Apple spyware alerts to two Thai opposition leaders ignite a Parliament showdown. MP Phakamon demands answers on ฿388.4m in past and proposed surveillance spending. Minister Chaichanok denies involvement, while Pegasus operators remain unidentified.
Thailand’s spyware scandal has intensified after fresh Apple warnings to two opposition leaders triggered a parliamentary confrontation over suspected political surveillance. People’s Party MP Phakamon Nunanan challenged security agencies on Thursday over ฿388.4 million in reported historical and proposed surveillance spending. Meanwhile, Digital Economy and Society Minister Chaichanok Chidchob denied government involvement and maintained that the latest warnings did not prove successful hacking or Pegasus infections. The controversy follows confirmed Pegasus attacks on 30 activists, lawyers and academics during the Prayut administration. With a further ฿100 million in proposed surveillance spending under scrutiny, MPs are demanding answers about who authorised operations, selected targets and controlled the technology.
Thailand’s government faces mounting pressure to disclose its surveillance operations after a People’s Party MP challenged security agencies over suspected political spying. The confrontation came at Parliament on Thursday, November 12, following fresh Apple spyware warnings sent to leading opposition politicians.
More significantly, MPs have identified ฿388.4 million in historical and proposed surveillance expenditure. The controversy has reopened questions about political monitoring dating back six years, including confirmed Pegasus infections involving pro-democracy activists.
People’s Party MP Phakamon Nunanan led the challenge during a parliamentary hearing attended by representatives of Thailand’s principal security agencies. As chairwoman of the House Committee on Political Development, Mass Communications and Public Participation, she demanded explanations about state surveillance.
Phakamon demands answers on political surveillance as Apple warnings reach two Thai opposition leaders
Specifically, she questioned who authorised operations, selected targets and approved spending on technology capable of monitoring citizens. She also challenged the concentration of previously identified spyware victims among opposition politicians, academics and government critics.
Her intervention followed security warnings received by People’s Party leader and Leader of the Opposition Nattapong Ruangpanyawut. Democrat Party leader and former Prime Minister Abhisit Vejjajiva also confirmed receiving an Apple notification.
Both men lead opposition parties preparing for a parliamentary no-confidence debate in December. Yet investigators have not established who targeted their devices or whether the suspected attacks succeeded.
At the centre of Thursday’s confrontation was a reported ฿100 million allocation in the proposed 2027 fiscal budget. Phakamon linked the spending to Pegasus spyware and related surveillance technology.
Separately, committee members identified ฿61.4 million in earlier Circles purchases and ฿227 million for mobile telephone tracking equipment. However, the hearing did not establish that the proposed allocation represented a confirmed Pegasus contract.
Apple meeting and parliamentary hearing put security agencies under pressure over spyware operations
The parliamentary clash followed Wednesday’s meeting between Digital Economy and Society Minister Chaichanok Chidchob and Apple representatives. Officials sought explanations about the company’s latest warnings concerning sophisticated mercenary spyware attacks.
Apple confirmed detecting suspicious activity but did not identify the perpetrators. Nor has the company publicly established that Pegasus was responsible for the latest incidents.
Thursday’s hearing began at approximately 9.20 am, with representatives of Thailand’s principal intelligence and security organisations summoned. Those invited included the Royal Thai Police, Internal Security Operations Command, National Intelligence Agency and Army Intelligence Department.
The National Cyber Security Agency and Ministry of Digital Economy and Society were also represented. Notably, most agencies sent operational representatives rather than their most senior officials.
Phakamon pressed those attending to explain the government’s surveillance capabilities and the procedures governing their deployment. She identified two principal concerns: protecting citizens’ personal information and preventing the political misuse of state surveillance technology.
In particular, she highlighted the pattern of earlier spyware infections involving activists, lawyers, academics and opponents of successive governments. She questioned why government MPs appeared absent from publicly identified targets.
Committee demands names behind surveillance targets and details of proposed Pegasus procurement spending
Her criticism extended beyond the latest Apple warnings. Phakamon demanded identification of officials responsible for selecting surveillance targets and authorising operations. She also sought explanations about whether government agencies maintained lists of politicians and other individuals selected for monitoring.
