Ninth Circuit Tells NSO Group It Isn't A Government, Has No Immunity From WhatApp's Lawsuit

from the law-harder! dept

Long before its current run of Very Bad News, Israeli malware purveyor NSO Group was already controversial. Investigations had shown its exploits were being used to target journalists and activists and its customer list included governments known mostly for their human rights abuses.

Facebook and WhatsApp sued NSO in November 2019, alleging -- among other things -- that NSO had violated WhatsApp's terms of use by deploying malware via the chat service. The arguments made by Facebook/WhatsApp aren't the best and they could allow the CFAA to be abused even more by expanding the definition of "unauthorized access."

Then there's the question of standing, which NSO raised in one motion to dismiss. The alleged harms were to users of the service, not to the service itself. While suing on behalf of violated users is a nice gesture, it's pretty difficult to talk a court into granting your requests for injunctions or damages if you're not the target of the alleged abuse.

NSO also pointed out it didn't actually violate anyone's terms of service. Its customers did when they used WhatApp to deliver malware to targets. NSO said WhatsApp was welcome to sue any of its customers, but was unlikely to get anywhere with that either, given the immunity from lawsuits generally handed to foreign governments.

Then NSO made a ridiculous claim of its own: it said it was immune from lawsuits since it provided this malware to foreign governments. By extension, it argued, the same immunity protecting foreign sovereigns (i.e., its customers) should be extended to the private company that sold them phone exploits. That argument was rejected by the district court. And the Ninth Circuit Appeals Court has just affirmed [PDF] that rejection, which means NSO will have to continue to fight what is now one of several damaging fires.

The Appeals Court says no reasonable reading of the Foreign Sovereign Immunities Act (FSIA) supports NSO's argument in favor of it taking no responsibility for its actions or the actions of its customers.

Whether such entity can sidestep the FSIA hinges on whether the Act took the entire field of foreign sovereign immunity as applied to entities, or whether it took the field only as applied to foreign state entities, as NSO suggests. The answer lies in the question. The idea that foreign sovereign immunity could apply to non-state entities is contrary to the originating and foundational premise of this immunity doctrine.

[...]

Thus, we hold that an entity is entitled to foreign sovereign immunity, if at all, only under the FSIA. If an entity does not fall within the Act’s definition of “foreign state,” it cannot claim foreign sovereign immunity. Period.

NSO isn't a "foreign state." It is not operated by a foreign state. It simply sells products to foreign states, which legally makes it no different than the company that supplies toilet paper to the White House. Just because the product is used almost exclusively by governments, that fact does not make NSO a state actor or a foreign state proxy.

NSO does not contend that it meets the FSIA’s definition of “foreign state,” and, of course, it cannot. It is not itself a sovereign. 28 U.S.C. § 1603(a). It is not “an organ . . . or political subdivision” of a sovereign. Id. § 1603(b)(2). Nor is a foreign sovereign its majority owner. NSO is a private corporation that provides products and services to sovereigns—several of them. NSO claims that it should enjoy the immunity extended to sovereigns because it provides technology used for law-enforcement purposes and law enforcement is an inherently sovereign function. Whatever NSO’s government customers do with its technology and services does not render NSO an “agency or instrumentality of a foreign state,” as Congress has defined that term. Thus, NSO is not entitled to the protection of foreign sovereign immunity. And that is the end of our task.

This heads back to the district court -- the court where NSO first argued that the court had no jurisdiction to handle the lawsuit since it was pretty much just a foreign government d/b/a a private malware manufacturer. It will have to continue facing WhatsApp's lawsuit over its alleged terms of service violations. And the longer the suit runs, the greater the chance NSO might have to divulge some more details on its dirty work and its even dirtier customers.

Filed Under: 9th circuit, immunity, malware, spyware
Companies: facebook, nso group, whatsapp

Israeli Malware Merchants NSO Group, Candiru Added To Commerce Department Export Blacklist

from the unwelcome-to-the-party,-pals dept

A couple of Israeli spyware purveyors have finally gotten themselves disinvited from the good graces of the federal government of the United States. The Commerce Department's Bureau of Industry and Security has amended its export regulations to hand NSO Group and the more mysterious Candiru a "presumption of denial," meaning they'll have to prove they're trustworthy again before US entities will be able to do business with them.

The new rules also make it more difficult for NSO and Candiru to sell their products using middlemen who aren't affected by the regulations.

In addition, the ERC [End-User Review Committee] also determined that no license exceptions should be available for exports, reexports, or transfers (in-country) to the persons being added to the Entity List in this rule.

NSO and Candiru weren't the only ones affected by this amendment, but they're the most notable recipients of the export controls.

