Four years after Calcalist published its investigative report on the Pegasus affair, which described the alleged use of spyware without judicial authorization, the state comptroller’s report released Tuesday afternoon addressed the issue, saying that “the audit uncovered the performance of prohibited actions by the police in the field of wiretapping and the use of technological tools.”
The report, which covers the years 2011–2021, does not detail specific cases or name those responsible. However, it clearly points to the use of spyware by the police, which for years sought to rebut such claims. Below are the police’s assertions, set against the comptroller’s findings.
2 View gallery
Former police commissioners Roni Alsheikh and Kobi Shabtai, a former investigations chief and the police legal adviser
(Photo credit: Ohad Zwigenberg, Avigail Uzi, Alex Kolomoisky)
On the day Calcalist published its Pegasus investigation, January 18, 2022, Israel Police said in a statement that “there is no truth to the claims raised in the article. All police activity in this field is conducted in accordance with the law, on the basis of court orders and meticulous work procedures. There are enhanced oversight and control mechanisms in this field, both within and outside the organization. We regret the attempt to harm police activity without basis.”
The comptroller’s report states that “since 2016, the police have used a certain technological tool hundreds of times without its use being regulated in legislation; without it being examined and approved by the government’s legal advisory bodies; and without the police holding a principled legal discussion on the matter with the government’s legal advisory bodies.”
Former Police Commissioner Shabtai: 'There is not and never was such a scenario'
Former Police Commissioner Kobi Shabtai wrote to officers on January 21, 2022: “There is not and never was a scenario in which the Israel Police, in an institutionalized and systematic manner, violated the privacy of innocent citizens and demonstrators. There is not and never was a scenario in which the police breached the unwritten covenant of protection between it and the citizens of the state. The technological tools at our disposal are directed at criminals or those seeking to carry out dangerous offenses. We safeguard these capabilities and supervise their use in the strictest manner.”
By contrast, the comptroller wrote that cases were identified “in which prohibited actions were carried out that harmed the right to privacy due to the production of prohibited outputs or the use thereof. The production of prohibited outputs and the use of such outputs cause severe harm to public trust in the police, and as a result, to its ability to fully utilize its overt and covert resources in the fight against crime.”
The words “prohibited” or “prohibition” appear 317 times in the report.
Former investigations chief: 'Police use surveillance tools? An unreliable narrative'
Former head of the police Investigations and Intelligence Division Yigal Ben Shalom said in an interview on January 21, 2022, that “the narrative being created around the claim that the Israel Police use surveillance measures against innocent citizens is entirely unreliable. We operate against criminals. If you are not a criminal, I am not going into your phone. We completed our own review and did not find a single substantiation of what was stated in the article. We acted in accordance with the law.”
The comptroller’s report found that “the audit identified 19 cases from 2019–2021 in which the police carried out prohibited installations or installations whose legality is in doubt — installation of a technological tool against an innocent target due to human error; installation without an appropriate warrant; and installation without a valid warrant. In addition, five cases were identified in which it was determined after the fact that the police carried out prohibited installations without authority or by exceeding authority, including use of an improper installation framework and use of technological tools prior to their legal approval.”
The term “innocent target” or “innocent targets” (that is, individuals not suspected of wrongdoing) appears six times in the report.
Police legal adviser: 'An erroneous journalistic article'
Police legal adviser Elazar Kahana wrote in an official letter on January 23, 2022, that “many parties were drawn into reaching conclusions and leveling serious accusations on the basis of an erroneous journalistic article. The Israel Police operate in the SIGINT-cyber domain within their legal authority and solely on the basis of judicial warrants. I clarify that the tools operated by the operational array are examined from a legal standpoint prior to their use. It would not be an exaggeration to state that this is the most supervised and controlled field in the Israel Police.”
The comptroller nevertheless concluded that “over the years, the police and the Attorney General’s Office in the Ministry of Justice engaged in partial legal regulation based on a shaky legislative foundation that does not survey the full range of technological tools and actions the police seek to carry out in the field of wiretapping. Circumvention mechanisms were created for the proper process of submitting requests, such that they no longer require approval by senior police officials, the State Attorney’s Office or judicial review. These mechanisms allow approval for wiretapping and the use of technological tools under increasingly lax supervision and without external oversight.”
