WhatsApp sues Israeli spyware firm it says helped governments hack phones

WhatsApp has filed a lawsuit against Israeli spyware firm NSO Group, accusing it of unlawfully seeking to surveil journalists, human rights activists and others.

The lawsuit, filed on Tuesday in a US federal court in California, accuses NSO Group of seeking to infect approximately 1,400 "target devices" with malicious spyware that could be used to steal WhatsApp users' information, the AFP news agency reported.

The spyware in question, known as Pegasus, has been widely condemned after human rights groups and cyber-security monitors reported that NSO Group had sold it to repressive governments.

Citizen Lab, a research centre at the University of Toronto that worked with WhatsApp to investigate the hacking, told Reuters that the targets included well-known television personalities, prominent women who had been subjected to online hate campaigns and people who had faced "assassination attempts and threats of violence".

None of the targets were identified by name.

WhatsApp chief Will Cathcart tweeted on Tuesday that the Facebook-owned app was "taking a stand against the dangerous use of spyware".

"NSO Group claims they responsibly serve governments, but we found more than 100 human rights defenders and journalists targeted in an attack last May. This abuse must be stopped," Cathcart said.

The lawsuit alleges that NSO Group facilitated government hacking in 20 countries, the Reuters news agency said.

Mexico, the United Arab Emirates (UAE) and Bahrain were the only countries identified, however.

WhatsApp said the attack exploited its video calling system in order to send malware to the mobile devices of a number of users.

The Israeli company rejected the allegations on Tuesday.

"In the strongest possible terms, we dispute today's allegations and will vigorously fight them," NSO Group said in a statement.

"The sole purpose of NSO is to provide technology to licensed government intelligence and law enforcement agencies to help them fight terrorism and serious crime."

'No cooperation is required'

Documents submitted in the case against NSO have revealed some of WhatsApp complaints as well as the details of how the Pegasus software operated. 

A manual submitted in the documents explains how it works without needing the "target" to install any kind of software and delivering "information about your target's relationships, location, phone calls, plans and activities – whenever and wherever they are".

The document describes how a software is installed remotely on the targeted individual's device and begins collecting data which is then transmitted when they have a reliable internet connection - all without their knowledge. 

"During the entire installation process no cooperation or engagement of the target is required (e.g., clicking a link, opening a message) and no indication appears on the device," it says, listing how the software automatically tracks a person's movement, messages and e-mails, contacts, call history and internet usage but can also be used to actively tap into calls and hijack a device's microphone to listen in on its surroundings. 

Targeted phone numbers from Bahrain and the United Arab Emirates were among the countries named in WhatsApp's complaint. 

Dissidents targeted

Human rights groups have criticised the Israeli firm for selling its software to repressive regimes around the world.

Earlier this year, Amnesty International said it planned to file a legal petition in Israel to push the country's defence ministry to withdraw an export licence for NSO Group in relation to its sales of the software.

Danna Ingleton, deputy director of Amnesty Tech, said in an affidavit at the time that NSO Group has not done its job to protect human rights defenders from being targeted.

'In the strongest possible terms, we dispute today's allegations and will vigorously fight them'

- NSO Group, responding to the WhatsApp lawsuit

Last year, a report by CitizenLab also showed that human rights defenders in Saudi Arabia, the UAE and Bahrain were targeted with the software.

"Our findings paint a bleak picture of the human rights risks of NSO's global proliferation,"  the report stated.

"At least six countries with significant Pegasus operations have previously been linked to abusive use of spyware to target civil society."

Those targeted include Saudi dissident Omar Abdulaziz, who lives in Canada, and Ghanem Almasarir, a Saudi satirist who lives in London and regularly criticises the Gulf kingdom.

"The use of spyware to target Omar Abdulaziz was one component of a broader campaign of repressive, punitive activities undertaken by a government in an effort to silence critics," CitizenLab said about the attempted hacking of  Abdulaziz's mobile phone.

The lawsuit filed on Tuesday seeks to have NSO barred from accessing, or attempting to access, WhatsApp and Facebook's services and seeks unspecified damages, Reuters said.