The ERC determined that NSO Group and Candiru be added to the Entity List based on § 744.11(b) of the EAR: Entities for which there is reasonable cause to believe, based on specific and articulated facts, that the entity has been involved, is involved, or poses a significant risk of being or becoming involved in activities that are contrary to the national security or foreign policy interests of the United States and those acting on behalf of such entities. Specifically, investigative information has shown that the Israeli companies NSO Group and Candiru developed and supplied spyware to foreign governments that used this tool to maliciously target government officials, journalists, businesspeople, activists, academics, and embassy workers.

Also added to the blacklist were two other malware purveyors located in countries the United States has a much frostier relationship with.

The ERC determined that Positive Technologies, located in Russia, and Computer Security Initiative Consultancy PTE. LTD., located in Singapore, be added to the Entity List based on their engagement in activities counter to U.S. national security. Specifically, these entities traffic in cyber exploits used to gain access to information systems, threatening the privacy and security of individuals and organizations worldwide.

US companies and agencies will now have to approach the Commerce Department and ask for permission to purchase exploits from these companies, with the presumption being that their requests will be denied. This effectively shutters a large and presumably profitable market for these companies. It also prevents US-based exploit developers from selling their discoveries to any of the affected companies. And it's just another reputational hit for NSO Group, which has been remarkably resilient, considering its now fighting a PR battle on multiple fronts while being dragged down by its long, sordid past.

That hasn't stopped it from complaining that this blacklisting is unfair. Here's the statement it gave to The Record after the publication of the export regulation amendment.

NSO Group is dismayed by the decision given that our technologies support US national security interests and policies by preventing terrorism and crime, and thus we will advocate for this decision to be reversed.

We look forward to presenting the full information regarding how we have the world’s most rigorous compliance and human rights programs that are based the American values we deeply share, which already resulted in multiple terminations of contacts with government agencies that misused our products.

That is hilarious. It will be fun seeing how NSO proves it has the "world's most rigorous compliance and human rights program" after it has been observed selling its products to countries with dismal human rights records. Combine that statement with its defense that it has no "visibility" into how its customers use its products and it's pretty clear the "rigorous compliance program" NSO claims to have is about 50% delayed reaction and 50% bullshit.

Filed Under: commerce department, entity list, export regulations, malware, spyware
Companies: candiru, nso group

In Latest Black Eye For NSO Group, Dubai's King Found To Have Used NSO Spyware To Hack His Ex-Wife's Phone

from the slumming-it-as-a-service dept

NSO Group has endured some particularly bad press lately, what with leaked data pointing to its customers' targeting of journalists, political figures, religious leaders, and dissidents. That its powerful spyware would be abused by its customers was not surprising. Neither were the findings from the leaked data, which only confirmed what was already known.

Despite this, NSO continues to make contradictory claims. First, it says it has no control (or visibility) as to how its customers use its products -- customers that include some notorious abusers of human rights. Second, it says that it cuts off customers who abuse its products to target people who only annoy their governments, rather than directly threaten it with criminal or terrorist acts.

Well, it's either one or the other. And if NSO is waiting for secondhand reports about abusive deployments to act, it really shouldn't be in the intel business. If NSO wants to stay above the fray, it could start by being a lot more selective about who it sells to.

If you're not selective, your customers will not only pettily target people (critics, activists, journalists, dissidents) the government doesn't like but will move on to the extreme pettiness of targeting people certain government officials don't like.

This latest nadir for NSO Group comes courtesy of court proceedings, which illustrates the danger of putting powerful cellphone exploits in the hands of the wrong people.

Dubai's ruler Sheikh Mohammed bin Rashid al-Maktoum ordered the phones of his ex-wife and her lawyers to be hacked as part of a "sustained campaign of intimidation and threat" during the custody battle over their children, England's High Court has ruled.

Mohammed used the sophisticated "Pegasus" software, developed by Israeli firm NSO for states to counter national security risks, to hack the phones of Princess Haya bint al-Hussein, half-sister of Jordan's King Abdullah, and some of those closely connected to her, according to the rulings.

That's the sort of thing you can expect to happen when powerful hacking tools are given to people who have never proven they're capable of handling power responsibly. Adding to the irony is the fact that the King's ex was tipped off by the wife of Tony Blair, who used to work as an outside legal adviser for NSO Group.

Now that this has been exposed, NSO is finally ready to take action.

Once the hacking was uncovered, NSO cancelled its contract with the UAE, Haya's lawyers said. The Israeli firm said it could not immediately comment on the case, but said it took action if it received evidence of misuse of Pegasus.

Well, duh (to use a technical term). But if NSO is so supposedly "proactive" why even sell to the UAE at all? It's not as though it has a long, storied history of respecting rights, much less those possessed by women who also happen to have angered the king? While I understand it might be difficult to promise investors steadily-increasing returns if you choose not to sell to questionable entities, it seems like a long run of bad press and government investigations might have the same effect on the bottom line. Or maybe NSO's investors are just as unconcerned about its partnerships with abusive governments as it is. Whatever the case is, it's led NSO to where it is now: a company best known for giving oppressive governments even more oppression options.