The words “supervision and oversight” appear 53 times in the report.
Former deputy investigations chief: 'We found no wiretap conducted unlawfully'
Former deputy head of the Investigations and Intelligence Division Yoav Telem said during a Knesset Constitution Committee discussion on February 1, 2022: “So far, we have not found a single wiretap that was not conducted lawfully — meaning a wiretap carried out without a court order or without supervision and oversight mechanisms. We have not found any indication at this stage of improper or illegal use by anyone in the police of the outputs. Over the years, we understood that it is necessary to ensure that the technologies we acquired include developments and restrictions, including the degradation of capabilities, so that there are no automatic downloads of materials that are not being used.”
According to the comptroller, “the police used a certain technological tool intended to collect wiretap outputs as a supporting tool in producing outputs. The tool enabled, incidentally and due to the police’s failure to technologically degrade it, the production of outputs whose production and use are prohibited. In January 2016, a professional official in the Cyber Division detailed in an internal document all types of outputs produced by this tool in order to obtain legal approval. The list included about 10 prohibited outputs and capabilities, but these were not neutralized.”
The word “degradation” appears 22 times in the report.
Former head of the police cyber-SIGINT unit Yoav Hassan said in an interview with Reshet News on February 7, 2022, that “there is oversight and there is supervision under the leadership of the attorney general, and the people who do it are highly skilled. I did not encounter significant deviations throughout my service in the police. By its nature, this is the most treated, reviewed and supervised subject in the Israel Police, because it intrudes into people’s privacy.”
The comptroller found that “until the publication of the Pegasus affair in January 2022, not only were the prosecutors handling cases in which confidentiality orders were sought unfamiliar with the full capabilities of the technological tools used by the police, but district prosecutors were also unaware of them. In practice, the police did not customarily update district prosecutors during confidentiality hearings regarding their use of technological tools.”
Former Police Commissioner Alsheikh: 'The police do not have Pegasus'
Former Police Commissioner Roni Alsheikh said in a briefing on February 8, 2022: “There is no situation in which someone can carry out any action without authorization. A warrant is issued; all logs are preserved — who used it and what permissions they had.”
The comptroller added that “decentralized management of production complicates the management of activities in the wiretapping registry, oversight of the identities of those who reviewed the wiretap outputs or the intelligence products derived from them, and examination of the alignment between the implementation of the wiretap and the limitations of the warrant. This conduct limits the ability to supervise and oversee production, manage the chain of evidence in intelligence matters and investigative files, and conduct debriefings and draw lessons from events in which there is suspicion that a prohibited action was taken.”
The words “stored” or “accumulated” appear 49 times in the report.
Alsheikh also said at a conference at Reichman University on February 13, 2022, that “to remove any doubt, the Israel Police do not have Pegasus. Pegasus is a tool that extracts the entire contents of a phone remotely. The police are permitted to conduct wiretaps or searches, and perhaps sometimes want more — but they operate subject to the court.”
At a conference of the Kibbutz Industry Association on March 1, 2022, Alsheikh said that “the distinction between Pegasus and the police tool is like comparing a Kia to a Porsche. When you operate Pegasus, you have the entire history of the phone. With the police tool, you only have the days during which the tap was authorized. The police acted precisely in accordance with the law and its interpretation.”
The comptroller concluded that “for years, the police operated a certain technological tool for wiretapping communications between computers, which the attorney general later determined — after being presented with the full capabilities of the tool following the outbreak of the Pegasus affair — included certain capabilities that exceed the police’s authority under the Wiretap Law, and therefore the police are prohibited from using it until those capabilities are degraded.”
The report further states that until January 2022, prosecutors were not informed of the full capabilities of the technological tools used to install them on end devices for the purpose of wiretapping computer-to-computer communications and producing outputs that form part of investigative materials.
In its conclusion, the report says that a review of police work processes in the field of wiretapping reveals significant and fundamental operational gaps. These led to serious and harmful actions in submitting requests, installing technological tools on end devices, collecting wiretap outputs, producing them and using them. At the root of the problem, the comptroller wrote, are substantial deficiencies in regulation.
The word “Pegasus” is mentioned 21 times in the report.