An Israeli spyware company that has been accused by WhatsApp of hacking 1,400 of its users, including journalists, human rights activists, and diplomatic officials, has blamed its government clients for the alleged abuses, according to court documents.
NSO Group – whose technology is reported to have been used against dozens of targets including Pakistani intelligence officials, Indian journalists and exiled Rwandan political activists – also claimed in legal documents that the lawsuit brought against the company by WhatsApp threatened to infringe on its clients’ “national security and foreign policy concerns”.
NSO Group has never disclosed a full list of its government clients, but research by Citizen Lab, which tracks the use of spyware, has claimed that current and former clients include Saudi Arabia, Bahrain, Kazakhstan, Morocco, Mexico and the United Arab Emirates.
WhatsApp, the popular messaging app, filed a lawsuit against NSO Group in October, alleging that the cyberweapons company was behind a series of highly sophisticated attacks that it claimed violated US law in an “unmistakeable pattern of abuse”.
Among the alleged victims of the hack, which was discovered last April and continued for two weeks until the app’s vulnerability was fixed, were 100 human rights activists, lawyers, journalists and academics who were later notified of the alleged intrusion by WhatsApp.
In its first substantive legal filing in the case, filed last week, NSO hit back at WhatsApp and its parent company, Facebook, which it said were seen by governments as “safe spaces for terrorists and other criminals” who – without NSO’s services – could operate “without fear of detection by law enforcement”.
NSO Group also argued that WhatsApp had “conflated” NSO Group’s actions with the actions of NSO’s “sovereign customers”. While NSO Group licenses its signature spying technology, Pegasus, to government law enforcement and intelligence agencies and assists with “training, setup, and installation”, it said it did not operate the technology.
“Government customers do that, making all decisions about how to use the technology,” NSO said in its legal filing. “If anyone installed Pegasus on any alleged “target devices” it was not [the] defendants [NSO Group]. It would have been an agency of a sovereign government.”
NSO Group claimed that to challenge such conduct, WhatsApp would have to declare the “sovereign acts” of those governments to be illegal.
“For that reason,” the company said in the filing, “permitting this litigation to proceed would infringe critical national security and foreign policy concerns of sovereign governments”.
The company also highlighted the role it claimed the Israeli government played in its review of NSO Group’s business. The Israeli ministry of defence, NSO Group said, could have access to information about NSO Group’s customers and “their intended use of Pegasus technology”.
In a statement, WhatsApp said NSO Group was attempting to “avoid responsibility” and questioned the accuracy of some of the company’s claims, including an allegation in the legal filing that Facebook had wanted to procure some of NSO Group’s technology in 2017.
In a sworn statement filed to the court, Shalev Hulio, an NSO Group co-founder, said that NSO had been approached by two Facebook representatives in October 2017 and asked about the right to “certain capabilities of Pegasus”, which the representatives had suggested could be used to help monitor users on Apple devices.
NSO Group declined to comment to the Guardian’s questions about the alleged meeting between Facebook and NSO, and said it would not reveal the identity of the individuals. WhatsApp said the description of the discussions were an “inaccurate representation”. It declined to provide further comment.
