Thailand’s Digital Economy and Society Minister met Apple representatives on Wednesday, November 11, over the iPhone spyware alerts that Thai politicians received on October 29. Minister Chaichanok Chidchob says getting an alert does not mean a phone was hacked, and Thai authorities have no evidence that Pegasus was involved.
Bloomberg reported the meetings, and Apple told the outlet that it sent the notifications on October 29 after detecting activity consistent with mercenary spyware attacks. That wave covered 99 countries, compared with 110 countries in Apple’s August threat notifications. Apple sends these alerts to users who may have been individually targeted, likely because of who they are or what they do.
iPhone Spyware Alerts Hit Thai Politicians
Former prime minister Abhisit Vejjajiva, who leads the Democrat Party, confirmed on November 2 that he received an Apple warning. Nattapong Ruangpanyawut, the People’s Party leader, posted a screenshot of his own alert on Facebook on November 3.
Apple warned Abhisit that his professional activities and political responsibilities might explain the targeting. He turned on Lockdown Mode, and a preliminary check by people familiar with such attacks found no sign that his phone was breached, although no full forensic investigation has been completed.
The alerts arrived ahead of a no-confidence debate against Prime Minister Anutin Charnvirakul, which is expected for December 7 to 11. Nattapong questioned the timing, but nothing so far connects the alerts to the debate.
Thailand Rejects State Involvement
On November 3, Chaichanok said the warnings do not show which technology was used and that his ministry had no evidence linking them to Thai security agencies. He said officials were contacting Apple and specialists for more information.
Pegasus, the spyware made by Israel’s NSO Group, has a history in Thailand. Citizen Lab reported in July 2022 that Pegasus infected at least 30 activists, lawyers and academics between October 2020 and November 2021, and the operators were never identified. Apple sent threat notifications to Thai activists in November 2021, the last month of that period.
Government spokesman Ekkapob Pianpises rejected claims that Thai authorities were behind the attacks, and he acknowledged that Thai agencies had earlier submitted budget requests to buy Pegasus. He said no Pegasus funds were allocated in the current or previous fiscal year.
Chaichanok described the Apple meeting as one in a series of discussions, with more talks with technology companies set for November 12. His ministry plans to work with the National Security Council and the National Cyber Security Agency, and officials say a security plan could be ready the week of November 16.
Apple Recommends Lockdown Mode
Apple does not say what triggers an alert. After one arrives, Apple recommends turning on Lockdown Mode and getting expert help, and recipients can reach Access Now’s Digital Security Helpline at any hour.
To check that an alert is real, sign in at account.apple.com, where a genuine notification appears as a banner at the top of the page. Apple never asks you to click links, open files, install apps or share a password or verification code.
Apple does not name who is behind an attack, so Thailand cannot get an answer from the alerts alone. I think any answer will have to come from a forensic check of a handset, and Abhisit has declined a government offer to examine his phone.
