Israeli firm linked to WhatsApp spyware attack faces lawsuit

Amnesty International fears its staff may be ‘surveilled via NSO Pegasus software’

The Israeli firm linked to this week’s WhatsApp hack is facing a lawsuit backed by Amnesty International, which says it fears its staff may be under surveillance from spyware installed via the messaging service.

The human rights group’s concerns are detailed in a lawsuit filed in Israel by about 50 members and supporters of Amnesty International Israel and others from the human rights community. It has called on the country’s ministry of defence to ban the export of NSO’s Pegasus software, which can covertly take control of a mobile phone, copy its data and turn on the microphone for surveillance.

An affidavit from Amnesty is at the heart of the case, and concludes that “staff of Amnesty International have an ongoing and well-founded fear they may continue to be targeted and ultimately surveilled” after a hacking attempt last year.

NSO Group, founded in 2010, supplies industry-leading surveillance software to governments that it says is for tackling terrorism and serious crime, and has been licensed to dozens of countries including Saudi Arabia, Mexico, Bahrain and the UAE.

But there have been a string of complaints in the past few months, documented largely by the Toronto-based Citizen Lab, that the technology has been used to target human rights groups, activists and journalists by several countries – and that there has been no attempt to rein it in.

That culminated, earlier this week, in the announcement by Facebook-owned WhatsApp that it had raced to patch up a security hole in its messaging service, which it believed had been exploited by NSO Group, that would have allowed spyware to be placed on a person’s mobile phone simply via a missed WhatsApp call.

Users are strongly advised to check for WhatsApp updates manually through the Apple App Store on an iPhone, Google Play or similar on an Android device, the Microsoft Store on Windows Phones and the Galaxy app store on Tizen devices.

A vulnerability in the popular Facebook-owned messaging service has been discovered that allowed hackers to install spyware through an infected WhatsApp voice call.

The spyware is capable of trawling through calls, texts and other data, activating the phone’s camera and microphone and performing other malicious activities.

All brands of phones with WhatsApp or WhatsApp Business installed are affected, including Apple’s iPhone (iOS), Android phones, Windows Phones and Tizen devices, according to Facebook. WhatsApp is used by 1.5 billion people globally.

Facebook implemented a server-side change to help protect users and pushed out updates for the various smartphone WhatsApp versions on Monday.

Samuel Gibbs

That represents a technical step beyond the breaches reported by Amnesty in its lawsuit, although it is not the first time that NSO has been accused of exploiting WhatsApp to hack phones.

Last June, an Amnesty staffer received “a suspicious message over WhatsApp”, according to the affidavit. The recipient was asked to cover the protest “for your brothers detained in Saudi Arabia in front of the Saudi embassy in Washington” and invited to click a link.

Technical analysis indicated the link was part of “a network of digital infrastructure comprising more than 600 suspicious domains used to lure targeted individuals to click on links that trigger infection with Pegasus spyware” onto a target’s mobile phone, it said.

Such links often aim to impersonate news sites by using slightly misspelled domain names or different suffixes, for example replacing .com with .net.

The Israeli government’s Defence Export Controls Agency has failed to exercise proper oversight “despite serious allegations of abuse”, the affidavit claimed, adding: “Because of DECA’s inaction, NSO Group can continue to sell its software to governments known to target human rights defenders.”

It is the latest in a string of Israeli lawsuits faced by the company. Omar Abdulaziz, a Saudi dissident based in Montreal, last December filed a lawsuit in Israel in which he claimed that NSO software had been used to target his phone at a time when he was in regular contact with the journalist Jamal Khashoggi.

In October, Khashoggi is believed to have been killed and dismembered at the Saudi consulate in Istanbul, Turkey – although the Middle Eastern country’s government still denies involvement. Saudi Arabia is understood to have licensed NSO technology in 2017, paying $55m for the technology, according to Israeli news reports.

NSO said it wants to “do whatever is necessary” to ensure its technology is used for fighting terrorism and serious crime and “not abused in a manner that undermines other equally fundamental human rights”. Its response came in a 26-page reply sent earlier this week to Amnesty and Citizen Lab from the British venture capital firm that is now its parent company.

