WhatsApp spyware attack was attempt to hack human rights data, says lawyer
The UK lawyer whose phone was targeted by spyware that exploits a WhatsApp vulnerability said it appeared to be a desperate attempt by someone to covertly find out the details of his human rights work.
The lawyer, who asked not to be named, is involved in a civil case brought against the Israeli surveillance company NSO Group whose sophisticated Pegasus malware has reportedly been used against Mexican journalists, and a prominent Saudi dissident living in Canada.
It has been claimed the would-be hacker had also repeatedly attempted to install Pegasus on the lawyer’s phone in recent weeks.
The lawyer, speaking to the Guardian, said he did not know who was behind the attempt to spy on him.
He said: “It is upsetting but it is not surprising. Someone has to be quite desperate to target a lawyer, and to use the technology that is the very subject of the lawsuit.”
NSO Group said: “NSO’s technology is licensed to authorised government agencies for the sole purpose of fighting crime and terror. The company does not operate the system, and after a rigorous licensing and vetting process, intelligence and law enforcement determine how to use the technology to support their public safety missions.
“We investigate any credible allegations of misuse and if necessary, we take action, including shutting down the system. Under no circumstances would NSO be involved in the operating or identifying of targets of its technology, which is solely operated by intelligence and law enforcement agencies.
“NSO would not or could not use its technology in its own right to target any person or organisation, including this individual.”
It was the lawyer’s suspicions that he might be being targeted that led him to raise his concerns with the Citizen Lab, the cyber specialists based at the University of Toronto. “A couple of months ago, I started to get WhatsApp video calls early in the morning at weird hours. I was suspicious of them and contacted Citizen Lab,” the lawyer said.
“They started their own investigation and they were also talking to WhatsApp, who had also noticed irregular activity on other phones.”
He added: “Over the weekend Citizen Lab was able to establish that there has been an attempt to target my phone using Pegasus. Citizen Lab told me on Sunday night that this was an attempt to target me.
“There are governments that have used this technology, like Saudi Arabia, Mexico and the United Arab Emirates. But I don’t think this was an attempt by a government.”
Facebook-owned WhatsApp has encouraged its 1.5 billion users to update to the latest version of the app after discovering the vulnerability, which allows spyware to be injected into a user’s phone through the app’s phone call function.
WhatsApp said the vulnerability was discovered this month, and that the company quickly addressed the problem within its own infrastructure. An update to the app was published on Monday, and the company was encouraging users to upgrade out of an abundance of caution.
It has also alerted US law enforcement to the exploit, and published a “CVE notice”, an advisory to other cybersecurity experts alerting them to “common vulnerabilities and exposures”.
WhatsApp said in a statement: “We have briefed a number of human rights organisations to share the information we can and to work with them to notify civil society.”
NSO Group is at the centre of a growing number of legal actions worldwide brought by civil rights groups and NGOs who say that the company’s spyware technologies have been used to target journalists and campaigners. Earlier this week, Amnesty International and 50 other organisations supported a legal action filed in Tel Aviv calling for the company’s export licences to be revoked.
Amnesty Tech’s deputy director, Danna Ingleton, said at the time: “The Israeli MoD has ignored mounting evidence linking NSO Group to attacks on human rights defenders, which is why we are supporting this case.” NSO Group, however, said it only supplies intelligence and law enforcement agencies to fight terrorism and organised crime.
In December, Omar Abdulaziz, a Saudi dissident based in Montreal, filed a lawsuit in Israel claiming that NSO software was used to target his phone earlier in the year – at a time when he was in regular contact with the journalist Jamal Khashoggi. In October, Khashoggi is believed to have been killed and dismembered at the Saudi consulate in Istanbul.
Saudi Arabia is understood to have licensed NSO technology in 2017, paying $55m for the technology. Its effectiveness is such that it has been characterised as a weapon by Israel’s defence ministry, according to local news reports.
Last August, Amnesty International said it believed it had been targeted. It said a staff member “received a malicious WhatsApp message with Saudi Arabia-related bait content and carrying links Amnesty International believes are used to distribute and deploy sophisticated mobile spyware.” It carried “a malicious link which Amnesty International believes belongs to infrastructure connected with NSO Group”.
A few months later, NSO Group said in response to Amnesty it would investigate. The company said: “If an allegation arises concerning a violation of our contract or inappropriate use of our technology, as Amnesty has offered, we investigate the issue and take appropriate action based on those findings. We welcome any specific information that can assist us in further investigating of the matter.”
NSO Group limits sales of its Pegasus spyware to state intelligence agencies. Once installed on a phone, the software can extract all of the data that is already on the device, such as text messages, contacts, GPS location, email and browser history. It can additionally create new data by using the phone’s microphone and camera to record the user’s surroundings and ambient sounds, according to a 2016 report by the New York Times.
In February, the Associated Press reported how lawyers and researchers involved in different lawsuits being brought against the NSO Group were approached by “mysterious operatives” who had invited them to meetings at luxury hotels.
AP reported the meetings appeared to be an attempt to goad them into making racist and anti-Israel remarks or revealing sensitive information about their work in connection with the lawsuits.
NSO Group has said it has nothing to do with the undercover efforts “either directly or indirectly.”