On another front, she questioned whether state agencies were acquiring equipment specifically to monitor political opponents.
The investigation consequently turned towards government procurement records. Phakamon said the proposed 2027 fiscal budget included ฿100 million for Pegasus spyware and related surveillance equipment.
She demanded clarification from police about whether additional surveillance technology was being purchased. Nevertheless, the committee had not established that the proposed allocation represented a confirmed Pegasus purchase. Nor had it proved that any equipment would be used for unlawful political surveillance.
Another committee member identified earlier purchases involving Circles surveillance technology. According to information presented during the hearing, three Thai agencies acquired the equipment between 2014 and 2020.
Three agencies linked to Circles purchases as phone tracking expenditure reaches hundreds of millions
These were the Army Intelligence Department, Internal Security Operations Command and Narcotics Suppression Bureau. Their combined expenditure was reported at ฿61.4 million. In addition, the committee identified ten procurement projects involving mobile telephone location-tracking equipment, valued at ฿227 million.
The reported Circles and location-tracking purchases therefore amounted to ฿288.4 million. Including the proposed ฿100 million allocation, the surveillance expenditure under scrutiny reached ฿388.4 million.
Crucially, that total combines historical procurement with proposed spending rather than confirmed purchases under one programme. The figures also cover different technologies, agencies and financial periods. Even so, they reveal the financial scale of surveillance procurement being examined by Parliament.
Circles is distinct from Pegasus, although both technologies have attracted international scrutiny. Pegasus can penetrate vulnerable smartphones and potentially access sensitive information stored on them.
By comparison, Circles has been associated with exploiting telecommunications signalling systems to identify the location of mobile devices. The committee’s investigation therefore extends beyond spyware infections to wider telephone surveillance capabilities. Moreover, the procurement records cover several administrations rather than one government.
Phakamon challenges minister over Apple warnings and demands independent evidence of spyware attacks
Phakamon directed further criticism towards Digital Economy and Society Minister Chaichanok Chidchob. The minister has repeatedly stressed that Apple’s notifications do not establish successful hacking.
He has also maintained that investigators have found no evidence identifying Pegasus as the software responsible. In response, Phakamon demanded technical evidence rather than assurances. She argued that citizens receiving spyware warnings should not have to investigate suspected surveillance without government assistance.
The committee chairwoman compared the latest controversy with surveillance concerns during former Prime Minister General Prayut Chan-o-cha’s administration. She questioned why similar concerns continued under an elected government.
Furthermore, she called for greater transparency concerning the authorisation of surveillance operations and the agencies responsible. Her committee’s investigation now covers procurement, operational control and the protection available to citizens whose devices may have been targeted.
Wednesday’s meeting between Chaichanok and Apple representatives produced further information about the international spyware threat. Thai national security and cybersecurity officials also participated in the discussions.
Apple reports spyware warnings across 99 countries but withholds details of attacks targeting Thai users
Apple confirmed that its October 29 notifications followed detection of activity consistent with mercenary spyware attacks. According to Bloomberg reporting, the warnings reached users across 99 countries. However, the company did not disclose how many recipients were located in Thailand.
Apple also declined to identify the organisations responsible for the suspected attacks. Additionally, the company withheld sensitive technical information concerning its detection methods.
Chaichanok explained that revealing such details could assist spyware operators seeking to avoid identification. The minister emphasised that receiving an Apple warning did not automatically establish successful penetration of an iPhone. Such notifications can indicate suspected targeting without proving that attackers obtained access.
The warnings nevertheless concern sophisticated spyware operations rather than ordinary online fraud. Mercenary spyware is associated with advanced technical capabilities and substantial financial resources.
Thai authorities offer forensic checks as Apple leaves spyware identity and suspected operators unknown
Apple did not identify Pegasus as the technology involved in the latest incidents. Equally, investigators have not publicly established that Thai government agencies directed the suspected attacks. The international distribution of the warnings also prevents automatic attribution of the Thai incidents to domestic operators.
Officials recommended that affected users activate Apple’s Lockdown Mode and seek specialist forensic examinations. The National Cyber Security Agency said ThaiCERT could assist with technical investigations.
