NSO Spyware Used To Snoop On US State Department Employees Stationed In Uganda

from the just-another-day-at-work-for-NSO-Group dept

Israeli exploit seller NSO Group has long past reached the limits of its non-denials and deflection attempts. There's only bad news on the horizon for the tech company, which would be a lot less disheartening for the company if it hadn't been preceded by months of bad news.

Already considered morally suspect due to its decision to sell powerful phone hacking tools to human rights violators, NSO has since proven to be pretty much amoral. Investigations uncovering abuse of its spyware to hack phones of journalists and activists began to surface three years ago before a leaked database of alleged spyware targets was given to investigators and journalists. Since then, NSO has waged a losing battle with a seemingly endless onslaught of revelations that put its hacking tools in the hands of bad actors and its powerful spyware (Pegasus) in the phones of journalists, activists, lawyers, diplomats, politicians, and religious leaders.

NSO was sued by WhatsApp and Facebook in 2019 for using the messaging app to send malware to targets. It was sued by Apple just a couple of weeks ago for targeting iPhone users. It is facing investigations in a handful of countries, including its home base. It has been blacklisted by the US Commerce Department and its list of governments it can sell to has been drastically trimmed by the Israeli government, from 102 to 37.

The question now is: does NSO Group even feel it when news breaks about additional misuse of its spyware? Or does it just prompt an exasperated "what now?!" from its execs as it tries to figure out how to remain viable in the future? Whatever the case is, this latest revelation isn't going to get its Commerce Department blacklisting lifted any time soon.

iPhones of at least nine U.S. State Department employees were hacked by an unknown assailant using sophisticated spyware developed by the Israel-based NSO Group, according to four people familiar with the matter.

The hacks, which took place in the last several months, hit U.S. officials either based in Uganda or focused on matters concerning the East African country, two of the sources said.

The intrusions, first reported here, represent the widest known hacks of U.S. officials through NSO technology.

The Reuters report says the source of the hacking hasn't been identified. But one can assume it was entities opposed to whatever aims the US State Department hopes to achieve in Uganda, which apparently includes simply trying to meet with opposition leaders. People don't spy on people whose aims are allied with theirs. And attribution has limited worth. Entities willing to abuse spyware to hack the phones of political opponents -- especially those operating under diplomatic immunity -- aren't really going to care if their wrongdoing is exposed.

And NSO only has to care now because it has spent years claiming it does everything it can to prevent misuse of its powerful malware -- only to have that assertion exposed as a lie with six months of uninterrupted news releases showing its hacking tools have been misused multiple times by multiple entities. Accompanying this steady drip of news reports has been zero evidence of NSO's asserted oversight or willingness to terminate contracts with entities who've abused its malware.

NSO's response to this report is no different than its response to several others: it will do something about this now that it has made international headlines.

"If our investigation shall show these actions indeed happened with NSO's tools, such customer will be terminated permanently and legal actions will take place..."

That's meaningless. NSO claims it has no visibility into its customers' actions and, if this is true, it has no way of investigating these claims. It's all just noise, something almost less substantial than a "no comment." The State Department's response means more: it simply pointed to NSO's blacklisting by the federal government. And that's pretty much all that needs to be said by witnesses and victims of these hacking attempts. NSO is running out of bridges to burn. There will always be a market for easily abused malware. But it's becoming much more difficult to keep these abuses secret and that's what has harmed NSO the most.

Filed Under: malware, pegasus, spyware, state department, surveillance
Companies: nso group

After Months Of Troubling News, Israel's Government Finally Limits Who NSO Group Can Sell To

from the tough-to-stay-solvent-using-a-'scorch-your-own-earth'-policy dept

Well, it's been yet another hilarious couple of days for Israel's NSO Group. I mean, not so much for NSO, which is currently sitting at the center of a raging dumpster fire of its own creation. But just because NSO isn't laughing doesn't mean it's not funny.

For years, it sold spyware to whoever wanted it. Those customers used the powerful phone exploits to target journalists, activists, dissidents, and high-ranking government officials.

