disclosing their identity. Sometimes it also means recognizing our responsibility for the risks people may face simply because they talk to us. About the author Olesya Vartanyan is a conflict analyst with over 15 years of experience in the South Caucasus, specializing in security, peace processes, and foreign policy. She has collaborated with leading international organizations, including the International Crisis Group, OSCE, and Freedom House, where she led research on conflict zones like Abkhazia, Nagorno-Karabakh, and South Ossetia, while contributing to public policy and confidential peace processes. Previously, she worked as a journalist, reporting on security and conflict issues, including groundbreaking coverage for The New York Times during the 2008 Russia-Georgia war. Olesya has received numerous accolades, including the International Young Women’s Peace Award and the EU’s Peace Journalism Prize. She holds master’s degrees from King’s College London and the Georgian Institute of Public Affairs. See all [Beyond Borders] articles here Comment The post A Spy in My Phone appeared first on EVN Report .