US federal court rules lawsuit against Israeli NSO can continue

A US federal court in California denied a request on Thursday by the Israeli surveillance software company NSO Group to dismiss a lawsuit filed by WhatsApp and parent company Facebook.

Phyllis Hamilton, chief judge of the United States District Court of the Northern District of California, denied most of the arguments NSo Group made in its request in April, according to TechCrunch.

In October, Facebook and WhatsApp filed a complaint in a US federal court against NSO Group following several months of internal investigation after the detection of “a new kind of cyberattack involving a vulnerability in [WhatsApp’s] video-calling feature,” Will Cathcart, head of WhatsApp, wrote in The Washington Post.

In the attack that took place between April and May 2019, NSO allegedly “used WhatsApp servers, located in the United States and elsewhere, to send malware to approximately 1,400 mobile phones and devices,” WhatsApp and Facebook said in their complaint.

According to Cathcart, the attack “targeted at least 100 human-rights defenders, journalists and other members of civil society across the world.”

Facebook and WhatsApp claim that NSO Group created a data program called Pegasus that could "remotely and covertly extract valuable intelligence from virtually any mobile device," according to the court order issued on Thursday. Pegasus was licensed and support services were sold to customers including Bahrain, the UAE and Mexico.

Pegasus could be customized to "intercept communications, capture screenshots, or exfiltrate browser history and contacts" from a user’s device.

NSO Group allegedly created WhatsApp accounts to send malicious code to personal devices in April and May 2019 and leased servers and internet hosting services from third parties to distribute malware and relay commands to devices. NSO allegedly reverse engineered WhatsApp and developed Pegasus to emulate legitimate traffic.

As part of its request to dismiss the suit, the NSO Group argued that its business dealings with foreign governments granted it immunity from lawsuits filed in US courts under the Foreign Sovereign Immunity Act. Hamilton responded to the argument, saying that the NSO Group failed to qualify for immunity because it was not incorporated or formed in the US.

"We are pleased with the Court's decision permitting us to move ahead with our claims that NSO engaged in unlawful conduct. The decision also confirms that WhatsApp will be able to obtain relevant documents and other information about NSO's practices," said WhatsApp to TechCrunch after the decision on Thursday.

Last week, the Tel Aviv District Court ruled in favor of the Defense Ministry and NSO Group and against Amnesty International’s lawsuit to cancel the cyber powerhouse’s export license.

Amnesty petitioned the court to cancel the export license, claiming that NSO violates human rights, including that its technology was used by its clients to hack some Amnesty employees’ cellphones.