Israeli spyware firm threatens to ‘shut down’ abusers

February 09, 2020

For years, Israel has been a cybersecurity powerhouse, with established companies and start-ups offering state-of-the-art services ranging from offensive cyber capabilities to AI-enabled defense systems.

Part of the reason for the industry’s success is the active recruitment of military veterans and former agents of Israel’s intelligence services. One of the most controversial companies to fall into this category is NSO Group, whose executives are believed to have served in Israel’s elite signal intelligence-gathering Unit 8200.

Rights groups, press freedom advocates and even research hubs have accused the Herzliya-based company of turning a blind eye to the misuse of its security-oriented technology, including its contentious Pegasus spyware.

The most recent revelations have pointed to Saudi operators attempting to hack Amazon CEO Jeff Bezos’ phone, although NSO Group has noted that it “can say unequivocally that our technology was not used in this instance.”

Other instances have purportedly occurred, such as the targeting of activists from the Arab Gulf, North Africa and North America, including a close confidant of Saudi critic Jamal Khashoggi in the run-up to his assassination.

Read more: WhatsApp’s security breach: Made in Israel, implemented worldwide

NSO Group logo on the side of an office building in Israel

The Herzliya-based company is the target of several lawsuits

For security’s sake

NSO Group’s products are licensed for the sole purpose of fighting serious crime, combating terrorism and assisting in emergency search and rescue operations.

The company said that it had taken steps to prevent and discipline the misuse of its products, including putting in place a human rights policy and harmonizing its governance structure in line with the UN Guiding Principles on Business and Human Rights.

“Customers are contractually obligated to cooperate in any investigation demanded from NSO Group and if misuse is confirmed, NSO Group has the ability to shut down their system and we have taken that step in the past,” a company spokesperson told DW.

Under its human rights policy, NSO Group acknowledges that while it has mechanisms to prevent the misuse of its software, its clients “should bear ultimate responsibility for the remedy of any harm to human rights.”

“We are incredibly proud of our products’ record of helping intelligence and law enforcement prevent serious crimes and save lives, but also understand that misuse could represent human rights violations,” said NSO Group CEO and co-founder Shalev Hulio last year.

“This new policy publicly affirms our equivocal respect for human rights and our commitment to mitigate the risk of misuse.”

Read more: When smart devices pass secrets to the police

‘No evidence’ of change

But some believe that doesn’t go far enough.

For Danna Ingleton, deputy program director of Amnesty International’s technology division (Amnesty Tech), NSO Group needs to provide more details about how they have remedied the misuse of its technology.

“While, in theory, it is good that they have a human rights policy and are speaking about the importance of human rights, we need to see those words put to action,” Ingleton told DW.

“So far we have no evidence that this human rights policy has changed the behavior of the company, that it has resulted in them changing any of their due diligence practices or taking any of the complaints — legal or otherwise — about attacks or targeting of civil society seriously.”

Even in Israel, NSO Group is the target of legal action launched by 30 citizens, including members of the human rights community there. The case is aimed at revoking the company’s export license, which is granted by the Israeli Defense Ministry.

Ingleton, a trained lawyer, said the court case is one of the few ways to ensure NSO Group is held responsible.

“There was no avenue of redress when one of my Amnesty colleagues was targeted with NSO technologies and we hope this case will help remedy this situation,” Ingleton said.

Read more: In Germany, controversy still surrounds video surveillance

Vulnerabilities

The discovery of a gaping flaw in Facebook-owned messaging app WhatsApp last year highlighted the misuse of NSO Group’s products. The vulnerability allowed an attacker to install spyware onto a targeted phone via a missed call on WhatsApp.

Facebook filed a lawsuit against NSO Group in October, accusing the Israeli company of providing foreign governments with the means to hack into 1,400 mobile phones across 20 countries. The California-based company said about 100 people involved in civil society work had been targeted.

However, by notifying users whose smartphones were compromised, Facebook had tipped off a terror suspect, The Wall Street Journal reported last month, citing a European law enforcement official.

In many ways, that is a prominent feature of such dual-use technologies; they present new opportunities and risks for civilians, authorities and the companies that make them. The challenge is finding the right balance.

Read more: Preventing terrorism: What powers do German security forces have?

Every evening, DW’s editors send out a selection of the day’s hard news and quality feature journalism. Sign up to receive it directly here.

Fighting for the internet: Social media, governments and tech companies

Free speech or illegal content?

Whether hate speech, propaganda or activism, governments across the globe have upped efforts to curb content deemed illegal from circulating on social networks. From drawn-out court cases to blanket bans, DW examines how some countries try to stop the circulation of illicit content while others attempt to regulate social media.

Fighting for the internet: Social media, governments and tech companies

Social media law

After a public debate in Germany, a new law on social media came into effect in October. The legislation imposes heavy fines on social media companies, such as Facebook, for failing to take down posts containing hate speech. Facebook and other social media companies have complained about the law, saying that harsh rules might lead to unnecessary censorship.

Fighting for the internet: Social media, governments and tech companies

Right to be forgotten

In 2014, the European Court of Justice ruled that European citizens had the right to request search engines, such as Google and Bing, remove “inaccurate, inadequate, irrelevant or excessive” search results linked to their name. Although Google has complied with the ruling, it has done so reluctantly, warning that it could make the internet as “free as the world’s least free place.”

Fighting for the internet: Social media, governments and tech companies

Blanket ban

In May 2017, Ukraine imposed sanctions on Russian social media platforms and web services. The blanket ban affected millions of Ukrainian citizens, many of whom were anxious about their data. The move prompted young Ukrainians to protest on the streets, calling for the government to reinstate access to platforms that included VKontakte (VK), Russia’s largest social network.

Fighting for the internet: Social media, governments and tech companies

Safe Harbor

In 2015, the European Court of Justice ruled that Safe Harbor, a 15-year-old pact between the US and EU that allowed the transfer of personal data without prior approval, was effectively invalid. Austrian law student Max Schrems launched the legal proceedings against Facebook in response to revelations made by former US National Security Agency (NSA) contractor, Edward Snowden.

Fighting for the internet: Social media, governments and tech companies

Regulation

In China, the use of social media is highly regulated by the government. Beijing has effectively blocked access to thousands of websites and platforms, including Facebook, Twitter, Instagram and Pinterest. Instead, China offers its citizens access to local social media platforms, such as Weibo and WeChat, which boast hundreds of millions of monthly users.

Fighting for the internet: Social media, governments and tech companies

Twitter bans Russia-linked accounts

Many politicians and media outlets blame Russia’s influence for Donald Trump’s election victory in 2016. Moscow reportedly used Facebook, Twitter, Google, and Instagram to shape public opinion on key issues. In October 2017, Twitter suspended over 2,750 accounts due to alleged Russian propaganda. The platform also banned ads from RT (formerly Russia Today) and the Sputnik news agency.

Fighting for the internet: Social media, governments and tech companies

Facebook announces propaganda-linked tool

With social media under pressure for allowing alleged Russian meddling, Facebook announced a new project to combat such efforts in November 2017. The upcoming page will give users a chance to check if they “liked” or followed an alleged propaganda account on Facebook or Instagram. Meanwhile, Facebook has come under fire for not protecting user data in the wake of the Cambridge Analytica scandal.

Author: Lewis Sanders IV (dj)