For more than a decade, journalists and human rights activists across the world have been targeted by governments using sophisticated spyware to hack their phones, often exposing them to intimidation, harassment, and in extreme cases, deadly violence. Countries linked to such surveillance include Ethiopia, Greece, Hungary, India, Mexico, Poland, Saudi Arabia, and the United Arab Emirates.
In response to this growing threat, a small team of digital security experts working with the New York based nonprofit Access Now has become a critical support system for vulnerable communities. Operating through its Digital Security Helpline, the team assists journalists, human rights defenders, and dissidents who suspect their devices have been compromised by mercenary spyware developed by firms such as NSO Group, Intellexa, and Paragon.
Led by incident response head Hassen Selmi, the helpline operates around the clock, with staff based in regions including Costa Rica, Manila, and Tunisia. Selmi explained that the goal is to provide immediate and trusted support whenever civil society actors experience a cybersecurity incident, helping them understand what has happened and what steps to take next.
The helpline has gained global recognition, with technology giant Apple directing users who receive threat notifications about mercenary spyware attacks to Access Now for assistance. Digital rights experts say the move reflects the helpline’s growing reputation as a frontline resource for investigating spyware abuse, despite the small size of the nonprofit team.
According to Access Now, the helpline now reviews about one thousand suspected spyware cases each year. Roughly half of these are investigated further, while only a small fraction result in confirmed infections. This marks a significant increase from a decade ago, when the team handled only a few dozen cases monthly, a rise Selmi attributes to the spread of spyware, increased awareness of the helpline, and targeted outreach to at risk communities.
When a report is received, investigators first verify that the individual falls within the helpline’s mandate, then carry out a step by step technical assessment of the device. Victims are also guided on safety measures, including whether to change devices or take additional precautions, with communication often handled in the victim’s own language.
Beyond individual cases, Access Now also supports similar investigative groups worldwide through a coalition known as CiviCERT. Selmi said the network has helped extend protection to journalists and activists in regions that would otherwise lack access to digital security support, ensuring that victims, regardless of location, have someone who understands their context and can help them respond effectively