Filed Under: dubai, hacking, malware, pegasus, princess haya bint al-hussein, sheikh mohammed bin rashid al-maktoum, spyware
Companies: nso group

Apple Patches Up Devices In Response To The Exposure Of Yet Another NSO Group Exploit

from the soon-they-will-make-a-board-with-a-nail-so-big-it-will-destroy-them-all dept

Israeli digital arms merchant NSO Group continues to sell its malware to a wide variety of governments. The governments it sells to, which includes a bunch of notorious human rights abusers, continue to use these exploits to target dissidents, activists, journalists, religious leaders, and political opponents. And the manufacturers of the devices exploited by governments to harm people these governments don't like (NSO says "criminals and terrorists," long-term customers say "eh, whoever") continue to patch things up so these exploits no longer work.

The circle of life continues. No sooner had longtime critic/investigator of NSO Group's exploits and activities -- Citizen Lab -- reported the Bahrain government was using "zero click" exploits to intercept communications and take control of targeted devices then a patch has arrived. Apple, whose devices were compromised using an exploit Citizen Lab has dubbed FORCEDENTRY, has responded to the somewhat surprising and altogether disturbing news that NSO has developed yet another exploit that requires no target interaction at all to deploy.

Apple released a patch Monday against two security vulnerabilities, one of which the Israeli surveillance company NSO Group has exploited, according to researchers.

The updated iOS software patches against a zero-click exploit that uses iMessage to launch malicious code, which in turn allows NSO Group clients to infiltrate targets — including the phone of a Saudi activist in March, researchers at Citizen Lab said.

The backdoor being closed involves a pretty clever trick of the trade. Since links require clicks and images don't, the exploit utilizes a tainted gif to crash Apple's image rendering library, which is then used to launch a second exploit that gives NSO customers control of these devices, allowing them to browse internal storage and eavesdrop on communications.

It's not the first time NSO has developed a zero-click exploit that affects iOS devices. It's just the latest exposed by Citizen Lab's incredible investigation efforts. Thanks to Citizen Lab, more Apple device users around the world are better protected against malicious hackers… working for a company that sells exploits to government agencies. And whatever can be nominally exploited for good (the terrorists and criminals NSO continues to claim its customers target, despite an ever-growing mountain of evidence that says otherwise) can be exploited by governments and malicious hackers who don't even have sketchy "national security" justifications to raise in the defense of their actions.

The arms race continues. It appears marketers of exploits will continue to do what they've always done: maintain over-the-air superiority for as long as possible. And while it may seem this is just part of the counterterrorism game, NSO Group's tacit approval of the targeting of dissidents, journalists, and others who have angered local governments (but have never committed any terrorist or criminal acts) shows it's not willing to stop profiting from the misery of people being hunted and harmed by repressive regimes.

Filed Under: ios, iphone, malware, patches, surveillance
Companies: apple, nso group

Investigation Finds NSO Malware Being Used By The Bahrain Government To Target Activists And Dissidents

from the truly-unsurprising-development dept

More bad news for Israeli malware purveyor NSO Group. Despite its contradictory and simultaneous claims that it does not allow its customers to abuse its products and that it has no way of monitoring use of its products, more evidence continues to surface that shows the company's customers are deploying NSO's malware to target journalists, activists, prominent politicians, and religious leaders.

Citizen Lab -- which has uncovered plenty of abusive use of NSO malware previously -- has released another report showing an abusive government abusing NSO spyware to spy on activists opposed to the country's current leadership. The investigation also confirms something NSO has repeatedly denied: that the list of numbers leaked to journalists and investigators is actually a list of potential targets of NSO's customers. That list included plenty of journalists, activists, politicians, and religious leaders.

Perhaps the most worrying thing about this report is the use of an exploit that bypasses security measures activists would logically adopt: refusing to click on links sent by unknown senders.

We identified nine Bahraini activists whose iPhones were successfully hacked with NSO Group’s Pegasus spyware between June 2020 and February 2021. Some of the activists were hacked using two zero-click iMessage exploits: the 2020 KISMET exploit and a 2021 exploit that we call FORCEDENTRY.

The hacked activists included three members of Waad (a secular Bahraini political society), three members of the Bahrain Center for Human Rights, two exiled Bahraini dissidents, and one member of Al Wefaq (a Shiite Bahraini political society).

And here's at least partial confirmation that the leaked list of potential targets has something to do with NSO Group and its customers:

We shared a list of the targeted phone numbers we identified with Forbidden Stories. They confirmed that numbers associated with five of the hacked devices were contained on the Pegasus Project’s list of potential targets of NSO Group’s customers, data that Forbidden Stories and Amnesty International describe as dating from 2016 up to several years ago.

If NSO Group is serious about preventing abuse of its products, the first step it could take is refusing to sell exploits to abusive governments. As Citizen Lab points out, Bahrain's government has a long history of human rights abuses. While things improved slightly and briefly around the turn of the century, everything reverted back to the abusive mean a decade later, when reforms were rolled back and the government went back to imprisoning and torturing dissidents, critics, and anti-government activists.

