German cybersecurity agency warns Bundestag members after Apple spyware alerts

Members of Germany's parliament are among the people who have been told their iPhones may have been targeted by state-backed spyware, TechCrunch reports. The warning came from the country's federal cybersecurity office, the BSI, a few days after Apple began sending threat notifications to affected users.

What the authorities have said

In a note published over the weekend, the BSI said it had learned that members of the Bundestag, along with other notable individuals it did not name, had received Apple alerts about possible cyberattacks. A government spokesperson, Stefan Kornelius, said Berlin was treating the warning very seriously, according to the Financial Times. He did not identify which officials had been targeted or say whether Chancellor Friedrich Merz was one of them.

Apple's notices do not confirm that a phone has actually been breached, and the company does not name any government as responsible. Because of that uncertainty, the BSI advised that recipients "should therefore assume that their device may have been compromised."

A wider campaign

The alerts were not limited to Germany. According to a notice seen by one recipient outside the country, Apple's latest round of warnings reached users in 99 countries. Who is behind the attacks, and which government may have ordered them, remains unknown.

Spyware of this kind can extract messages, location data and other sensitive information. It often uses so-called zero-click exploits, which can infect a device without the owner tapping a link or opening a file, making the intrusion very hard to notice.

Governments seldom develop such tools on their own and frequently buy them from private companies described as mercenary spyware vendors. The best known is Israel's NSO Group, maker of Pegasus. Germany's federal criminal police agency, the BKA, reportedly acquired access to Pegasus in 2019.

What it means for users

For anyone following computer and internet security, the case is a reminder that mobile devices are a prime target for sophisticated surveillance. Keeping operating systems updated, taking any security warning from a device maker seriously and seeking expert help after an alert are sensible steps, particularly for people in public or sensitive roles.