Lebanese journalist Radwan Mortada’s announcement that he received a fresh Apple mercenary spyware warning requires urgent protective measures and an independent investigation. The notification reproduced with his account states that Apple detected another attack against his device, following an earlier warning on 23 November 2021. It says the latest notification round reached targeted users in 99 countries.^[1] This is evidence warranting serious attention; it is not, by itself, forensic confirmation that spyware was successfully installed.

The National Human Rights Commission, including the Committee for the Prevention of Torture (NHRC-CPT), calls for a response centred on the journalist’s safety, protection of confidential sources and preservation of digital evidence. No publicly verified forensic findings reviewed for this briefing identify the software, operator or commissioning authority in Mortada’s latest case. His reporting on Lebanon’s 2024 pager explosions provides relevant context.

1. Scope and evidential limits

This briefing draws on an interview with journalist Radwan Mortada and a screenshot of the Apple notification addressed to him, dated 29 October 2026, held by the National Human Rights Commission, as well as a link to his X post as an additional reference for his public testimony.^[2] Media coverage of the current round of notifications was published on 30 October 2026.^[3]

The briefing provides a preliminary human rights assessment, rather than a digital forensic examination. No technical examination of Mortada’s device was conducted in preparing it; it therefore reaches no definitive conclusion about whether his device was successfully compromised, the type of spyware used or the identity of those responsible for the targeting. Information concerning his experience and the circumstances in which he received the notification is attributed to his interview testimony, while general technical findings draw on specialist publications with identifiable sources.

2. What the warning establishes

Apple’s new message states that this latest notification is separate from the 2021 warning and concerns another detected attack. Its reference to 99 countries describes the geographical reach of this notification round, not 99 attacking governments, a victim count or confirmed infections. The reference to more than 150 countries concerns notifications issued cumulatively since 2021.

Apple describes these alerts as assessments made with high confidence, while acknowledging uncertainty and withholding detection details that could help attackers evade identification.^[4] Amnesty International’s Security Lab likewise distinguishes an attempted compromise from a successful infection: subsequent forensic examination is necessary to establish whether spyware was installed.^[5] A notification therefore justifies immediate assistance without supporting conclusions about every stage of an attack.

The investigation should establish whether earlier security incidents were documented. The date of a notification must be recorded separately from any dates of suspected exploitation: a warning can concern activity detected retrospectively. Technical findings should state their confidence level and identify gaps that prevent firmer conclusions.

Nor does the alert identify Pegasus, NSO Group, another vendor, or a particular state. Naming familiar spyware products as examples must not become attribution. Repeated notifications also do not establish uninterrupted surveillance between 2021 and 2026, use of the same software, or involvement of the same operator.

3. Mortada’s testimony and the Lebanese context

Mortada stated in an interview conducted in preparing this briefing that he received the notification and did not know whether the targeting was connected to his film about Lebanon’s 2024 pager explosions.

There is independent historical evidence supporting his account of the earlier warning: Human Rights Watch reported in January 2022 that Mortada posted in November 2021 about notifications he received from Apple.^[6]

Lebanon also has a documented precedent involving a human rights researcher. Human Rights Watch reported that Pegasus targeted its Beirut office director, Lama Fakih, five times between April and August 2021. The organization’s digital forensic findings were independently peer reviewed and confirmed by Amnesty International’s Security Lab.^[7]

4. Lessons from comparable investigations

Amnesty International’s Security Lab has repeatedly shown why initial warnings must be followed by careful technical work. Its April 2024 guidance explains that examination of devices belonging to notification recipients has, in numerous cases, established targeting and compromise, including with Pegasus.^[8]

In March 2025, the Security Lab documented Pegasus targeting of two journalists from the Balkan Investigative Reporting Network in Serbia. One journalist, identified by a pseudonym, did not open the malicious link; researchers found no indication of successful installation on her phone.^[9] This illustrates why a documented attack attempt must not be reported automatically as a completed hack.