Some of this had already been exposed by security researchers like Canada's Citizen Lab before the bombshell dropped: a list of 50,000 alleged NSO malware targets. NSO denied having anything to do with the list, but report after report tied its spyware to abuse by government agencies and quasi-political leaders like kings and princes in the United Arab Emirates, one who used the malware to hack the phone of his ex-wife and her lawyer.

France's President, Emmanuel Macron, was one of those on the target list obtained by journalists. This prompted the President (and other French government officials) to acquire new phones. Because of this, the French government has decided it won't be requiring the services of NSO in the future.

At the exact same time, MIT Technology Review has learned, French government officials were in the final stages of contract negotiations to purchase Pegasus hacking tools from NSO. The French were on the verge of buying the tool—in the type of deal that is typically worth millions of dollars—despite years of allegations that it was regularly being used to surveil and harass dissidents, journalists, and human rights activists worldwide.

But sources familiar with the deal say that the process fell apart after the accusations that French politicians potentially were among those targeted, and negotiations were broken off just a few days before the sale was set to take place. After publication, France’s Ministry of Foreign Affairs denied it was in the process of purchasing NSO Group tools.

That takes one customer off the list for NSO. The Israeli government -- after years of ignoring NSO's sales to human rights violators -- has further limited the company's market base, removing nearly two-thirds of the countries on its approved purchasers list.

The Defense Ministry has dramatically scaled back the number of countries to which Israeli companies can sell cyber technologies amid global fallout over Israeli spyware firm NSO Group, according to a report Thursday.

The updated November list consists of 37 countries, down from 102, according to the Calcalist business news daily.

Countries with questionable human rights records, including Israel’s new allies Morocco and the UAE, have been removed, the report said.

Much like everything related to the fallout from the NSO target list obtained in July, this could have been prevented if NSO had decided not to sell to governments known to routinely violate human rights or -- if it just couldn't help itself -- its government had forbidden sales of powerful malware to these countries.

Having fewer customers isn't going to help NSO climb back out of the hole it dug for itself. This trimming of its potential user base follows blacklisting by the US Commerce Department -- something that had an almost-immediate effect on the company's credit rating.

According to Bloomberg, Moody’s dropped NSO’s credit rating by two levels, asserting that the company’s risk of defaulting on its debts had increased and noting that the company has been losing money since 2020.

Not that NSO was in great financial shape to begin with. This was the second downgrade by Moody's, the first of which came a month before the July release of the alleged NSO spyware target list.

Moody’s said in June that it downgraded the company’s rating from B2 to B3, adding that its outlook remains negative. The report said most of the debt is supposed to be repaid in March 2025.

NSO has been offering up nonsensical and contradictory defenses of its actions for several months. Now, it's just flailing. It now wants people to believe its current woes are the end result of an anti-Israel conspiracy.

In a letter, [NSO] argued that the U.S. blacklisting arose from "an orchestrated campaign by anti-Israel organizations" that would result in hundreds of employees losing their job, according to Israeli news site Walla.

That's a ridiculous assertion. NSO would be toxic no matter where it was located. And it has had years to head off this sort of worldwide reckoning but chose to reap the profits, rather than control use of its powerful phone hacking tools. Investigations attributing phone hacks of journalists and human rights activists to NSO malware have been public knowledge for a few years now, and the company's response (until now) has been to do nothing.

By waiting this long to finally start addressing these allegations, NSO has limited its options to making nonsensical defensive statements and, presumably, starting to figure out how much its office furniture might go for at auction.

The same can be said for the Israeli government, which has been aware of these troubling allegations about NSO for just as long, but instead chose to urge on sales to human rights abusers, rather than discourage NSO from pursuing business relationships with governments that were always going to end up abusing the powerful malware. Due to this close relationship, NSO's problems are also Israel's problems, which is likely why even the Israeli government is trying to distance itself from the country's most toxic asset.

Filed Under: israel, malware, pegasus, spyware, surveillance
Companies: nso group

NSO Made Millions Selling Phone Hacking Tools To The Princes And Kings Of The United Arab Emirates

from the handing-more-power-to-the-unassailably-powerful dept

NSO Group can't get a break. Too bad. It really doesn't deserve one. The inability of the Israeli exploit purveyor to escape this endlessly negative news cycle is entirely its own fault. And each passing day seems to uncover something new and nasty about the tech company, which has built its business by seemingly selling to whoever wants to buy, no matter how morally repugnant.

The company's malware has been deployed by a variety of repeat human rights offenders to target journalists, critics, dissidents, religious leaders, opposition parties, and the occasional heads of state of their allies. To its own critics, NSO has issued contradictions: it is not responsible for how its customers use its products and that it does everything it can to prevent misuse of its products. The contradiction is baked in: NSO says it pulls access for misuse while claiming it has no "visibility" into its customers' activities.

It also says it does not sell its powerful malware to private entities. But the fine line between public and private entities is never finer than in the United Arab Emirates, where the allied rulers of the area are also private citizens -- kings and princes with access to a whole lot of wealth and a whole lot of power.

A prince can claim to be a government official and still behave like a private citizen. Take Sheikh Mohammed bin Rashid al-Maktoum of Dubai. He's the king of Dubai. He's also in the middle of an extremely messy, somewhat public divorce from Princess Haya bint al-Hussein. His access to NSO's most popular phone exploit (Pegasus) allowed him to hack phones belonging to his ex, along with phones belonging to her legal reps.

But he's not the only UAE figurehead with NSO contracts. Israeli news agency Haaretz reports NSO has sold to other kings and princes who control parts of UAE: men who have plenty of private business that could benefit from a bit of phone hackery using tools obtained under the auspices of Official Government Business.

The Israeli cyber firm NSO sold its Pegasus mobile-phone hacking software to two different leaders of the United Arab Emirates – Abu Dhabi ruler Mohammed Bin Zayed and Dubai ruler Sheikh Mohammed Bin Rashid al-Makhtoum.

TheMarker has learned that the price each of these clients paid in dollars is a seven- to eight-figure number.

It's not that UAE doesn't have national security and law enforcement agencies that would make better homes for phone hacking tools. (I mean comparatively…) The UAE has a federal police force and a joint national security agency that's supposed to handle the sorts of things (serious crime, terrorist activity) NSO swears up and down its customers are using its exploits to combat.

So, why sell the princes and kings, who have few obligations to the people they rule over… you know, since they're rulers rather than elected officials? Apparently, the answer is because they have millions to spend on phone hacking tools and a company willing to exchange goods and services for money while pretending to hold its nose, cover its eyes and ears, and act all defensive when people ask the why in the almighty fuck are they selling exploits to the United Arab Emirates, much less its literal ruling class?

NSO says publicly (and a lot more frequently in recent months) that it takes a hard line on the abuse of its products to violate human rights. But it says that after years of selling to rulers with long histories of extremely severe human rights violations. Both things can't be true. And a cursory Google search would give NSO all the due diligence it needs to refuse to sell to rulers (and government agencies) located in places like Dubai and Abu Dhabi. (Not to mention others with the same cavalier attitude towards life and liberty.)

Recent revelations are forcing NSO to put its money where its mouth is. With every new report of violations and use by human rights violators, the company is now obligated to yank access and cancel contracts. I cannot imagine how uncomfortable it will be for the company to approach rulers who preside over areas where executions and disappearances of critics are commonplace. But suck it up, NSO. The best way to avoid having to tell brutal rulers their business is no longer welcome is to never welcome it in the first place.

Worse, the country NSO calls home may be partly to blame.

In some cases, including the sale of two systems to two separate rulers in the UAE, the Pegasus system was only sold following heavy pressure from the Israeli government, as part of the diplomatic warming between Israel and the UAE. Yet the system’s irregular use embarrassed NSO and caused the third bout of bad publicity the company has sustained since being blacklisted by the U.S. last week.

So, if the Israeli government feels any complicity in the current state of NSO affairs, it probably should send a couple of diplomats along to ensure the revocation of hacking power by NSO not only actually happens, but happens without part of the NSO sales force being disappeared for having the audacity to tell these half-patriarchy/half-oligarchy rulers to take their business elsewhere.

Filed Under: dubai, israel, malware, pegasus, spyware, surveillance, uae
Companies: nso group

New Investigation Shows A US Journalist Critical Of The Saudi Government Was Hit With NSO Spyware

from the truly-an-unsurprising-development dept

Malware merchant NSO Group's year of embarrassment continues. Leaked data published in July appeared to show NSO malware (namely its phone-hijacking malware Pegasus) had been used to target dissidents, journalists, religious leaders, and prominent politicians.

NSO reacted by first claiming the data showed nothing of the sort or at least was unrelated to its malware and its customers. Then it made contradictory claims, saying it terminated contracts when it discovered abuse of its products and that it had no visibility into its customers' actions. Puzzling.

Then things somehow got worse. Countries accused of using NSO Group malware to target critics and journalists decided to sue critics and journalists. Israel's government opened an investigation into the Israeli company. Another investigation found the government of Bahrain was engaging in exactly the kind of abuse NSO claimed it didn't allow. And, thanks to some pretty ugly divorce proceedings, it came to light that the Dubai's king had used the malware to spy on his ex-wife and her lawyer.

The debacle continues. An investigation by Citizen Lab -- which has uncovered previous misuse of NSO's software -- reveals an American journalist was targeted multiple times by NSO's hacking tools.

New York Times journalist Ben Hubbard was repeatedly targeted with NSO Group’s Pegasus spyware over a three-year period from June 2018 to June 2021. The targeting took place while he was reporting on Saudi Arabia, and writing a book about Saudi Crown Prince Mohammed bin Salman.

The investigators aren't sure who targeted Hubbard, but they do note that complaining to NSO about being targeted in violation of the company's guidelines has zero deterrent effect on future targeting.

The targeting resulted in Pegasus infections in July 2020 and June 2021. Notably, these infections occurred after Hubbard complained to NSO Group that he was targeted by the Saudi-linked KINGDOM Pegasus operator in June 2018.

While it would seem the most likely suspect is the Saudi government (or perhaps the prince himself, given what we now know about individual misuse of NSO spyware), Citizen Lab doesn't have enough information to definitively say who's behind the second round of targeting. And, given government/government officials' willingness to sue journalists over accusations of spying, Citizen Lab is wise to play it safe when it comes to attribution.

The in-depth report is worth reading, detailing how Citizen Lab arrived at these conclusions, as well as noting the similarities between these attacks (which utilized both malicious links and zero-click exploits) and ones observed targeting a Saudi activist earlier this year. And it shows NSO is still months away from being able to put this in the rearview mirror. A change of culture is needed at NSO and it needs to cancel all contracts with countries whose governments whose abuses of human rights and hacking tools have already been the subject of years of reporting.

Filed Under: ben hubbard, malware, pegasus, spyware, surveillance
Companies: citizen lab, nso

In Latest Black Eye For NSO Group, Dubai's King Found To Have Used NSO Spyware To Hack His Ex-Wife's Phone

from the slumming-it-as-a-service dept

NSO Group has endured some particularly bad press lately, what with leaked data pointing to its customers' targeting of journalists, political figures, religious leaders, and dissidents. That its powerful spyware would be abused by its customers was not surprising. Neither were the findings from the leaked data, which only confirmed what was already known.

Despite this, NSO continues to make contradictory claims. First, it says it has no control (or visibility) as to how its customers use its products -- customers that include some notorious abusers of human rights. Second, it says that it cuts off customers who abuse its products to target people who only annoy their governments, rather than directly threaten it with criminal or terrorist acts.

Well, it's either one or the other. And if NSO is waiting for secondhand reports about abusive deployments to act, it really shouldn't be in the intel business. If NSO wants to stay above the fray, it could start by being a lot more selective about who it sells to.

If you're not selective, your customers will not only pettily target people (critics, activists, journalists, dissidents) the government doesn't like but will move on to the extreme pettiness of targeting people certain government officials don't like.

This latest nadir for NSO Group comes courtesy of court proceedings, which illustrates the danger of putting powerful cellphone exploits in the hands of the wrong people.

Dubai's ruler Sheikh Mohammed bin Rashid al-Maktoum ordered the phones of his ex-wife and her lawyers to be hacked as part of a "sustained campaign of intimidation and threat" during the custody battle over their children, England's High Court has ruled.

Mohammed used the sophisticated "Pegasus" software, developed by Israeli firm NSO for states to counter national security risks, to hack the phones of Princess Haya bint al-Hussein, half-sister of Jordan's King Abdullah, and some of those closely connected to her, according to the rulings.

That's the sort of thing you can expect to happen when powerful hacking tools are given to people who have never proven they're capable of handling power responsibly. Adding to the irony is the fact that the King's ex was tipped off by the wife of Tony Blair, who used to work as an outside legal adviser for NSO Group.

Now that this has been exposed, NSO is finally ready to take action.

Once the hacking was uncovered, NSO cancelled its contract with the UAE, Haya's lawyers said. The Israeli firm said it could not immediately comment on the case, but said it took action if it received evidence of misuse of Pegasus.

Well, duh (to use a technical term). But if NSO is so supposedly "proactive" why even sell to the UAE at all? It's not as though it has a long, storied history of respecting rights, much less those possessed by women who also happen to have angered the king? While I understand it might be difficult to promise investors steadily-increasing returns if you choose not to sell to questionable entities, it seems like a long run of bad press and government investigations might have the same effect on the bottom line. Or maybe NSO's investors are just as unconcerned about its partnerships with abusive governments as it is. Whatever the case is, it's led NSO to where it is now: a company best known for giving oppressive governments even more oppression options.

Filed Under: dubai, hacking, malware, pegasus, princess haya bint al-hussein, sheikh mohammed bin rashid al-maktoum, spyware
Companies: nso group

Investigation Finds NSO Malware Being Used By The Bahrain Government To Target Activists And Dissidents

from the truly-unsurprising-development dept

More bad news for Israeli malware purveyor NSO Group. Despite its contradictory and simultaneous claims that it does not allow its customers to abuse its products and that it has no way of monitoring use of its products, more evidence continues to surface that shows the company's customers are deploying NSO's malware to target journalists, activists, prominent politicians, and religious leaders.

Citizen Lab -- which has uncovered plenty of abusive use of NSO malware previously -- has released another report showing an abusive government abusing NSO spyware to spy on activists opposed to the country's current leadership. The investigation also confirms something NSO has repeatedly denied: that the list of numbers leaked to journalists and investigators is actually a list of potential targets of NSO's customers. That list included plenty of journalists, activists, politicians, and religious leaders.

Perhaps the most worrying thing about this report is the use of an exploit that bypasses security measures activists would logically adopt: refusing to click on links sent by unknown senders.

We identified nine Bahraini activists whose iPhones were successfully hacked with NSO Group’s Pegasus spyware between June 2020 and February 2021. Some of the activists were hacked using two zero-click iMessage exploits: the 2020 KISMET exploit and a 2021 exploit that we call FORCEDENTRY.

The hacked activists included three members of Waad (a secular Bahraini political society), three members of the Bahrain Center for Human Rights, two exiled Bahraini dissidents, and one member of Al Wefaq (a Shiite Bahraini political society).

And here's at least partial confirmation that the leaked list of potential targets has something to do with NSO Group and its customers:

We shared a list of the targeted phone numbers we identified with Forbidden Stories. They confirmed that numbers associated with five of the hacked devices were contained on the Pegasus Project’s list of potential targets of NSO Group’s customers, data that Forbidden Stories and Amnesty International describe as dating from 2016 up to several years ago.

If NSO Group is serious about preventing abuse of its products, the first step it could take is refusing to sell exploits to abusive governments. As Citizen Lab points out, Bahrain's government has a long history of human rights abuses. While things improved slightly and briefly around the turn of the century, everything reverted back to the abusive mean a decade later, when reforms were rolled back and the government went back to imprisoning and torturing dissidents, critics, and anti-government activists.

