German lawmakers among Apple spyware warning recipients, BSI tells them to replace devices

Several German lawmakers and foreign policy staff were among the people Apple warned about spyware attacks last week, according to the country's information security agency, the BSI.

Der Spiegel reported on Monday that the Apple threat notifications went to members of a German delegation travelling with Chancellor Friedrich Merz through South Korea, Japan and Singapore: federal ministry staffers, lawmakers and journalists. On Tuesday, Franziska Brantner, co-leader of the Green Party and a member of parliament's European Affairs Committee, said she was among the recipients. Apple said the targets were located in 99 countries.

The BSI sent a warning letter on Friday to German officials, lawmakers and public figures who received the notifications, telling them to assume their devices are infected and replace them, according to Digital Minister Karsten Wildberg, who spoke to a local news outlet. The letter went out within 24 hours of Apple's notifications.

The BSI says it doesn't know how many of the devices were actually infected rather than just targeted, or why these particular people were singled out.

Hannah Neumann, a German member of the European Parliament who sat on the now disbanded PEGA committee, said the volume stood out. "Several foreign policy politicians and also staffers have received Apple notifications in the last round," she said, compared with roughly one recipient per round before.

The warnings landed just before a Pall Mall Process meeting in Paris on November 11-12, where voluntary industry guidelines for spyware use are due to be unveiled. Citizen Lab's John Scott-Railton called the German cases proof that "even the most technologically sophisticated European governments are totally vulnerable to mercenary spyware."

Nobody has published forensic findings on which spyware was involved or who operated it. For anyone holding one of these notifications, the BSI's position is blunt: treat the device as compromised. We'd not argue with replacing it, though the agency's own admission that it can't tell infected from targeted is the part worth pressing on.