Such examinations can identify suspicious software, unusual device activity and communications with external command servers. However, sophisticated spyware may leave limited evidence of attempted or successful intrusion. The absence of identifiable traces therefore does not necessarily establish that no attack occurred.
Conversely, receiving a security warning does not prove that a device was successfully compromised. Chaichanok announced further discussions with telecommunications operators, technology companies and cybersecurity specialists.
Additional protective measures are expected during the week beginning November 16. Prime Minister Anutin Charnvirakul has also directed relevant agencies to assess the wider cybersecurity threat. In parallel, the National Security Council has become involved in coordinating the government’s response.
Abhisit and Nattapong receive spyware alerts before planned December parliamentary no-confidence debate
The latest warnings became public in Thailand on November 2 and 3. Abhisit confirmed receiving an Apple notification concerning possible spyware targeting connected to his political and professional activities.
He subsequently activated additional security protections. However, initial examinations reportedly found no evidence that his telephone had been successfully compromised. People’s Party leader Nattapong Ruangpanyawut also disclosed receiving a notification, bringing the controversy directly into Thailand’s opposition leadership.
Both men lead parties preparing for parliamentary confrontation with the government. Significantly, the notifications emerged ahead of a planned December no-confidence debate.
However, no publicly verified evidence connects the suspected attacks with preparations for that debate. Nor has any organisation been identified as responsible for targeting either politician. The government has denied involvement in surveillance against opposition figures.
Thailand’s spyware controversy has a substantial documented history. The most significant findings emerged in July 2022, following an investigation by the University of Toronto’s Citizen Lab. Researchers worked alongside Thai civil society organisations iLaw and DigitalReach.
Their investigation established that at least 30 individuals had suffered confirmed Pegasus infections between October 2020 and November 2021. The victims included political activists, lawyers, academics and civil society organisers.
Citizen Lab confirms Pegasus infections during Prayut-era protests but operator remains unidentified
That period coincided with major pro-democracy demonstrations against the government of General Prayut Chan-o-cha. Protesters were demanding political reforms while authorities faced sustained criticism over their response.
Among those identified as spyware victims were human rights lawyer Arnon Nampa and activist Jatupat Boonpattararaksa. iLaw executive Yingcheep Atchanont was also among those affected. Researchers further established that several victims had experienced repeated infections.
Citizen Lab identified sophisticated exploitation techniques known as KISMET and FORCEDENTRY. These included zero-click attacks capable of compromising vulnerable devices without users opening malicious links.
Such technology could potentially provide attackers with extensive access to information stored on infected smartphones. The researchers also identified infections occurring around politically sensitive activities and demonstrations. Despite those findings, they did not conclusively establish which organisation operated Pegasus in Thailand.
Citizen Lab reported circumstantial evidence suggesting involvement by one or more Thai government Pegasus operators. Pegasus was developed by Israel’s NSO Group, which maintains that its spyware is supplied exclusively to government customers.
Israeli spyware supplier says it sells to governments as researchers stop short of naming Thai operators
Those customers include intelligence services and law-enforcement agencies. Consequently, the confirmed Thai infections raised questions about possible state involvement. However, the forensic investigation stopped short of identifying the responsible government agency or operator.
The distinction between those historical findings and the latest warnings is important. Citizen Lab established actual infections through forensic examinations. By contrast, successful compromise has not been publicly confirmed in the current cases involving opposition leaders.
The latest notifications also have not been attributed to any particular government or spyware supplier. Nevertheless, the earlier findings provide documented evidence of sophisticated surveillance targeting individuals involved in Thai political activity.
The 2022 revelations triggered questions inside Thailand’s Parliament. In July that year, then Digital Economy and Society Minister Chaiwut Thanakamanusorn acknowledged government use of surveillance software.
He said such technology was deployed in limited cases involving national security or narcotics investigations. However, he did not identify the software involved or the agencies responsible. Chaiwut also declined to confirm whether Pegasus had been used or identify individuals selected for surveillance.
Former digital minister acknowledged surveillance software but never confirmed whether Pegasus was used
Police repeatedly denied purchasing or deploying Pegasus against political activists or other targets. Those denials did not resolve the findings of the independent forensic investigation. The identity of the operators responsible for the confirmed infections remained unknown. As a result, the controversy continued despite technical evidence established by Citizen Lab and its Thai research partners.
The earlier surveillance controversy also reached Thailand’s National Human Rights Commission. Thursday’s committee hearing examined complaints dating back to 2021.
Wattanakorn Sannui, head of Human Rights Protection Group 2 at the commission, addressed MPs about those complaints. Several individuals had reported suspected violations of their privacy. Among those affected were political activists and academics who subsequently received Apple notifications about possible state-sponsored attacks.
Political scientist Puangthong Pawakapan was among those identified. Her case formed part of the wider surveillance controversy involving critics of previous governments. The commission’s evidence demonstrated that complaints about political surveillance predated the latest Apple notifications by several years.
Police denials leave infections unresolved as rights commission details earlier privacy complaints
Furthermore, those complaints overlapped with the period examined by Citizen Lab. The parliamentary investigation therefore involves both historical cases and the latest suspected attacks.
Phakamon proposed direct cooperation between the Ministry of Digital Economy and Society and international academic institutions. She specifically identified Citizen Lab as a potential investigative partner. Such cooperation would involve researchers who previously established Pegasus infections through technical examinations.
Their findings remain central to the historical surveillance controversy. Meanwhile, the committee is examining whether government procurement records can establish which agencies acquired particular surveillance capabilities.
The committee is also seeking information about operational authorisations and target selection. However, the purchase of surveillance equipment does not itself establish unlawful activity. Police and intelligence agencies may deploy investigative technologies under applicable legal powers.
The unresolved issue concerns whether such capabilities were used against political opponents without lawful authorisation. Thursday’s hearing did not establish that any current agency had carried out such operations.
Committee seeks Citizen Lab assistance while examining surveillance purchases and legal authorisation
Nor did the hearing establish that the proposed 2027 budget allocation represented a confirmed Pegasus purchase. No evidence publicly identifying the perpetrators behind Apple’s October warnings has emerged.
Nevertheless, the committee has placed substantial procurement figures before Parliament. It has also demanded explanations from agencies responsible for policing, intelligence gathering and national cybersecurity. Those demands extend to surveillance purchases made under previous administrations.
The investigation now covers three distinct areas. These are historical Pegasus infections, surveillance equipment procurement and the latest suspected spyware attacks. The first has been established through independent forensic evidence.
The second involves procurement information presented during Thursday’s parliamentary hearing. The third remains under technical investigation, with no confirmed identification of the attackers. Meanwhile, the government continues discussions with Apple and cybersecurity specialists.
MP seeks answers on Pegasus budget, surveillance contracts and unresolved Apple spyware warnings
Phakamon has demanded further explanations about who authorises surveillance, who selects targets and how equipment purchases are approved. Her committee is also seeking clarification about the protection available to citizens receiving spyware warnings.
Additionally, the proposed involvement of Citizen Lab would introduce independent forensic expertise into the current investigation. However, no findings establishing responsibility for the latest suspected attacks have been announced.
Two opposition leaders receive alerts about spyware on their phones as ministers deny involvement
Canadian institute identifies Pegasus spyware on phones of 30 people linked to Bangkok protests
Six years after the earliest confirmed Pegasus infections, Parliament is again examining Thailand’s surveillance apparatus. This time, the investigation involves fresh warnings to opposition leaders and ฿388.4 million in reported historical and proposed surveillance expenditure.
The government maintains that it is investigating an international cybersecurity threat. Meanwhile, the identity of those responsible remains unconfirmed, as Phakamon’s committee continues demanding procurement records and operational explanations.
Join the Thai News forum, follow Thai Examiner on Facebook here
Follow Thai Examiner on Google here
Receive all our stories as they come out on Telegram here
Follow Thai Examiner here
Further reading:
Two opposition leaders receive alerts about spyware on their phones as ministers deny involvement
Licenced online gambling site abroad linked to the husband of a government MP raises legal quandary
House Committee chair Rome to call Bhumjaithai MP and Australian husband on Wednesday over wealth
Bhumjaithai MP files police report against People’s Party’s Rangsiman Rome over scammer link remarks