Different products can also generate similar initial warnings. In June 2025, Citizen Lab reported forensic evidence linking attacks against two journalists to Paragon’s Graphite spyware after Apple notifications. It confirmed compromise of an anonymous European journalist’s device and targeting of Italian journalist Ciro Pellegrino.^[10] The distinction between these findings matters. Investigators should test competing technical explanations rather than assume that every mercenary spyware warning concerns Pegasus.

5. Human rights at risk

The International Covenant on Civil and Political Rights protects privacy and correspondence under Article 17, freedom of expression under Article 19, and access to an effective remedy under Article 2(3).^[11] Unlawful surveillance of a journalist can affect all three. It may reveal confidential sources, unpublished investigations and personal information about people who never consented to disclosure.

These risks extend beyond the person whose phone is targeted. A source fearing identification may abandon contact; a witness may withhold evidence; colleagues may censor their reporting. Such consequences are foreseeable risks, not established outcomes in Mortada’s case. Protection must apply regardless of a journalist’s political views, employer or the popularity of their reporting.

States must ensure that surveillance complies with legality, necessity and proportionality and is subject to effective independent oversight. Invoking national security does not dispense with these requirements. The Office of the UN High Commissioner for Human Rights has called for a moratorium on hacking tools until adequate safeguards exist.^[12] Any investigation must also safeguard the journalist’s sources: assistance must never become an opportunity for unrestricted access to his reporting materials.

6. Immediate protection and evidence preservation

Mortada should have access to independent specialists through a secure channel and with informed consent. Apple recommends verifying notifications by signing in directly to its account website, enabling Lockdown Mode and seeking expert assistance, including from Access Now’s Digital Security Helpline.^[13] Amnesty International’s Security Lab also accepts requests for forensic support from at-risk journalists and other civil society members.^[14]

Protection and evidence preservation should be planned together. Specialists should advise on securing communications and documenting the device’s condition before potentially destructive actions, including a factory reset. Investigators should retain original notification messages and relevant metadata, document handling and transfers, and restrict access to collected material.

The journalist and specialists should agree how to contact potentially affected sources without unnecessarily exposing their identities or spreading unverified claims of compromise. Sensitive conversations may need to move to a separately secured device while assessment continues. These decisions should follow an individual risk assessment, including the safety of people whose information might be present on the phone.

Any examination should specify what information will be extracted, who can see it, how long it will be retained and how unrelated journalistic material will be protected. A negative forensic result should be explained with its limitations; it should not automatically be presented as proof that no targeting occurred.

7. Recommendations

The National Human Rights Commission, including the Committee for the Prevention of Torture, calls on the Public Prosecutor at the Court of Cassation to promptly assess the information concerning the reported attack and open an independent and impartial investigation where the legal grounds exist. The investigation should draw on specialist technical expertise, ensure that evidence is preserved in accordance with the law and establish responsibility. The Commission also calls for the public to be informed of progress that can be disclosed, while safeguarding the confidentiality of the investigation, protecting sources and privacy, and ensuring the integrity of proceedings.

The Lebanese authorities should establish a confidential referral mechanism for journalists and human rights defenders receiving spyware warnings. Participation must be voluntary, with access to independent technical and legal assistance. Protection should not depend on surrendering unrelated devices, source identities or unpublished work.

Parliament and government should strengthen oversight of surveillance procurement and deployment, require meaningful transparency and ensure effective remedies for unlawful surveillance. They should prohibit spyware whose capabilities prevent rights-compliant use and suspend relevant transfers and use pending adequate safeguards. These measures reflect concerns raised by UN human rights mechanisms.^[15]

The NHRC-CPT should offer a confidential channel for receiving relevant information and monitor the authorities’ response within its mandate. Any subsequent public update should distinguish testimony, documentary evidence and technical findings, explain corrections, and seek responses from actors facing substantiated allegations. Publication decisions should prioritize consent and avoid releasing exploit indicators or personal details that could create additional risks.

Technology companies should continue timely warnings, security updates and support for independent research. Surveillance vendors and their investors should prevent and address human rights harms connected to their activities. Media organizations should fund digital protection and confidential incident response. Such support should cover freelance journalists equally and include follow-up assistance when an initial assessment leaves significant technical questions unresolved. The immediate priority is practical protection for Mortada and his contacts, alongside a credible process capable of establishing what happened and securing accountability.

