NSO, Not Government Clients, Operates Its Spyware

jojowombl shares a report from The Guardian: Legal documents released in ongoing US litigation between NSO Group and WhatsApp have revealed for the first time that the Israeli cyberweapons maker -- and not its government customers -- is the party that "installs and extracts" information from mobile phones targeted by the company's hacking software. The new details were contained in sworn depositions from NSO Group employees, portions of which were published for the first time on Thursday.

It comes five years after WhatsApp, the popular messaging app owned by Facebook, first announced it was filing suit against NSO. The company, which was blacklisted by the Biden administration in 2021, makes what is widely considered the world's most sophisticated hacking software, which -- according to researchers -- has been used in the past in Saudi Arabia, Dubai, India, Mexico, Morocco and Rwanda. [...] At the heart of the legal fight was an allegation by WhatsApp that NSO had long denied: that it was the Israeli company itself, and not its government clients around the world, who were operating the spyware. NSO has always said that its product is meant to be used to prevent serious crime and terrorism, and that clients are obligated not to abuse the spyware. It has also insisted that it does not know who its clients are targeting. [...]

To make its case, WhatsApp was allowed by Judge Phyllis Hamilton to make its case, including citing depositions that have previously been redacted and out of public view. In one, an NSO employee said customers only needed to enter a phone number of the person whose information was being sought. Then, the employee said, "the rest is done automatically by the system." In other words, the process was not operated by customers. Rather NSO alone decided to access WhatsApp's servers when it designed (and continuously upgraded) Pegasus to target individuals' phones. A spokesperson for NSO, Gil Lainer, said in a statement: "NSO stands behind its previous statements in which we repeatedly detailed that the system is operated solely by our clients and that neither NSO nor its employees have access to the intelligence gathered by the system. We are confident that these claims, like many others in the past, will be proven wrong in court, and we look forward to the opportunity to do so."

The question should be, who has the kill switch?

[evanh]

When asked like that, it's pretty clear NSO always retain the ability to disable the software. After all, they're always going to want to control/update who it can be used against. Not unlike being able to cut off the supply of munitions.

Re:

[Mirnotoriety]

> who has the kill switch?

Mossad ASIO BND DGSE DIA FSB GCHQ NSA

Time for Interpol to get involved?

[Gravis Zero]

I'm no lawyer but if you keep doing business with a government that violates human rights of the people the you provide information on, you are an accomplice to the crime.

Re:

[Valgrus Thunderaxe]

Which government is this, specifically?

Re:

[Gravis Zero]

Try reading the summary because there's a list.

Re:

[Gravis Zero]

This is for you: https://en.wikipedia.org/wiki/... [wikipedia.org]

Simple test

[spaceman375]

Purchase the software. Give it the phone numbers of the executives, board members, and employees of NSO. See what response you get. This will tell you if NSO controls, or at least knows, who is targeted. If you actually get any real data, I'd suggest that this would be one of the rare times where doxxing is appropriate.

Re:

[ravenshrike]

Nah, that could just as easily be a pre-programmed blacklist of numbers that it wouldn't process. Also, the idea that an automated process dependent on data entry by the user isn't controlled by the one who set it in motion is more than a bit silly.

I saw that back in 2019 too

[TrancePhreak]

Glad to see more remember too! Don't forget, they have exploit injection at factory some places too. You did a great job with the write up.

Still not sure how this is legal

[kmoser]

When a 14-year-old writes an exploit that lets you hack into anyone's phone, he gets busted. When a company does the same thing, they get customers.

Re:

[Valgrus Thunderaxe]

Please cite exactly which laws were broken in this case.

Nice!

[sosume]

| "To make its case, WhatsApp was allowed by Judge Phyllis Hamilton to make its case"

maybe they could have made their case if the Judge had made its case to make the case..