The messaging service WhatsApp filed suit in federal court Tuesday against the Israeli surveillance company NSO, claiming it acted illegally in helping governments hack into the mobile devices of more than 100 people worldwide, including journalists, human rights workers and women who had been the subject of online attacks.
The suit amounted to a new legal front in attempts to curb the abuses of the burgeoning but almost entirely unregulated global surveillance industry. Victims of hacking previously have sued NSO in Israeli courts, but a technology company has not before pursued such legal action for using its services to help conduct spying operations on users.
WhatsApp alleged that NSO helped government agencies deliver malicious software through seemingly harmless WhatsApp video calls, even if the targets never answered their phones. The malware was capable of initiating a powerful form of spying that included the ability to intercept communications, steal photos and other forms of data, activate microphones and cameras, track the locations of targets and more, said people familiar with NSO technology.
Targets, which also included religious figures and lawyers, were identified in 20 countries, according to the WhatsApp lawsuit.
An NSO surveillance tool called Pegasus has been implicated in spying on Washington Post contributing writer Jamal Khashoggi before he was killed by people affiliated with Saudi Arabia’s security services last year. A friend of Khashoggi, Omar Abdulaziz, has alleged in a lawsuit that his phone was infected with Pegasus without his knowledge and that the malicious software helped the Saudis snoop on Khashoggi.
Khashoggi friend sues Israeli firm over hacking he says contributed to the journalist’s murder
Though human rights and privacy activists long have complained about the increasingly intrusive reach of such surveillance technologies, they have had little luck pursuing new laws or other remedies against makers of spying software as such tools have spread into many countries, with Israeli being a leader in the field. This has prompted government surveillance victims to seek remedies in the courts. This suit was filed in the United States District Court in the Northern District of California.
“This is unprecedented,” said John Scott-Railton, a senior research at Citizen Lab at the University of Toronto’s Munk School, who helped WhatsApp investigate the targeting of civil society groups and contacted some of the people affected. “It’s a huge milestone in digital rights and privacy.”
NSO rejected the allegations, saying its technology is used by governments and law enforcement to fight terrorism.
“In the strongest possible terms, we dispute today’s allegations and will vigorously fight them,” NSO said in a statement that was forwarded to The Washington Post by a Washington public relations agency.
The company said using its technology for any purposes other than preventing crime and terrorism is a misuse and contractually prohibited.
WhatsApp explains why it’s suing NSO
WhatsApp, which is owned by Facebook, said in a blog post that the company believes NSO and its parent company, Q Cyber Technologies, violated U.S. and California law, as well as the terms of service for WhatsApp.
“At WhatsApp, we believe people have a fundamental right to privacy and that no one else should have access to your private conversations, not even us,” said Will Cathcart, head of WhatsApp, in an op-ed that The Washington Post published online Tuesday. “Mobile phones provide us with great utility, but turned against us they can reveal our locations and our private messages, and record sensitive conversations we have with others.”
The suit should put governments that want to snoop on notice, said Eva Galperin, director of cybersecurity at the Electronic Frontier Foundation, a civil liberties group.
“If you are an authoritarian government who buys spyware from NSO, you now run the risk of being caught,” said Galperin, who believes other tech companies whose platforms have been allegedly targeted by NSO could also follow WhatsApp’s lead.