NSO Group spyware ‘dangerous’, say tech firms in legal filing

Washington, December 22: Spyware made by NSO Group is “powerful and dangerous” and the Israeli company should be held liable to US anti-hacking laws, Google, Microsoft, Cisco and other leading technology companies have said in a rare joint legal filing, the Guardian has reported.

An amicus brief filed by the companies in support of WhatsApp, which has sued NSO Group in the US, appears to mark a major turning point in the popular messaging app’s legal fight against the Israeli spyware firm, and has sent a strong signal that the world’s biggest technology companies are rallying against the proliferation of hacking tools made by private companies.

At the heart of the case lies WhatsApp’s claim that 1,400 of its users, including diplomats, journalists, politicians and human rights advocates, were targeted by NSO Group’s spyware over a two-week period in 2019. The company, which is owned by Facebook, sued NSO Group after the alleged targeting came to light, blaming NSO Group for the attempted intrusions.

NSO Group has denied any responsibility for the alleged targeting, and has said its government clients control how its software is used.

After losing an important ruling in a lower court about the merits of its arguments in its defence in the case earlier this year, NSO Group appealed against the judge’s decision at a higher US court. The move has temporarily delayed the main case from moving forward, until the higher court resolves the questions around the merits of the company’s defence.

NSO Group is now arguing before a US appeal court that it ought to have complete immunity from US anti-hacking laws because it works on behalf of unnamed sovereign government clients.

In their rare joint amicus brief filed to an appeal court on Monday night, Google, Microsoft, and others argued against NSO’s appeal, and claimed that offering such legal immunity to the spyware company – or any similar company – posed grave risks to global cybersecurity.

The companies said that the consequences of an “immunised and expanded” spyware industry would mean that more foreign governments would have access to “powerful and dangerous” cybersurveillance tools.

NSO Group has been approached for comment.

For years, campaigners such as Amnesty International have argued that the use of spyware poses a fundamental risk to human rights. In their legal filing, the technology companies agreed, saying that foreign governments “may use the technology in problematic ways”. While NSO Group has said that its products are meant to be used to track terrorists and criminals, Google and the other technology companies claimed in their legal brief that there were “substantial reasons to doubt” NSO Group’s attempts to “characterise its customers’ intended uses as appropriate”.

But the companies also put forward a new argument against the proliferation of spyware.

“Widespread creation and deployment of these tools by private companies acting for profit dramatically increases the risk that these vulnerabilities will be obtained and exploited by malicious actors other than the initial customer to cripple infrastructure, commit large-scale financial crime, or cause other catastrophic damage,” the companies said.

They added that it was now up to the court to decide whether to “radically expand the risks these powerful tools pose”.

The companies also pointed to the tens of billions of dollars they and others have spent to develop secure products, services, and systems, to protect the people who use their products from intrusion.

The companies said they had an interest in “ensuring that entities who access their products, services, and systems in violation of US law are held accountable in US courts”.

The decision by the companies to join the fray comes more than a year after WhatsApp launched its lawsuit against NSO Group. At the time, in October 2019, the WhatsApp chief, Will Cathcart, said in an op-ed in the Washington Post that the targeting of WhatsApp users ought to serve as a wake-up call to technology companies about the dangers of spyware.

John Scott-Railton, a senior researcher at Citizen Lab at the University of Toronto, which has uncovered alleged targeting of reporters and others using NSO Group technology, praised the move.

“It’s a remarkable show of solidarity, and a clear signal to the spyware industry that the big platforms have just begun to lean into the fight,” he said. “NSO’s filings had been trying to portray this case as about a trade-off between public safety and privacy. The brief just flipped the script and said: no, exempting companies like NSO from liability is itself a threat to public safety.”

There were two notable absences in the amicus brief filed so far: Apple, whose products’ own alleged vulnerabilities to NSO Group spyware were revealed in a recent report about the alleged hacking of dozens of Al Jazeera journalists, and Amazon, whose founder, Jeff Bezos’s own phone was allegedly hacked by Saudi Arabia in 2019.

Saudi Arabia is a known user of spyware and is believed to have targeted Bezos in his role as publisher of the Washington Post. Saudi Arabia denied it hacked Bezos’s phone.

Neither Apple nor Amazon responded immediately to a request for comment.

https://www.theguardian.com/us-news/2020/dec/22/nso-group-spyware-dangerous-say-tech-firms-in-legal-filing