WhatsApp hack led to targeting of 100 journalists and dissidents
Six-month investigation by messaging app shows wide misuse of Israeli company’s spyware
At least 100 journalists, human rights activists and political dissidents had their smartphones attacked by spyware that exploited a vulnerability in WhatsApp, according to the Facebook-owned messaging service.
The victims of the attack, which was first revealed by the Financial Times in May, were contacted by WhatsApp on Tuesday.
Their phones were targeted through WhatsApp’s call function by customers of the Israel-based NSO Group, which makes Pegasus, a spyware program. Once installed, Pegasus is designed to take over all of a phone’s functions.
WhatsApp told the FT it is filing a lawsuit in a US court that attributes the hack of its service to NSO. “This is the first time that an encrypted messaging provider is taking legal action against a private entity that has carried out this type of attack,” WhatsApp said.
The targets of attacks by NSO’s customers included politicians, prominent religious figures, lawyers and officials at humanitarian organisations fighting corruption and rights abuses, as well as people who have faced assassination attempts and violent threats.
WhatsApp said it spent six months investigating the breach, discovering that attackers had used its service to target about 1,400 phones over a two-week period this spring. In May it asked its 1.5bn users to update their apps in order to close the loophole.
NSO claims that Pegasus is sold only to law enforcement and intelligence agencies to prevent crime and terrorism. But WhatsApp, which worked with the University of Toronto’s Citizen Lab to identify victims, said a sizeable proportion of the targets were members of civil society, saying there had been an “unmistakable pattern of abuse” of the spyware.
“There is an unaccountable wild west of this kind of spyware and intrusion technology,” said John Scott-Railton, a senior researcher at Citizen Lab, which tracks digital surveillance. “If you equip repressive governments with the power to snoop like this it is almost a foregone conclusion that they will abuse this technology.”
WhatsApp worked with Citizen Lab to contact some of the targeted human rights activists and journalists to tell them that their phones may have been compromised by one of the entities using NSO’s spyware.
The spyware was transmitted even if a user did not answer the WhatsApp call. Missed calls were often wiped from call logs, leaving users unaware that their phone had been attacked.
Customers using Pegasus can read all the messages and emails stored on an infected phone, listen to incoming or outgoing calls, and turn on its camera and microphone to record conversations.
The WhatsApp investigation is the first large-scale glimpse into how NSO’s clients are able to use and misuse its spyware.
The company told potential investors earlier this year that it had sold Pegasus to at least 20 EU countries and that half of its 2018 revenues of $251m came from Middle East clients.
WhatsApp called for “strong legal oversight of cyber weapons used in this attack to ensure they are not used to violate the rights and freedoms people deserve wherever they are in the world”.
NSO has said it respects human rights unequivocally, and it conducts a thorough evaluation of the potential for misuse of its products by clients. This includes a review of a country’s past human rights record and governance standards.
It believes allegations of misuse of its products are based on “erroneous information”.
The NSO Group said in a statement: “In the strongest possible terms, we dispute today’s allegations and will vigorously fight them. Our technology is not designed or licensed for use against human rights activists and journalists.”
Since a leveraged buyout in February backed by London-based Novalpina Capital that valued NSO at $1bn, the company has rejected criticism that its clients abuse its software. NSO said in May it would introduce further reforms to prevent abuse.
David Kaye, the UN rapporteur on freedom of expression, wrote to Shalev Hulio, NSO’s chief executive, this month, saying its new policies were inadequate, especially regarding the investigation of rights abuses raised by whistleblowers.
“The record of NSO Group is troubling,” Mr Kaye told the FT. “Making matters worse, it’s activities are opaque, and subject to minimal, if any, government constraints. My hope is that allegations like these encourage governments to take strong regulatory action.”