And you can't find people to jail and torture without domestic spying, which the Bahraini government enthusiastically engages in. That apparently includes spying on activists and dissidents who have left the country. The report says two Bahrain citizens who now live in London were hit with NSO malware. But this may have been a proxy hack on behalf of the Bahrain government. Citizen Lab notes it has only seen the Bahrain government deploy malware in its own country or in neighboring Qatar. So, these hacks may have been performed on its behalf by a friendly government with its own set of NSO malware.

In conclusion, NSO Group is complicit in the surveillance, imprisonment, torture, and silencing of activists around the world. The company claims it is selective about who it sells to and that it takes action when there are reports of abuse, but neither of these statements can possibly be true.

While NSO Group regularly attempts to discredit reports of abuse, their customer list includes many notorious misusers of surveillance technology. The sale of Pegasus to Bahrain is particularly egregious, considering that there is significant, longstanding, and documented evidence of Bahrain’s serial misuse of surveillance products including Trovicor, FinFisher, Cellebrite, and, now, NSO Group.

Once again, if NSO's statements about preventing abuse are going to be taken seriously, the company needs to dump customers with proven track records of human rights abuses. That's the bare minimum it can do to prevent its exploits from being used to target people governments just don't like. If these tools have been developed to fight dangerous crime and terrorism, the worst thing to do is place them in the hands of governments whose actions are criminal and often indistinguishable from terrorism.

Filed Under: activists, bahrain, dissidents, malware, pegasus, spyware, surveillance
Companies: citizen lab, nso group

Israeli Government Finally Decides To Start Looking Into NSO Group And Its Customers

from the laconic-ideal dept

The NSO Group's latest scandal is the gift that keeps on giving. The malware purveyor has always been controversial, thanks to its decision to sell powerful cellphone exploits to known human rights violators. That these exploits have been used to place world leaders, journalists, activists, and religious leaders under surveillance is just the expected result of choosing to do business with extremely shady governments.

A list of 50,000 phone numbers portrayed as potential targets for NSO's Pegasus malware is the latest black eye for the Israeli company. The list contains numbers linked to all of the sorts of individuals listed above -- not exactly the criminals and "Bin Ladens" of the world, as NSO claims its software is used to surveil.

These revelations have led to a lot of obfuscation and backpedaling by NSO, which simultaneously claims its customers do not abuse its products while also claiming it has no insight into how its customers choose to deploy the Pegasus malware. So, when NSO says it takes action when customers use its product to target people who aren't suspected criminals or terrorists, it's pretty much just making stuff up because it really doesn't know the malware is being used or who it's being deployed against.

This has prompted reactions all over the world. In France (where activists are being sued for claiming governments have deployed this spyware), French President Emmanuel Macron recently acquired a new phone after discovering his old one had potentially been targeted by a foreign government using NSO's spyware. This prompted a call from the French government to the Israeli government demanding some answers about NSO Group, its customers, and its targets.

It also prompted an investigation into the deployment of the Pegasus malware in France. And this shows you just how quickly a government can wrap up an investigation when it's sure it will be pointing its finger at other governments or their constituents: it only took nine days to get some actionable results.

France’s cybersecurity agency has confirmed the mobile phones of two French journalists from the investigative news outlet Mediapart were hacked with the Pegasus spyware, the first instance of such surveillance being detected by a government agency.

The hacking of the phones of Lénaïg Bredoux and Edwy Plenel, the two journalists from Mediapart, was earlier detected by Amnesty International’s security lab as part of the reporting by an international consortium of journalists on the targeting of 50,000 phone numbers around the world by clients of the Isreali firm NSO Group, which developed Pegasus.

Meanwhile, the Israeli government has opened its own... something... of NSO Group. But this inquiry is moving much more cautiously with local agencies showing much less urgency.

The Record reports NSO Group was "raided" by Israeli government agencies, including the Ministry of Defense. But The Record's own reporting shows this was much more casual than its headline suggests.

Israeli news outlet Calcalist, which also reported on the raids earlier today, cited an anonymous source who said the raids were more of a formal meeting than an in-depth audit of NSO’s documents and computer systems.

A tweet by the Ministry of Defense also appears to confirm this wasn't really a raid.

Representatives from a number of bodies came to NSO today to examine the publications and allegations raised in this case.

NSO says it "welcomes" the investigation and is cooperating with the Israeli government. As for the Ministry of Defense, it won't even go so far as to call it an "investigation."

Israel’s Defense Ministry has been mum about its plans to investigate the firm and remained laconic about the matter on Wednesday, refusing to elaborate on the nature of the visit, if a formal investigation had been launched, who the officials were and what specific allegations they were checking.

NSO must be feeling some pressure. While it's obligated to follow local export license laws when selling its products to foreign governments, it pretty much takes violating a UN embargo to run afoul of Israeli law, allowing NSO Group to sell its products to a number of countries that aren't exactly on good terms with the company's homeland. Nevertheless, for the first time ever, NSO Group is actually taking the sort of action it claims has always been standard operating procedure when its customers are suspected of abusing its products.

Israeli spyware company NSO Group has temporarily blocked several government clients around the world from using its technology as the company investigates their possible misuse, a company employee told NPR on Thursday.

The suspensions are in response to an investigation by the Pegasus Project, a consortium of media outlets that reported the company's Pegasus spyware was linked to hacks and potential surveillance of telephones of people including journalists, human rights activists and heads of state.

This seems to indicate that the list of numbers is actually related to NSO Group and potential targets of its customer base. If the list has nothing to do with NSO or its customers -- as NSO has claimed -- it likely wouldn't feel compelled to cut off customers and/or curtail their use of Pegasus malware. While this isn't an explicit admission of culpability by NSO, the implication is that the company sold its products to governments it knew would abuse them to surveil people they didn't like, rather than just criminals and terrorists.

Filed Under: israel, malware, pegasus, spyware, surveillance
Companies: nso group

Governments Accused Of Spying On Journalists And Activists With NSO Group Malware Are Now Suing Journalists And Activists

from the all-hosted-by-a-country-that-really-knows-how-to-host-a-war-or-two dept

I don't think anyone foresaw the immense amount of fallout that would result from the revelation that Israeli malware purveyor NSO Group's Pegasus software is being used to target phones belonging to journalists, activists, religious leaders, and high-ranking government officials. After all, some of this was already common knowledge, thanks to investigations by Citizen Lab and others delving into the inner workings of this powerful spyware.

The malware maker had already weathered plenty of negative press, thanks to its customers' questionable use of its products, as well as NSO Group's willingness to sell powerful exploits to enemies of Israel with long human rights abuse rap sheets.

The company is now trying to regain control of the narrative, but its statements and responses have raised more questions than they've answered. NSO claims it has nothing to do with the list of 50,000 potential target phone numbers seen by journalists (a list that contains nearly 200 journalists' phone numbers). It also says it has "no visibility" on customers' use of its malware, which undermines the strength of this denial. NSO also claims it cuts off governments who abuse the product to target journalists, religious leaders, and government officials, but [taps statement above] if NSO doesn't know what customers are doing with the malware, it seems highly unlikely the company is in any position to start cutting customers off.

It's not just NSO Group that's angry. Entire governments are now pissed off by these revelations. Not everyone is angry for the same reason, though.

In France, the revelation that President Emmanuel Macron's phone was on the list of NSO-linked numbers has resulted in Macron and 14 other French ministers acquiring new phones and numbers. The French government has also opened an investigation into the Moroccan government's use of NSO's Pegasus software, which is seemingly where the targeting of French officials originated.

Over in Morocco, the government is angry that it's been named as one of the main perpetrators of questionable targeting.

Morocco has filed defamation claims against Amnesty International and a French NGO who claim its intelligence services used the Pegasus mobile phone spyware against dozens of French journalists, lawyers for the government said Thursday.

"The Moroccan state ... wants all possible light cast on these false allegations from these two organisations, who make claims without any concrete or demonstrative evidence whatsoever," the lawyer, Olivier Baratelli, said in a statement.

Somewhat awkwardly, this defamation action is being pursued in France, where Moroccan government activities are now facing scrutiny from French investigators.

But even Moroccan government officials weren't exempt from the government's alleged spying efforts.

On Tuesday, Radio France claims the country’s monarch was on the list, as well as “a large number” of Moroccan royals.

The list is said to include the king’s wife Lalla Salma Bennani; his cousin Prince Moulay Hicham Alaoui, nicknamed the “red prince” for his progressive views; a former son-in-law of the late King Hassan II; entrepreneur Fouad Filali; and Hassan II’s former bodyguard, Mohamed Mediouri, who is the current king’s stepfather.

“But what is most surprising, when you look closely at this list, is that the sovereign himself is among those whose numbers were selected as potential Pegasus targets,” the report says.

And the government has placed journalists under surveillance in the past, undermining its new claims that it has never used the software nor purchased exploits from NSO Group.

[Amnesty International] found that [Moroccan journalist] Omar Radi’s phone was subjected to multiple attacks using a sophisticated new technique that silently installed NSO Group’s notorious Pegasus spyware. The attacks occurred over a period when Radi was being repeatedly harassed by the Moroccan authorities, with one attack taking place just days after NSO pledged to stop its products being used in human rights abuses and continued until at least January 2020.

So, there's a lot to unpack and hopefully the court will start doing that when it begins handling the Moroccan government's defamation claim. If there's any truth to the allegations, one would expect the lawsuit to be dropped if the Moroccan government is ordered to turn over information on its surveillance tech and spying activities.

Morocco isn't the only aggrieved national government, though. More litigation is in the works, courtesy of the Algerian government, which says it was falsely accused of utilizing the spyware to snoop on targets. This legal action will also be taking place in France.

Algeria said on Friday that it had filed a defamation claim against media watchdog Reporters Without Borders (RSF) after it back-pedalled accusations that the North African country had possessed Israeli-made Pegasus spyware.

Algeria's embassy in France said the complaint related to declarations the France-based organisation published on its website on July 19.

RSF had initially identified Algeria as among the countries possessing the spyware, developed by Israeli firm NSO Group, but on Friday it issued a correction.

RSF has since apologized for the error, but that isn't stopping the Algerian government from making a whole bunch of noise about the mistake.

"As well as their defamatory and false nature, these unacceptable allegations pertain to the manipulation of RSF, which is known for its relentlessness towards Algeria," the embassy said.

That's pretty mild compared to the doth-protest-too-much blustering of Morocco's Foreign Minister Nasser Bourita, who must be getting paid by the word to issue responses.

Morocco has also chosen to trust justice, at home and internationally, added Bourita, who denounced a “smokescreen”, and a “fabricated bluff (…) without any proof”, calling for “shedding light on the facts, far from controversy and slander.”

However, “this is what neither Forbidden Stories nor Amnesty International do. They base their stories solely on pure speculation”, Bourita said, noting that certain papers that are under the banner of Forbidden Stories “serve agendas that are well known for their primary hostility towards Morocco” and are ulcerated by the Kingdom’s successes under the leadership of King Mohammed VI.

This is mere hostility. This is not journalism. It is large-scale sabotage, he said.

And so it goes for several paragraphs, punctuated by the occasional even-hotter take.

“Is this a campaign? Yes! Is it denigration? Certainly! Is it orchestrated? It could not be otherwise! By whom? Time will tell,” he said.

Ah, "time will tell." Or will it? Sometimes it doesn't. Sometimes no one learns anything because the secrecy surrounding national security efforts meshes with NDAs signed by surveillance tech customers and, before anything gets really interesting, lawsuits get dropped and verbose rants are replaced with "requests for comment were not returned."

Whatever the provenance of The List, it has become a Pandora's Box for NSO Group. Never mind the fact NSO didn't actually open the box itself. It's open and NSO will have to start dealing with the mess it's created.

Filed Under: defamation, france, malware, morocco, surveillance
Companies: nso group

NSO Group Attempting To Distance Itself From Damaging Leak By Offering Up Contradictory Statements And 'Nothing To Fear' Platitudes

from the not-so-fun-when-you're-the-one-being-scrutinized-by-outsiders dept

This truly is a pleasure to observe. Israeli malware merchant NSO Group -- the purveyor of powerful spyware capable of turning a target's phone into a spy agency's plaything -- is playing a whole lot of defense after leaked data seen by a number of journalists and activists appears to confirm that NSO's customers are targeting… activists and journalists. (And world leaders, religious leaders, NGO employees, and friends and relatives of all of the above…)

While the origin of this data remains unclear, it appears to be related to NSO and its customers. And although NSO claims to be very selective about who it sells this powerful spyware to, its customers include governments of questionable character, including Saudi Arabia, United Arab Emirates, Mexico, Kazakhstan, and Uzbekistan.

This has thrust Shalev Hulio, the CEO and co-founder of NSO Group, into the limelight. He's clearly unprepared to be there. His statements and responses to questions are, at best, contradictory. At worst, they're nothing more than deflections that aren't going to persuade anyone that the allegations made by several news agencies and rights groups are false.

Here's Hulio's attempt (in an interview with Calcalist) to explain that the list of 50,000 phone numbers couldn't possibly have anything to do with NSO Group:

According to Hulio, "the average for our clients is 100 targets a year. If you take NSO's entire history, you won't reach 50,000 Pegasus targets since the company was founded. Pegasus has 45 clients, with around 100 targets per client a year. In addition, this list includes countries that aren't even our clients and NSO doesn't even have any list that includes all Pegasus targets - simply because the company itself doesn't know in real-time how its clients are using the system."

So, Hulio claims agencies only target a few people every year and that he knows this because "the company itself doesn't know in real-time how its clients are using the system." If the company doesn't know what customers are doing, it's pretty tough to claim definitively that they aren't targeting more phones than NSO thinks they are or that they aren't violating their agreements with NSO by pursuing "off-limits" targets like journalists and heads of state.

It is possible NSO knows how many targets each customer has, but this information suggests it's pretty easy to exceed the "100 clients a year" Hulio insists governments aren't exceeding.

In 2016, The New York Times reported that NSO Group charged $500,000 to set a client up with the Pegasus system, and then charged an additional fee to actually infiltrate people’s phones. At the time, the costs were reportedly $650,000 to hack 10 iPhone or Android users, or $500,000 to infiltrate five BlackBerry users. Clients could then pay more to target additional users, saving as they spy with bulk discounts: $800,000 for an additional 100 phones, $500,000 for an extra 50 phones, and so on.

Here's another seemingly-contradictory statement from NSO, as provided to Forbidden Stories, which was instrumental in breaking news of this data leak:

NSO does not have insight into the specific intelligence activities of its customers, but even a rudimentary, common sense understanding of intelligence leads to the clear conclusion that these types of systems are used mostly for purposes other than surveillance.

There's some word salad towards the end that means a whole lot of nothing, but pay attention to the opening of this statement: "NSO does not have insight into the specific intelligence activities of its customers." If this is true, there's no way NSO can definitively claim the leaked phone number list has nothing to do with its customers. And it also can't seriously claim that it cuts off customers who abuse the product to target individuals that aren't terrorists or criminal suspects.

This isn't the end of the flailing. Shalev Huilo also has conspiracy theories about the origin of the list currently in the news.

"I believe that in the end it's either Qatar or BDS or both," he said. "In the end it's always the same entities. I don't want to sound cynical now, but there are those who don't want [Israel] to import ice cream or export technologies."

Hulio is referring to Ben and Jerry's recent decision not to sell its ice cream in Israeli-occupied territories following years of BDS campaigns. Hulio also said that he doesn't think it's a coincidence that the investigation about his company dropped around the same time that another Israeli surveillance company, Cellebrite, is being challenged by digital rights group while attempting to go public, and the publication of an investigation about Candiru, yet another Israeli surveillance company.

"It's just illogical that this is all happening at once," he said.

Most of the time, coincidences are just that: coincidences. Far more rarely than people claim, coincidences aren't coincidences, but rather evidence of a conspiracy. In this case it's the former, an actual coincidence. And Hulio knows that because even he can't connect enough dots to narrow this down to a single perpetrator.

And the flailingest thing of all is this statement by Hulio, which echoes the statements made by government spy agencies when they're caught with their surveillance pants down:

“The people that are not criminals, not the Bin Ladens of the world—there’s nothing to be afraid of. They can absolutely trust on the security and privacy of their Google and Apple devices.”

Oh really? Then all these journalists and activists who have been targeted by NSO spyware are the "Bin Ladens of the world?" That's a bullshit response, especially when Hulio admits it can't control or even monitor its customers' use of the malware it sells them. Given the number of human rights violators it sells to, people who are not criminals or Bin Laden-alikes still have plenty to be afraid of.

Filed Under: malware, shalev hulio, surveillance
Companies: nso group

Leaked Data Shows NSO Group's Malware Was Used To Target Journalists, Activists, And World Leaders

from the not-your-usual-bad-guys dept

A massive data leak has confirmed what's been suspected (and reported by security researchers like Citizen Lab) for a long time: Israeli malware developer NSO Group's powerful cellphone snooping tools have been used to target journalists, activists, and dissidents all over the world.

The Guardian and 16 other media outlets have dug into the data leak and uncovered some pretty disturbing info about NSO's Pegasus malware, which allows those deploying the spyware to extract messages, record phone calls, and surreptitiously activate microphones.

Who's in the list of phone numbers seen by the Guardian? Lots and lots and lots of journalists.

The leak contains a list of more than 50,000 phone numbers that, it is believed, have been identified as those of people of interest by clients of NSO since 2016.

[...]

The disclosures begin on Sunday, with the revelation that the numbers of more than 180 journalists are listed in the data, including reporters, editors and executives at the Financial Times, CNN, the New York Times, France 24, the Economist, Associated Press and Reuters.

Here's who's included in this first revelation by the Guardian:

[J]ournalists who were selected as possible candidates for surveillance by NSO’s clients work for some of the world’s most prestigious media organisations. They include the Wall Street Journal, CNN, the New York Times, Al Jazeera, France 24, Radio Free Europe, Mediapart, El País, Associated Press, Le Monde, Bloomberg, Agence France-Presse, the Economist, Reuters and Voice of America.

Also found on the list was the number of Mexican reporter Cecilio Pineda Birto, who was murdered while waiting for his pickup to finish being cleaned at a local car wash. This followed weeks of death threats that began after his reporting accused state police and local government officials of colluding with crime lords.

It's not just journalists being targeted by NSO's powerful malware. The list also includes numbers linked to religious figures, executives of private companies, union officials, high-ranking government officials, and NGO employees.

NSO, for its part, continues to insist it's not the bad guy here. It says it only sells the software to a "select group" of "vetted" government agencies. Unfortunately, that list of approved governments includes notorious human rights violators like the Saudi government (which killed Washington Post reporter Jamal Khashoggi) and agencies in the UAE, Bahrain, and Kazakhstan.

The government of Mexico is one of NSO's most enthusiastic users. It "selected" 15,000 of the 50,000 numbers recovered in the data leak. This doesn't mean 15,000 successful deployments but it does mean the Mexican government -- which has no shortage of local criminals to target -- also apparently tried to infect phones owned by journalists.