^[1] Apple, notification concerning detection of a targeted mercenary spyware attack against journalist Radwan Mortada’s iPhone, 29 October 2026; a screenshot of the notification is held by the National Human Rights Commission. The notification refers to detection of a new attack, separate from the earlier notification sent on 23 November 2021.

^[2] Radwan Mortada, X post including an image of an Apple notification concerning the targeting of his phone with mercenary spyware, available at: https://x.com/radwanmortada/status/2116163605796200693/photo/1 .

^[3] Tim Starks, CyberScoop, “Apple notifications alert victims in 99 countries about mercenary spyware infections”, 30 October 2026, https://cyberscoop.com/apple-spyware-notifications-pall-mall-process  .

^[4] Apple, “About Apple threat notifications and protecting against mercenary spyware”, 13 August 2026, https://support.apple.com/en-us/102174 (accessed on 1 November 2026).

^[5] Amnesty International Security Lab, “Apple threat notifications: What they mean and what you can do”, 11 April 2024, https://securitylab.amnesty.org/latest/2024/04/apple-threat-notifications-what-they-mean-and-what-you-can-do  .

^[6] Human Rights Watch, “Human Rights Watch among Pegasus spyware targets”, 26 January 2022, https://www.hrw.org/news/2022/01/26/human-rights-watch-among-pegasus-spyware-targets . NSO Group told Human Rights Watch it was unaware of an active customer using its technology against a Human Rights Watch staff member and would undertake an initial assessment.

^[7] Human Rights Watch, “Human Rights Watch among Pegasus spyware targets”, 26 January 2022, https://www.hrw.org/news/2022/01/26/human-rights-watch-among-pegasus-spyware-targets . NSO Group told Human Rights Watch it was unaware of an active customer using its technology against a Human Rights Watch staff member and would undertake an initial assessment.

^[8] Amnesty International Security Lab, “Apple threat notifications: What they mean and what you can do”, 11 April 2024, https://securitylab.amnesty.org/latest/2024/04/apple-threat-notifications-what-they-mean-and-what-you-can-do .

^[9] Amnesty International Security Lab, “Serbia: Journalists targeted with Pegasus spyware”, 27 March 2025, https://securitylab.amnesty.org/latest/2025/03/journalists-targeted-with-pegasus-spyware/ . NSO Group’s response, reproduced in the research, states that it cannot comment on specific customers and affirms its commitment to respecting human rights.

^[10] Bill Marczak and John Scott-Railton, Citizen Lab, “Graphite caught: First forensic confirmation of Paragon’s iOS mercenary spyware finds journalists targeted”, 12 June 2025, https://citizenlab.ca/research/first-forensic-confirmation-of-paragons-ios-mercenary-spyware-finds-journalists-targeted

^[11] International Covenant on Civil and Political Rights (ICCPR), Articles 2(3), 17 and 19, https://2covenants.ohchr.org/About-ICCPR.html .

^[12] UN Office at Geneva, “Bi-weekly press briefing”, 16 September 2022, section “Privacy in the digital age”, reporting the findings and recommendations of the Office of the UN High Commissioner for Human Rights, https://www.unognewsroom.org/story/en/1287/bi-weekly-press-briefing-16-september-2022

^[13] Apple, “About Apple threat notifications and protecting against mercenary spyware”, 13 August 2026, https://support.apple.com/en-us/102174 (accessed on 1 November 2026).

^[14] Amnesty International Security Lab, “Apple threat notifications: What they mean and what you can do”, 11 April 2024, https://securitylab.amnesty.org/latest/2024/04/apple-threat-notifications-what-they-mean-and-what-you-can-do  .

^[15] UN Office at Geneva, “Bi-weekly press briefing”, 16 September 2022, section “Privacy in the digital age”, reporting the findings and recommendations of the Office of the UN High Commissioner for Human Rights, https://www.unognewsroom.org/story/en/1287/bi-weekly-press-briefing-16-september-2022

هذه المقالة متاحة أيضًا بـ: