Israel tried to frustrate US lawsuit over Pegasus spyware, leak suggests

Jul 25, 2024

he Israeli government took extraordinary measures to frustrate a high-stakes US lawsuit that threatened to reveal closely guarded secrets about one of the world’s most notorious hacking tools, leaked files suggest.

Israeli officials seized documents about Pegasus spyware from its manufacturer, NSO Group, in an effort to prevent the company from being able to comply with demands made by WhatsApp in a US court to hand over information about the invasive technology.

Documents suggest the seizures were part of an unusual legal manoeuvre created by Israel to block the disclosure of information about Pegasus, which the government believed would cause “serious diplomatic and security damage” to the country.

Pegasus allows NSO clients to infect smartphones with hidden software that can extract messages and photos, record calls and secretly activate microphones. NSO’s clients have included both authoritarian regimes and democratic countries and the technology has been linked to human rights abuses around the world.

ince late 2019, NSO has been battling a lawsuit in the US brought by WhatsApp, which has alleged the Israeli company used a vulnerability in the messaging service to target more than 1,400 of its users in 20 countries over a two-week period. NSO has denied the allegations.

The removal of files and computers from NSO’s offices in July 2020 – until now hidden from the public by a strict gag order issued by an Israeli court – casts new light on the close ties between Israel and NSO and the overlapping interests of the privately owned surveillance company and the country’s security establishment.

The July 2020 seizures were made after Israeli officials and the company appear to have discussed how to respond to WhatsApp’s requests for NSO to disclose internal files about its spyware, raising questions about whether they coordinated to conceal certain information from US legal proceedings.

At one stage, one of NSO’s lawyers, Rod Rosenstein, a former US deputy attorney general in the Trump administration, appears to have asked one of Israel’s US lawyers whether the Israeli government would “come to the rescue” in the legal battle with WhatsApp.

Israel’s hidden intervention in the case can be revealed after a consortium of media organisations led by the Paris-based non-profit Forbidden Stories, and including the Guardian and Israeli media partners, obtained a copy of a secret court order relating to the 2020 seizure of NSO’s internal files.

Details of the seizures and Israel’s contacts with NSO regarding the WhatsApp case are laid bare in a separate cache of emails and documents reviewed by the Guardian. They originate from a hack of data from Israel’s ministry of justice obtained by the transparency group Distributed Denial of Secrets and shared with Forbidden Stories.

Combining US court records, information from sources and a forensic analysis by Amnesty International’s security lab of some of the files, the consortium has been able to confirm key details revealed in the hacked files.

According to Amnesty’s researchers, the files “are consistent with a hack-and-leak of a series of email accounts” but it is “not possible to cryptographically verify the authenticity of the emails as critical email metadata was removed by the hackers”.

In April this year, Israeli authorities obtained another sweeping gag order to prevent the country’s media from publishing information from the hack. The large cache of emails and documents was posted online by a self-described “hacktivist collective”, Anonymous for Justice. The identity of those behind the group is unclear.