NSO's hands are far from clean. Its list of clients isn't as selective as it likes to pretend. And while it may tell purchasers the spyware should only be used to target criminals and terrorists, it doesn't yank licenses from governments that choose to target journalists, academics, religious figures, and others.

Filed Under: activists, governments, journalists, malware, snooping tools, spyware, surveillance
Companies: nso group

Malware Merchant NSO Group Caught Leaving Harvested Location Data Exposed

from the oh-well-'little-people'-aren't-the-end-users-so-who-cares dept

Israeli surveillance tech firm NSO Group is something else. (Pejorative, yo.) It set up shop in a contested country where it's not all that paranoid to say everyone is out to get them. (But it's still a little paranoid, if not a lot racist.) That being said, Israel doesn't have a lot of nearby allies. And its ongoing conflict with Palestine hasn't made it any new friends.

You'd think a government contractor operating out of this space would be more judicious with its sales efforts. But finding new customers seems to be more important to NSO Group than defending its own country against attacks. NSO has sold its pervasive surveillance products -- ones that leverage popular messaging apps to create spy-holes in end-to-end encryption -- to anyone who wants them, including those that would turn these tools against Israeli citizens, journalists, and activists.

NSO has enabled a global war on dissent and criticism. It's not the only company that takes a hands-off approach to sales -- justifying the money in its pocket with claims it's nothing more than an exploit-hawking middleman. This has earned it some justifiable disdain. It has also earned it lawsuits, including one filed by a company too big to ignore: Facebook.

Multiple governments have purchased exploits from NSO, resulting in a worldwide war on journalists and activists. This makes NSO richer. But it doesn't make the company any smarter. NSO and Israel briefly joined forces to engage in domestic surveillance, utilizing NSO's malware to facilitate COVID contact tracing -- an effort swiftly blocked by an Israeli court.

NSO hasn't slowed down its surveillance efforts -- the ones deployed by its customers. But it has again managed to generate unfavorable headlines and coverage. The company, whose offers of contact tracing were rejected by an Israeli court, hasn't dialed back its efforts to place people under surveillance -- supposedly for the public good.

But its exploits have their own security flaws. While it was trying to sell governments its contract tracing goods, it failed to secure some of the data it had been gathering in hopes of vertically integrating its spy tech and its "concern" for the general population's health. Zack Whittaker reports for TechCrunch:

NSO, a private intelligence company best known for developing and selling governments access to its Pegasus spyware, went on the charm offensive earlier this year to pitch its contact-tracing system, dubbed Fleming, aimed at helping governments track the spread of COVID-19. Fleming is designed to allow governments to feed location data from cell phone companies to visualize and track the spread of the virus. NSO gave several news outlets each a demo of Fleming, which NSO says helps governments make public health decisions “without compromising individual privacy.”

But in May, a security researcher told TechCrunch that he found an exposed database storing thousands of location data points used by NSO to demonstrate how Fleming works — the same demo seen by reporters weeks earlier.

NSO has responded to the hole it didn't close until notified by TechCrunch -- months after the first notification by the security researcher. It says the data seen in the breach isn't "real and genuine data."

Well, we'll see if that's true. At this point, this appears to be bullshit. As Whittaker notes, NSO's statement conflicts with news reports about NSO's use of location data sold to it by third-party brokers who gather location info from phone apps. NSO used this data to "train" its contact tracing AI. It's still "real and genuine data," even if NSO wasn't (yet!) using it in real-word applications.

TechCrunch asked researchers at Forensic Architecture, an academic unit at Goldsmiths, University of London that studies and examines human rights abuses, to investigate. The researchers published their findings on Wednesday, concluding that the exposed data was likely based on real phone location data.

Whatever the real-world applications by NSO, the fact is NSO utilized data of thousands of individuals from multiple countries (Rwanda, Israel, Saudi Arabia, UAE, Bahrain) to train an AI it was pitching to world governments -- a pitch that likely did not inform potential end users NSO would be buying data in bulk from brokers who are generally unconcerned about local data privacy laws.

NSO may be trying to rehabilitate its image by offering its considerable surveillance power to the fight against COVID, but its efforts show it's really still just in the business of collecting everything it can while expanding its user base to whoever's willing to buy -- even if it includes foreign enemies.

A failure to secure a database -- even if it's only filled with "trial" data -- is a monumental self-own. This indicates NSO isn't nearly as careful as it should be, considering the wealth of data/communications it helps government agencies siphon from targets' devices. When millions of people around the world are just grist for the surveillance mill, it rarely seems imperative to protect the data you've harvested from them. The only thing that matters to NSO is surveillance and the profit made. Collateral damage doesn't affect its bottom line -- not when there's a host of human rights violators lining up to buy your goods.

Filed Under: data breach, exploits, hacking, location data, security, surveillance
Companies: nso group