NSO GROUP SPYWARE USED AGAINST MOROCCAN JOURNALIST DAYS AFTER COMPANY PLEDGED TO RESPECT HUMAN RIGHTS

Amnesty International is supporting a legal case being brought in Israel that seeks to force the Israeli Ministry of Defence (MOD) to revoke NSO Group’s export license. The organization argues that the Israeli MOD is putting human rights at risk by allowing NSO to continue to export its products to governments worldwide. A judgment is expected in the case soon

Amnesty Tech carried out a forensic analysis of Omar Radi’s iPhone in February 2020. This revealed that the device was subject to a series of ‘network injection’ attacks.

 

With network injections, attackers are able to monitor, intercept and manipulate the internet traffic of the target. The phone’s web browser is then redirected to a malicious website, without requiring any action by the target. The malicious website then silently installs Pegasus spyware on the target’s phone.

 

For network injections, the attacker requires either physical proximity to the targets or access over mobile networks in the country which only a government could authorize, a further indication that the Moroccan authorities were responsible for the attack against Omar Radi. NSO marketed such sophisticated interception technology as recently as January 2020. 

When Pegasus is installed, an attacker has complete access to a phone’s messages, emails, media, microphone, camera, calls and contacts. Network injection attacks are notoriously difficult for a victim to spot as they leave few clues.

Forensic data extracted from Omar Radi’s phone indicates network injection attacks occurred on 27 January, 11 February, and 13 September 2019. NSO Group publicly committed to abide by the UN Guiding Principles on Business and Human Rights on 10 September 2019.

The browser on Omar Radi’s phone was directed to the same malicious website Amnesty International found in an attack against Moroccan academic and activist Maati Monjib, as revealed in the report “Morocco: Human Rights Defenders Targeted with NSO Group’s Spyware” published on 10 October 2019.

NSO Group was provided with an advanced copy of that report on 2 October 2019. The malicious website was shut down on 6 October, days before Amnesty made its findings public. However, new evidence shows similar network injection attacks against Omar Radi’s phone continued until 29 January 2020, using a different website.

With NSO Group claiming it only sells its spyware to government intelligence and law enforcement agencies, the evidence revealed by Amnesty International indicates that the Moroccan government remained an active customer of NSO Group, and was able to continue to use the company’s technology to track, intimidate and silence activists, journalists and critics.

When Amnesty International shared its latest findings with NSO Group, the company did not confirm or deny whether the Moroccan authorities use their technologies and stated that they will review the information submitted.

“NSO Group has serious questions to answer as to what actions it took when presented with evidence its technology was used to commit human rights violations in Morocco. Why did it not terminate its contract with the Moroccan authorities? Subjecting journalists and activists to intimidation through invasive digital surveillance is a violation of their rights to privacy and freedom of expression,” said Danna Ingleton.

Amnesty International and others have documented a pattern of NSO Group’s Pegasus spyware being used to target civil society. The spyware has been used in attacks on journalists and parliamentarians in Mexico; Saudi activists Omar Abdulaziz, Yahya Assiri, Ghanem Al-Masarir; award-winning Emirati human rights campaigner Ahmed Mansoor; an Amnesty International staff member; and allegedly, used in connection with murdered Saudi dissident Jamal Khashoggi.