Three months ago, a majority stake in NSO was acquired by the London based firm Novalpina Capital, founded by the banker and philanthropist Stephen Peel. It appears eager to rehabilitate the controversial software company’s reputation and maintain its value.

The lengthy reply to Amnesty, signed by Peel, claimed that in “almost all” the cases of complaints of human rights abuse raised, the alleged victim of hacking had not been a target or the government in question had acted with “due lawful authority”.

A statement that has been challenged by Amnesty. Danna Ingleton, the deputy director of Amnesty’s technology division, said: “We believe that the reality is different. We’ve seen them target human rights organisations and no evidence they’ve been able to effectively control governments when complaints have been raised.”

Profile: Stephen Peel

Peel, a former Olympic rower who competed in the Seoul Olympics, is a long-term financier who set up Novalpina in 2016 after stints at the investment bank Goldman Sachs and the US private equity giant TPG.

In recent years he has become a philanthropist as well, sitting on a number of boards, and said last year he had donated £100,000 to the anti-Brexit campaign group Best for Britain.

“We have heard the strident calls from those against us to try and close down debate and silence discussion over the disaster that Brexit appears to be. I for one, will not be silenced,” he said in an interview with the Observer.

However, Peel stood down from the board of Global Witness, a human rights and environmental campaigning organisation in February, after the buyout of NSO.

The statement announcing Peel’s departure described his decision as “typically selfless” – although there is understood to have been considerable concern in some quarters of the organisation once the acquisition was confirmed.


Dan Sabbagh

The GuardianTramp

Related Content

Article image
WhatsApp spyware attack was attempt to hack human rights data, says lawyer
NSO Group technology reportedly used against lawyer involved in civil case against the Israeli surveillance firm

Nick Hopkins and Dan Sabbagh

14, May, 2019 @12:27 PM

Article image
US judge: WhatsApp lawsuit against Israeli spyware firm NSO can proceed
NSO Group was sued last year by messaging app owned by Facebook

Stephanie Kirchgaessner in Washington

17, Jul, 2020 @4:27 PM

Article image
CEO of Israeli Pegasus spyware firm NSO to step down
CEO Shalev Hulio is stepping down as part of NSO reorganisation that will see it focus on sales in Nato member countries

Staff and agencies

21, Aug, 2022 @11:50 PM

Article image
WhatsApp spyware attack: senior clergymen in Togo among activists targeted
Bishop from Togo among 1,400 individuals alerted by WhatsApp to malware attack

Stephanie Kirchgaessner and Jennifer Rankin

03, Aug, 2020 @10:40 AM

Article image
Israeli spyware company NSO Group placed on US blacklist
Decision against company at heart of Pegasus project reflects deep concern about impact of spyware on US national security interests

Stephanie Kirchgaessner in Washington

03, Nov, 2021 @7:53 PM

Article image
WhatsApp urges users to update app after discovering spyware vulnerability
The spyware, developed by Israeli cyber intelligence company, used infected phone calls to take over the functions of operating systems

Julia Carrie Wong

14, May, 2019 @7:21 AM

Article image
The Guardian view on hacking: a dangerous arms trade | Editorial
Editorial: Cyberweapons are dangerous in themselves. Their proliferation makes them much more harmful


14, May, 2019 @5:38 PM

Article image
Israeli spyware firm fails to get hacking case dismissed
Judge orders NSO Group to fight case brought by Saudi activist and pay his legal costs

Oliver Holmes and Stephanie Kirchgaessner

16, Jan, 2020 @10:27 AM

Article image
WhatsApp spyware: UK firm promises new 'respect for human rights' following allegations
Novalpina Capital to establish new rules at NSO Group following multiple allegations that technology was used to spy on dissidents and the media

Stephanie Kirchgaessner in Washington and Jon Swaine in New York

18, Jun, 2019 @5:49 PM

Article image
Hacking of activists is latest in long line of cyber-attacks on Palestinians
Analysis: while identity of hackers is not known in this case, Palestinians have long been spied on by Israeli military

Peter Beaumont

08, Nov, 2021 @4:22 PM