by

Lawsuit Asks to Restrict Sales of Israeli Spyware

Two lawsuits filed Thursday in Israel and Cyprus reveal details of the modus operandi of Israeli NSO Group

Lilach Baumer 16:4102.09.18

A lawsuit filed in Israeli district court on Thursday by five Mexican nationals calls into question previous statements made by Israeli spyware company NSO Group regarding its lack of involvement in governmental spying efforts worldwide. The five plaintiffs, all journalists and human rights activists, allege they were targeted by NSO’s spyware in 2014-2016, and ask the court to restrict NSO’s future sales of its spyware.

For daily updates, subscribe to our newsletter by clicking here.

The lawsuit and its content were first reported by the New York Times Friday. According to the Times, a second lawsuit has been filed in Cyprus, adding a Qatari citizen as a plaintiff in addition to the Mexican plaintiffs named in Israel.

NSO's offices in Israel. Photo: Orel Cohen

NSO, founded in 2010, develops and sells spyware tools for mobile phones and other devices, which can be used to collect data about user activities and remote control the handset's microphone, camera, and GPS.

The company states its technology is sold to government and law enforcement agencies and is intended to be used “exclusively” to combat crimes and terrorism, but NSO’s “Pegasus” spyware has been implicated several times in the past in cases where human rights activists and journalists were targeted, including in Mexico and the United Arab Emirates. More recently, the spyware was revealed to be allegedly used by Panama's ex-president Ricardo Martinelli to spy illegally on around 150 individuals between 2012 and 2014, and also to target a staff member of Amnesty International.

In a December interview, NSO co-founder Omri Lavie said that once a sale is made, NSO has no way to know what the purchasing party does with the system, and that the company does not "want to be an intelligence partner." The Hebrew-language interview was featured on a podcast published by a Microsoft startup accelerator operating in Israel called Microsoft Accelerator TLV.

Thursday’s suit, filed by Israeli lawyers Alaa Mahajna and Muhammad Dahleh, contests that statement. The filing gives an example of at least one case where the manager of an NSO affiliate called Circles Technologies, looking to sell the company’s spyware to high-ranking government members of the UAE, hacked four requested phones and sent the data to the client.

The lawsuit also gives several examples of the text messages used to bait the five plaintiffs into clicking the link and unknowingly downloading Pegasus.

In 2017, Toronto-based human rights research group The Citizen Lab named three Mexican politicians and fifteen Mexican citizens that were targeted with NSO’s spyware, among them journalists, lawyers, and activists in human rights and anti-corruption organizations.

The news led Mexico to launch an investigation into the accusations. According to the lawsuit, since October 2017 the Mexican authorities reached out to NSO for information several times but were rebuffed.

In its report, Citizen Lab stated that it has “no conclusive evidence attributing these messages to specific government agencies in Mexico. However, circumstantial evidence suggests that one or more of NSO’s government customers in Mexico are the likely operators.”

The lawsuit filed Thursday provides a copy—both in the original Spanish and a translated English version—of a 2014 contract between the office of the Mexican Attorney General and a newly-incorporated company named Grupo Tech Bull SA DE CV, for the acquisition of Pegasus at a sum of $32 million (including Value Added Tax). The lawsuit alleges that Grupo Tech Bull is a shell company, according to “common conception.” The lawsuit further states that in May, as part of the Mexican investigation, the Mexican Attorney General admitted to acquiring a Pegasus license.