And you can't find people to jail and torture without domestic spying, which the Bahraini government enthusiastically engages in. That apparently includes spying on activists and dissidents who have left the country. The report says two Bahrain citizens who now live in London were hit with NSO malware. But this may have been a proxy hack on behalf of the Bahrain government. Citizen Lab notes it has only seen the Bahrain government deploy malware in its own country or in neighboring Qatar. So, these hacks may have been performed on its behalf by a friendly government with its own set of NSO malware.

In conclusion, NSO Group is complicit in the surveillance, imprisonment, torture, and silencing of activists around the world. The company claims it is selective about who it sells to and that it takes action when there are reports of abuse, but neither of these statements can possibly be true.

While NSO Group regularly attempts to discredit reports of abuse, their customer list includes many notorious misusers of surveillance technology. The sale of Pegasus to Bahrain is particularly egregious, considering that there is significant, longstanding, and documented evidence of Bahrain’s serial misuse of surveillance products including Trovicor, FinFisher, Cellebrite, and, now, NSO Group.

Once again, if NSO's statements about preventing abuse are going to be taken seriously, the company needs to dump customers with proven track records of human rights abuses. That's the bare minimum it can do to prevent its exploits from being used to target people governments just don't like. If these tools have been developed to fight dangerous crime and terrorism, the worst thing to do is place them in the hands of governments whose actions are criminal and often indistinguishable from terrorism.

Filed Under: activists, bahrain, dissidents, malware, pegasus, spyware, surveillance
Companies: citizen lab, nso group

Israeli Government Finally Decides To Start Looking Into NSO Group And Its Customers

from the laconic-ideal dept

The NSO Group's latest scandal is the gift that keeps on giving. The malware purveyor has always been controversial, thanks to its decision to sell powerful cellphone exploits to known human rights violators. That these exploits have been used to place world leaders, journalists, activists, and religious leaders under surveillance is just the expected result of choosing to do business with extremely shady governments.

A list of 50,000 phone numbers portrayed as potential targets for NSO's Pegasus malware is the latest black eye for the Israeli company. The list contains numbers linked to all of the sorts of individuals listed above -- not exactly the criminals and "Bin Ladens" of the world, as NSO claims its software is used to surveil.

These revelations have led to a lot of obfuscation and backpedaling by NSO, which simultaneously claims its customers do not abuse its products while also claiming it has no insight into how its customers choose to deploy the Pegasus malware. So, when NSO says it takes action when customers use its product to target people who aren't suspected criminals or terrorists, it's pretty much just making stuff up because it really doesn't know the malware is being used or who it's being deployed against.

This has prompted reactions all over the world. In France (where activists are being sued for claiming governments have deployed this spyware), French President Emmanuel Macron recently acquired a new phone after discovering his old one had potentially been targeted by a foreign government using NSO's spyware. This prompted a call from the French government to the Israeli government demanding some answers about NSO Group, its customers, and its targets.

It also prompted an investigation into the deployment of the Pegasus malware in France. And this shows you just how quickly a government can wrap up an investigation when it's sure it will be pointing its finger at other governments or their constituents: it only took nine days to get some actionable results.

France’s cybersecurity agency has confirmed the mobile phones of two French journalists from the investigative news outlet Mediapart were hacked with the Pegasus spyware, the first instance of such surveillance being detected by a government agency.

The hacking of the phones of Lénaïg Bredoux and Edwy Plenel, the two journalists from Mediapart, was earlier detected by Amnesty International’s security lab as part of the reporting by an international consortium of journalists on the targeting of 50,000 phone numbers around the world by clients of the Isreali firm NSO Group, which developed Pegasus.

Meanwhile, the Israeli government has opened its own... something... of NSO Group. But this inquiry is moving much more cautiously with local agencies showing much less urgency.

The Record reports NSO Group was "raided" by Israeli government agencies, including the Ministry of Defense. But The Record's own reporting shows this was much more casual than its headline suggests.

Israeli news outlet Calcalist, which also reported on the raids earlier today, cited an anonymous source who said the raids were more of a formal meeting than an in-depth audit of NSO’s documents and computer systems.

A tweet by the Ministry of Defense also appears to confirm this wasn't really a raid.

Representatives from a number of bodies came to NSO today to examine the publications and allegations raised in this case.

