U.S. Supreme Court clears way for lawsuit against NSO
On Monday, the U.S. Supreme Court rejected an appeal by spyware provider NSO Group. This means that the lawsuit filed by WhatsApp and its parent company Meta against the Israeli firm can now go to trial.
NSO had tried to avert the proceedings, arguing that it sells law enforcement technologies to government agencies. The company was therefore an agent of foreign governments and should be entitled to immunity under U.S. law. After two lower courts had already denied NSO immunity, the company had filed an appeal to the U.S. Supreme Court in April 2022.
Meta welcomed the Supreme Court’s decision, stating, “NSO’s spyware has enabled attacks on human rights activists, journalists, and government officials. We strongly believe that their operations violate U.S. law, and they must be held accountable.”
Lawsuit filed in 2019
In the lawsuit filed in 2019, WhatsApp and Meta accuse the Israeli company of being involved in attacks on 1400 WhatsApp users. Among those targeted, they say, were journalists, lawyers, dissidents, human rights activists, diplomats, and government officials.
According to the report, NSO had exploited a security vulnerability in WhatsApp’s call feature at the time to plant its controversial Pegasus spyware in smartphones. The called device was infiltrated even if the call was not accepted. Servers associated with NSO had been used for these attacks. WhatsApp was also able to attribute several user accounts used for the attacks to the Israeli company.
Meta argues that NSO violated US laws as well as WhatsApp’s terms of use. The group is therefore claiming damages and would like NSO to be prohibited from creating accounts on WhatsApp or Facebook, among other things.
U.S. Department of Justice had opposed immunity
In NSO’s appeal to the Supreme Court, the company had also suggested seeking an assessment from the U.S. Department of Justice regarding the case. The Supreme Court had then asked the Department for an opinion, which was issued in November 2022.
In it, the U.S. Department of Justice had stated that the company’s appeal should be rejected. This was now upheld by the Supreme Court.
What is Pegasus?
Pegasus is a spyware from the Israeli company NSO Group. The spyware can completely take over an infiltrated device and, for example, switch on the camera and microphone unnoticed as well as copy all data. Location data can also be accessed and passwords retrieved. The surveillance programme has been criticized for years in connection with human rights violations.
The U.S. Department of Justice had ruled that the lower courts’ decisions were correct – and found that NSO was “clearly not entitled to immunity” in the present case. Nor had either the U.S. State Department or any other state supported NSO’s claim of immunity.
The department had also pointed out that the U.S. government had already imposed sanctions on NSO in November 2021: At the time, the U.S. Department of Commerce had placed the Israeli firm on the so-called Entity List because its activities are “contrary to the national security or foreign policy interests of the United States.” Without a special permit, U.S. companies are prohibited from selling certain technologies to firms on that list.
According to the Commerce Department, there is evidence that NSO has developed and supplied spyware to foreign governments. These programs have been used for malicious surveillance of government officials, journalists, business people, activists, scientists, and embassy staff, it said. Authoritarian governments have also used the software to target dissidents outside their territories to suppress dissent, he said.
Members of the media and Apple also suing
The civil rights organization Access Now welcomed the Supreme Court’s decision. It appealed to the now responsible court in California to continue the proceedings without delay.
Security researcher John Scott-Railton of the Citizen Lab at the University of Toronto, which has repeatedly exposed the use of Pegasus, said NSO now faces a number of high-profile lawsuits.
This is because in the U.S., media professionals from El Faro, a news site based in El Salvador, are also suing NSO. Citizen Lab had proven in January 2022 that they were monitored with Pegasus. Among other things, the plaintiffs want NSO to disclose which government customer was responsible for the spying operation.
The lawsuit was filed in November 2022 by the Knight First Amendment Institute at Columbia University on behalf of the affected media professionals. Carrie DeCell, an attorney employed by the institute, explained the implications of the decision now handed down: “Today’s decision clears the path for lawsuits brought by the tech companies, as well as for suits brought by journalists and human rights advocates who have been victims of spyware attacks.” It also criticized the use of spyware against media professionals as “one of the greatest threats to press freedom and democracy.”
Apple is also suing the Israeli company in the United States. The aim of this lawsuit is to hold NSO responsible for the surveillance and targeted attacks on Apple users.
Demand for moratorium
NSO and the Pegasus spyware have long been linked to human rights violations. The spyware is also said to have played a role in the case of the murdered Saudi dissident Jamal Kashoggi. In the summer of 2021, an international research consortium also uncovered how Pegasus was used to monitor media workers, human rights activists and opposition figures around the world.
Since then, dozens of other cases have surfaced: Activists in Jordan and Bahrain, opposition figures in Poland, and U.S. State Department employees in Uganda (in German), among others, were spied on.
Organizations such as Amnesty International and Reporters Without Borders, as well as UN human rights experts, have long called for a global moratorium (in German) on the sale and transfer of surveillance technologies. (js)