In an unprecedented move, WhatsApp, owned by Mark Zuckerberg's Facebook, has sued the NSO Group, an Israeli surveillance firm, for allegedly helping governments to hack into accounts of users in 20 countries, a report says. The case filed in a San Francisco court charges the NSO Group, which denies any wrongdoing, with hacking into about 1,400 users' phone using WhatsApp and stealing sensitive data.
The company that boasts of 1.5 billion monthly users says the hacking spree targeted phones of sensitive users including diplomats, political dissidents, journalists and senior government officials in the 20 countries of which it mentions Mexico, the United Arab Emirates (UAE) and Bahrain by name, the Reuters report says. The lawsuit accuses the NSO Group of facilitating government hacking.
Emphatic denial
WhatsApp said in a statement that 100 civil society members had been targeted, and called it an unmistakable pattern of abuse, according to the report.
The NSO, however, denied the charges and said: "In the strongest possible terms, we dispute today's allegations and will vigorously fight them." It said the "sole purpose of the NSO is to provide technology to licensed government intelligence and law enforcement agencies to help them fight terrorism and serious crime."
Lawyer Scott Watnik called WhatsApp's move "entirely unprecedented", explaining that major service providers tended to shy away from litigation."
WhatsApp said in the lawsuit the attack exploited its video calling system and sent malware to the mobile devices of a number of users, according to the report. The malware would allow NSO's clients — said to be governments and intelligence organisations — to secretly spy on the phone's owner, opening their digital lives up to official scrutiny.
WhatsApp's admission contradicts its own claim of a high level of security for the chat app including end-to-end encryption that cannot be deciphered by WhatsApp or other third parties. Citizen Lab, a cybersecurity research laboratory based in the University of Toronto that worked with WhatsApp to investigate the phone hacking, said the targets included well-known television personalities, prominent women who had been subjected to online hate campaigns and people who had faced assassination attempts and threats of violence, the report said.
Citizens' digital lives
Governments have increasingly turned to sophisticated hacking software as officials seek to push their surveillance power into the furthest corners of their citizens' digital lives, the report added. Companies like NSO say their technology enables officials to circumvent the encryption that increasingly protects the data held on phones and other devices. But governments only rarely talk about their capabilities publicly, meaning that the digital intrusions like the ones that affected WhatsApp typically happen in the shadows, the report said.
Lawyer Scott Watnik called WhatsApp's move "entirely unprecedented", explaining that major service providers tended to shy away from litigation for fear of "opening up the hood" and revealing too much about their digital security. He said other firms would be watching the progress of the suit with interest. "It could certainly set a precedent," said Watnik, who chairs the cybersecurity practice at the Wilk Auslander law firm in New York. The lawsuit seeks to have NSO barred from accessing or attempting to access WhatsApp and Facebook's services and seeks unspecified damages, according to the report.
NSO's phone hacking software has already been implicated in a series of human rights abuses across Latin America and the Middle East, including a sprawling espionage scandal in Panama and an attempt to spy on an employee of the London-based rights group Amnesty International. NSO came under particularly harsh scrutiny over the allegation that its spyware played a role in the death of Washington Post journalist Jamal Khashoggi, who was murdered at the Saudi Consulate in Istanbul a little over a year ago.
