Facebook has sued the NSO Group, a security software maker allegedly responsible for using the WhatsApp message platform to spread spyware earlier this year. The lawsuit claims the NSO Group used WhatsApp servers to deliver spyware to 1,400 mobile devices between April and May, allowing it to decrypt private messages. Facebook wants an injunction against the NSO Group barring it from using WhatsApp or Facebook services, along with damages and costs.
While at first the lawsuit seems to be focused around how the NSO Group interfered with the service, used WhatsApp servers without authorization, and additionally broke the terms of service, the lawsuit has wider implications. A later section states the NSO Group used the spyware, “to target attorneys, journalists, human rights activists, political dissidents, diplomats, and other senior foreign government officials.”
The NSO Group has responded to the lawsuit with a statement that concentrates solely on this accusation, stating that it provides its technology to licensed government intelligence and law enforcement agencies, and that its software is expressly made to target terrorism and serious crime. “We consider any other use of our products than to prevent serious crime and terrorism a misuse, which is contractually prohibited,” the company said.
The software installed by the NSO Group, known as Pegasus, is “among some of the most sophisticated spyware available on the market,” according to Citizen Lab, a human rights research group that has investigated the attack. Once installed, it can steal critical data including passwords, contacts, calendars, messages, and even monitor live calls. The software can also use the microphone, GPS, and camera to further spy on the phone’s owner.
Prior to the WhatsApp hack, the NSO Group’s Pegasus software had also been linked to repeated surveillance attempts against a Moroccan investigative journalist and a human rights lawyer, Amnesty Tech uncovered in October. Amnesty International is also suing the NSO Group. Danna Ingleton, program director at Amnesty Tech, wrote at the time:
“NSO is not currently able to prevent governments from unlawfully using its surveillance technology as tools to abuse human rights. Instead of attempting to whitewash human rights violations associated with NSO products, the company must urgently put in place more effective due diligence processes to stop its spyware being abused.”
In a statement given to the Committee to Protect Journalists (CPJ) following Amnesty Tech’s report, an NSO Group spokesperson said its products are, “not tools to surveil dissidents or human rights activists. That’s why contracts with all of our customers enable the use of our products solely for the legitimate purposes of preventing and investigating crime and terrorism. If we ever discover that our products were misused in breach of such a contract, we will take appropriate action.”
Following the earlier exposure, the NSO Group introduced a new Human Rights Policy and added three high profile new advisers to its team. However, this new high profile lawsuit, brought about by one of the biggest and most known technology companies in the world, may prompt the NSO Group and other firms offering similar products, to take even further action to prevent misuse and increase accountability.
“This is the first time that an encrypted messaging provider is taking legal action against a private entity that has carried out this type of attack against its users,” WhatsApp wrote in a statement, emphasizing the significance of the lawsuit.