Journalist Teixeira Cândido surveilled with Predator spyware, a first in Angola

Teixeira Cândido’s initial suspicions date back to 2022, when the SJA’s office was burgled three times in three months. Other journalists — including João Armando, the director of Jornal Expansão, and Raquel Rio, at the time a correspondent for the Portuguese news agency Lusa — were also victims of similar incidents at their homes that same year. In each case, computers belonging to the union and the journalists were stolen.

Goodbye phone calls about sensitive topics, hello face-to-face meetings

Since these revelations, Teixeira Cândido has taken precautions regarding his digital identity. He no longer discusses sensitive topics over the phone or via messaging applications and now prioritises face-to-face meetings. Several Angolan journalists who were informed of the case have also changed their habits for fear of surveillance.

Evaristo Mulaza, Director-General of Valor Económico newspaper and Rádio Essencial radio station, close to Teixeira Cândido, believes that these revelations “only confirm the suspicions that have always existed within the Angolan journalism community.” Although he has not yet taken “exceptional measures,” he is now more cautious about the type of information he shares by text or phone call.

Evidence of Predator found by several institutions

Although the infection of Teixeira Cândido’s phone is a first in Angola, several organisations had previously warned of the likely use of Predator in the country. In an October 2023 report, Amnesty International stated its analysis indicated “active customers or targeting of individuals […]in Angola.” This assessment was echoed that same month by the cybersecurity company Sekoia. In February 2024, the company reported that Predator was still active in the country, with strengthened operational security. Seven months later, the Insikt Group — a subsidiary of the American cybersecurity company Recorded Future — revealed a new infrastructure “associated with Predator customer(s) in Angola.”

To read Amnesty International’s technical report, click here.

Launched in July 2022, the RSF Digital Security Lab conducts in-depth analyses of devices belonging to journalists who suspect they are under digital surveillance.