ISRAEL’S ATTEMPT TO SWAY WHATSAPP CASE CASTS DOUBT ON ITS ABILITY TO DEAL WITH NSO SPYWARE CASES

WhatsApp sued NSO Group in California’s 9th District Court in October 2019 for allegedly abusing its platform to hack the phones of 1,400 people around the world. As part of court procedures, NSO Group was facing a potential discovery process, a pretrial procedure whereby information, such as internal documents, can be requested to be produced in court

Responding to a Forbidden Stories-led investigation, supported by the Amnesty International’s Security Lab, on the government of Israel’s attempts to sway WhatsApp’s ongoing US lawsuit against spyware firm NSO Group, Donncha Ó Cearbhaill, Head of the Security Lab at Amnesty International, said:  

“These revelations raise critical concerns about Israel’s regulatory oversight and the impartiality of its investigations into the spyware maker.  

“Israel has a duty to ensure Israeli companies do not cause or contribute to human rights violations anywhere in the world. These documents suggest that not only are they failing to do this but are actively trying to shield NSO Group from accountability for its role in severe human rights violations. 

“Such revelations call into question Israel’s commitment to impartially regulate NSO Group and casts doubt on its ability to provide justice, truth and reparation to those affected by Pegasus spyware.  

“It further confirms the difficulty in seeing Israel as an independent adjudicator capable of meaningfully exercising its responsibilities to control the highly invasive spyware industry, which poses serious human rights risks, or of offering redress to victims of spyware through its own courts.”

 “These revelations raise critical concerns about Israel’s regulatory oversight and the impartiality of its investigations into the spyware maker.  

Donncha Ó Cearbhaill, Head of the Security Lab at Amnesty International

NSO Group, an Israeli private company, has been under scrutiny for its surveillance technology products, particularly the highly invasive Pegasus spyware, which is used by governments globally to target human rights defenders, journalists, lawyers, and politicians, among others. NSO Group has consistently argued that its Pegasus spyware is a tool intended for fighting crime and terrorism. 

Earlier this week, Google and Microsoft intervened in a separate US legal case against NSO Group, arguing that spyware victims should be able to take legal action in the US against spyware vendors even if they were hacked abroad. This may be the final option for victims, who seldom have avenues for effective remedy in jurisdictions which abuse or export spyware tools. 

In 2021, Amnesty International and Forbidden Stories revealed how NSO Group’s spyware was used to facilitate human rights violations around the world targeting potentially tens of thousands of phone numbers, including those of heads of state, activists and journalists – among them the family of slain Saudi journalist Jamal Khashoggi. 

Background:   

WhatsApp sued NSO Group in California’s 9th District Court in October 2019 for allegedly abusing its platform to hack the phones of 1,400 people around the world. As part of court procedures, NSO Group was facing a potential discovery process, a pretrial procedure whereby information, such as internal documents, can be requested to be produced in court. 

The Forbidden Stories-led consortium story reveals how Israeli authorities took steps to seize NSO Group documents in efforts to protect them from discovery in a US court during this pretrial procedure and sought to censor information related to WhatsApp’s lawsuit against NSO Group. 

Apparently, Israel’s government feared this process could have led to the disclosure of sensitive information about NSO Group and the activities of NSO Group’s customers. 

The investigation draws on leaked files published online and reviewed by Forbidden Stories and their media partners, as well as additional documents and sources. Amnesty International’s Security Lab conducted a forensic analysis to verify some documents used by Forbidden Stories and media partners in their stories. 
 
Amnesty International’s Security Lab was not able to cryptographically verify the authenticity of the emails contained in the leak, which had been converted into HTML format and did not include detailed metadata. Technical indicators in other files from the leak, including PDFs and Microsoft Word documents cited by Forbidden Stories in their piece, were reviewed and do not show obvious signs of having been tampered with. 

Amnesty International and seven other civil society groups filed an Amicus brief related to WhatsApp’s case against NSO Group in December 2020 asking a California District Court not to grant NSO Group immunity from prosecution for harms suffered by those targeted with spyware. 

The matter is still before the court.