Depositions: NSO Group, Not Government Clients, Operates NSO Spyware

Facts

• Sworn depositions from a lawsuit between Meta-owned WhatsApp and Israeli spyware firm NSO Group show that NSO is the one that "installs and extracts" people's mobile phone data, not its government clients.^[1]
• WhatsApp, which first sued NSO in 2019 over allegations that its Pegasus software hacked 1.4K users, said NSO admitted to "extracting and decompiling WhatsApp's code" and "reverse-engineering WhatsApp" to bypass security measures and insert "zero-click" spyware.^[2][3]
• WhatsApp claims that NSO's head of research and development "confirmed" that its "zero-click vector called 'Eden'" — which was part of a "family of WhatsApp-based vectors" called "Hummingbird" — was "responsible for the attacks described in the complaint."^[2][4]
• WhatsApp argued in its deposition that NSO customers "only needed to enter the target device’s number and 'press Install, and Pegasus will install the agent on the device remotely without any engagement,'" citing a former employee of U.S.-based NSO affiliate Westbridge.^[2][5]
• This follows a July report on leaked Israeli government documents, which found that NSO Group was worried about the lawsuit revealing its "US customers," including documents related to "the Jeff Bezos hack or Khashoggi killing."^[6][7]
• NSO software has been linked to hacks in Saudi Arabia, Dubai, India, Mexico, Morocco, Rwanda, and Hungary. While US Pres. Joe Biden blacklisted the company in 2021, NSO continues to lobby Congress to reverse the decision.^[1]

Sources: ^[1]The Guardian, ^[2]The Record, ^[3]Al Mayadeen, ^[4]Document Cloud, ^[5]WION, ^[6]Cyber Daily and ^[7]Forbidden Stories.

Narratives

• Narrative A, as provided by Wired. The US government has been on the right track over the last four years — from Pres. Biden's blacklisting of NSO Group to Congress requiring incident reporting regulations. However, the incoming Trump administration appears to be extremely friendly with Israel, which means these bans and regulations could go out the window come January. Protecting sovereign citizens from the prying eyes of intel agencies and private firms should be a bipartisan effort.
• Narrative B, as provided by Carnegie Endowment for International Peace. Spyware companies like NSO have led to justified public backlash, but that shouldn't result in an outright ban on these technologies. While Western governments are at the forefront of the fight to restrain malicious spyware schemes, they also need access to these tools to combat adversarial regimes and nonstate actors, especially terrorists. International treaties are already being built to ensure a happy medium, which is the path the world should stick to.