A leaked list of phone numbers reveals how Rwandan President Paul Kagame’s regime used Pegasus spyware sought to track political opponents and members of his own party.
Key Findings
- Leaked data suggests Anne Rwigara, the late sister of presidential candidate Diane Rwigara, was selected as a target of Pegasus spyware in February 2019
- Other potential Pegasus targets include several former ministers, including the former justice minister Tharcisse Karugarama
- Multiple sources confirm Rwanda’s access to Pegasus was revoked in 2021
The December 28, 2023, death of Anne Rwigara in California took family members by surprise. Anne, 41, was the sister of Diane Rwigara, a Rwandan opposition figure who previously tried to run for president. Anne had no prior health issues and complained to family about stomach pain.
Between unexpected deaths and prolonged prison stints, the Rwigara family had already suffered multiple tragedies. In 2015, Assinapol, the father, died in a mysterious road accident. Assinapol was a businessman and financer of Rwanda’s RPF party, helmed by President Paul Kagame, who has ruled Rwanda with an iron fist for over 20 years. Two years later, when Diane sought to run for president, nude photos were leaked after she announced her candidacy. She was later barred from running by the Electoral Commission, in 2017, and she and her mother Adeline were charged with fraud and inciting insurrection, and served more than a year in prison.
Diane and Adeline were acquitted in December 2018. The Rwandan state, however, didn’t let the Rwigara family out of its sight. In February 2019, a phone number belonging to Anne was added to a list of Pegasus spyware targets. This spyware tool, sold by the Israeli company NSO Group, allows state intelligence services to infiltrate phones remotely, without the user’s awareness.
Forbidden Stories was unable to perform a forensic analysis of the device, and therefore could not confirm whether it was successfully infected. Nevertheless, the addition of Anne’s phone number, which was confirmed by multiple sources, to a list of potential Pegasus targets suggests that she was a person of interest for a Rwanda-based client operating the spyware tool.
Anne was one of at least a dozen Rwandan political figures and their family members whose phone numbers were selected as Pegasus targets, Forbidden Stories found as part of the Rwanda Classified project, published jointly by 17 media outlets and coordinated by Forbidden Stories.
A phone number belonging to Anne Rwigara, the sister of presidential hopeful Diane Rwigara, was added to a list of leaked phone numbers – potential targets of Pegasus spyware – in February 2019.
Pursuing the work of the late journalist John Williams Ntwali, who had investigated the death of Assinapol Rwigara before he himself was found dead in January 2023, Forbidden Stories and its partners spent months digging through previously unexploited Pegasus data, part of the data leak that led to the 2021 Pegasus Project. The leaked data suggests that high-profile targets, even within Kagame’s own RPF party, may have been regularly under surveillance.
Out of respect for the privacy of victims, Forbidden Stories is only naming those individuals who are public figures, having previously served or currently serving in office. These include Tharcisse Karugarama, Rwanda’s former justice minister, selected as a target in October 2017. A phone number belonging to former Minister of Infrastructure James Musoni was selected as a surveillance target amid allegations of corruption and a cabinet reshuffle in April 2018. Musoni is Rwanda’s current Ambassador to the Republic of Zimbabwe. At least two phone numbers belonging to Professor Nshuti Manasseh, Rwanda’s current Minister of State for East African Community Affairs, were also selected as surveillance targets in 2018.
Forbidden Stories was unable to establish why these individuals were targeted, nor were we able to access the phones to conduct a forensic analysis. Both Musoni and Manasseh were previously involved with Crystal Ventures, an investment company founded in 1995 and run by the Rwandan state, which allegedly controlled about $500 million in assets within the country in 2012. Manasseh was chairman of the board until 2013. Various media outlets have reported that Musoni was also involved in Crystal Ventures, and some have alleged that he was the “de facto head” of the company. (Musoni and Manasseh did not respond to multiple requests for comment.)
Karugarama, the former justice minister, was removed from office in 2013, reportedly after foreign journalists suggested he had contested Kagame’s decision to run for a third term.
“In many cases that we’ve investigated with Pegasus, we’ve seen a blend of ally targeting and opponent targeting,” John Scott-Railton, a Senior Researcher at the University of Toronto’s Citizen Lab, said. “And it doesn’t surprise me that there would be a dynamic in which both people who are viewed as important allies, or people whose political viability and reliability is important, would be targeted for scrutiny as well as people who are viewed as enemies and opponents.”
Rwanda’s alleged use of spyware to track dissidents didn’t stop at its own borders. In 2021, the Pegasus Project revealed that the phone of Carine Kanimba, the daughter of human rights defender Paul Rusesabagina, had been infected with Pegasus spyware in Belgium. Past reporting from the Financial Times documented Pegasus use against dissidents in Belgium, the UK and South Africa.
Other potential targets revealed at the time included Gatera Gashabana, a lawyer who represented the Rwigara family, as well as a journalist who covered the case against Diane and her mother Adeline.
Grady Vaughan, a researcher at the NGO Freedom House, which has studied Rwanda’s transnational repression, explained that this type of surveillance is typical of authoritarian regimes. “A lot of times spyware is used to find out where someone lives, and then their family members may be harassed,” he said. “Ultimately, this may lead to a physical assault or assassination.”
Pegasus can be used to infiltrate phones remotely, without the user’s awareness. Credit: Forbidden Films
Rwanda, for its part, has officially denied using Pegasus. But multiple Israeli intelligence sources confirmed to Forbidden Stories’s partner Haaretz that the country had signed a contract by 2017, with the participation of a Rwandan police officer. According to those sources, the contract was either ended or not renewed in 2021. (A Rwandan government spokesperson did not respond to questions sent by the consortium. The Rwanda National Police did not respond to our request for comment.)
In an email, NSO Group, which sells Pegasus, insisted that its technology is “only sold to vetted intelligence and law enforcement agencies” for use “to prevent crime and terrorist attacks.” While NSO cannot confirm or deny specific customers, a spokesperson added: “We would like to emphasize that NSO has had no active clients in Rwanda since 2021.”
Scott-Railton of Citizen Lab, which first identified Pegasus activity in Rwanda in June 2017, confirmed that the watchdog had not seen recent Pegasus activity. “We see no evidence indicating that Rwanda is a current customer,” he said.
Rwanda, meanwhile, is gearing up for presidential elections on July 15. Kagame is widely expected to win.
Diane Rwigara – whose sister’s death remains elusive – announced on May 8 in a post on X (formerly Twitter) that she was planning on running for office against Kagame in the 2024 elections. “A new chapter for Rwanda begins now. Together we will make history! Join me as I run for President,” she wrote.