NSO says it "welcomes" the investigation and is cooperating with the Israeli government. As for the Ministry of Defense, it won't even go so far as to call it an "investigation."

Israel’s Defense Ministry has been mum about its plans to investigate the firm and remained laconic about the matter on Wednesday, refusing to elaborate on the nature of the visit, if a formal investigation had been launched, who the officials were and what specific allegations they were checking.

NSO must be feeling some pressure. While it's obligated to follow local export license laws when selling its products to foreign governments, it pretty much takes violating a UN embargo to run afoul of Israeli law, allowing NSO Group to sell its products to a number of countries that aren't exactly on good terms with the company's homeland. Nevertheless, for the first time ever, NSO Group is actually taking the sort of action it claims has always been standard operating procedure when its customers are suspected of abusing its products.

Israeli spyware company NSO Group has temporarily blocked several government clients around the world from using its technology as the company investigates their possible misuse, a company employee told NPR on Thursday.

The suspensions are in response to an investigation by the Pegasus Project, a consortium of media outlets that reported the company's Pegasus spyware was linked to hacks and potential surveillance of telephones of people including journalists, human rights activists and heads of state.

This seems to indicate that the list of numbers is actually related to NSO Group and potential targets of its customer base. If the list has nothing to do with NSO or its customers -- as NSO has claimed -- it likely wouldn't feel compelled to cut off customers and/or curtail their use of Pegasus malware. While this isn't an explicit admission of culpability by NSO, the implication is that the company sold its products to governments it knew would abuse them to surveil people they didn't like, rather than just criminals and terrorists.

Filed Under: israel, malware, pegasus, spyware, surveillance
Companies: nso group

Israeli Tech Company's Spyware Still Being Used To Target Journalists And Activists

from the buy-it-for-safety,-use-it-for-evil dept

Israeli exploit/malware developer NSO Group says its products are marketed to governments for legitimate national security and law enforcement purposes. Yet somehow it keeps ending up in the hands of governments with terrible human rights records and deployed against journalists, dissent groups, and activists.

The software sold by NSO is being deployed against journalists in Mexico -- ones looking to expose government corruption. This report by the Columbia Journalism Review provides more details on the hacks, building off Citizen Lab's exposure of NSO's "Pegasus" spyware.

Mexico has been ground zero for Pegasus’s deployment against journalists. At least six reporters have been targeted there, according to exhaustive research by both Citizen Lab and the Mexican digital rights group R3D. Those attacks coincided with major journalistic investigations that challenged the Mexican government. For example: three reporters who were targeted worked on the “Casa Blanca Scandal,” a major story exposing how Mexico’s first lady was given a mansion by a government contractor who later received lucrative contracts. Mexican television journalist Carlos Loret de Mola was targeted while he was reporting on extrajudicial killings. Although three Mexican federal agencies have access to Pegasus, the government has denied it ever launched any attacks on reporters.

This is more of the same for NSO's spyware. Citizen Lab also uncovered use of the software by notorious humans rights violators like Saudi Arabia, Kazakhstan, and the United Arab Emirates. In many cases, deployments targeted critics and activists, rather than criminals or national security threats. The deployments are disturbing enough. The tactics are even worse:

The targets received SMS messages that included links to NSO exploits paired with troubling personal and sexual taunts, messages impersonating official communications by the Embassy of the United States in Mexico, fake AMBER Alerts, warnings of kidnappings, and other threats.

CJR's report is supposed to act as a warning for journalists around the world. They are targets, no matter what their governments say and no matter how NSO frames its pitches.

And we're not completely immune to this in the United States. Although any deployment against journalists would be viewed as a serious violation of Constitutional rights, the fact is US government agencies are seeking to purchase NSO's spyware for use in their work. The DEA has met with NSO in the recent past and the agency's own past suggests it isn't above violating rights to further its own ends. No rights violations have been seen yet but, as we've seen before, the government is willing to impersonate journalists to track down suspects. Infecting journalists' phones to track down leakers and whistleblowers isn't that much of a step forward.

Filed Under: activists, journalism, mexico, pegasus, spyware
Companies: citizen lab, nso