WhatsApp 'hack' is serious rights violation, say alleged victims
More than a dozen pro-democracy activists, journalists and academics have spoken out after WhatsApp privately warned them they had allegedly been the victims of cyber-attacks designed to secretly infiltrate their mobile phones.
The individuals received alerts saying they were among more than 100 human rights campaigners whose phones were believed to have been hacked using malware sold by NSO Group, an Israeli cyberweapons company.
WhatsApp launched an unprecedented lawsuit against the surveillance company earlier this week, claiming it had discovered more than 1,400 of its users were targeted by NSO technology in a two-week period in May.
Filed in a Californian court, the lawsuit described the alleged attacks as an “unmistakeable pattern of abuse” that violated US law.
Two pro-democracy campaigners from Morocco who received the WhatsApp warnings said any use of the sophisticated malware, known as Pegasus, against them would be a serious violation of their rights.
“I am a big proponent of democratisation in the Middle East in general and in Morocco in particular,” said Aboubakr Jamaï, a campaigner and former journalist who lives in France. “The Moroccan regime is certainly less nefarious than, say, the Syrian regime, but it’s nonetheless an authoritarian regime who can use some despicable means against its opponents, as it did.”
Jamaï, who has gained international recognition for his groundbreaking work as a publisher who faced jail for his journalism, said he was contemplating his own separate legal action against NSO, and would consider a possible class-action suit with other alleged victims.
Abdellatif El Hamamouchi, a 22year-old human rights activist in Rabat who has been campaigning for justice for the jailed newspaper editor Taoufik Bouachrine, also received the alert.
Hamamouchi said: “I already strongly believed that I was under surveillance from the Moroccan authorities, but it surprised me that these attacks were coming from abroad, and they involved an Israeli company. The action taken by WhatsApp against NSO is a positive thing.
“I have not heard from NSO since I was informed about this, but I would regard any explanation they could give as worthless.”
At least six Rwandan dissidents have also come forward with claims they were targeted by Pegasus, according to interviews with the Financial Times.
Among them was Faustin Rukundo, a British citizen who is a member of a Rwandan opposition group and lives in exile and in fear of Rwanda’s security services.
In India, 17 people, including human rights activists, scholars and journalists, are said to have confirmed to Scroll.in that they were targeted by spyware on WhatsApp.
NSO has said it will contest “in the strongest possible terms” the WhatsApp lawsuit, but declined to comment further. It has insisted it cannot comment on its customers, or the people who have received alerts from WhatsApp.
The company said it investigated all serious allegations against it and had recently adopted a new human rights policy.
“The sole purpose of NSO is to provide technology to licensed government intelligence and law enforcement agencies to help them fight terrorism and serious crime. Our technology is not designed or licensed for use against human rights activists and journalists. It has helped to save thousands of lives over recent years,” the company said.
“We consider any other use of our products than to prevent serious crime and terrorism a misuse, which is contractually prohibited. We take action if we detect any misuse.”
However, NSO has faced a chorus of criticism because of the alleged abuse of its technology. It is widely reported to have sold its spyware to authoritarian regimes including Bahrain, Saudi Arabia and the United Arab Emirates.
The WhatsApp lawsuit also claims human rights activists and lawyers were not the only intended victims of the cyber-attacks, with unnamed diplomats and senior government officials also targeted.
Although WhatsApp declined to
provide more details about the claims, Reuters reported on Thursday that the targeted officials were from “multiple” US-allied countries.
Pressure on NSO grew on Friday when the Israeli security cabinet minister, Ze’ev Elkin, insisted the government had nothing to do with the company.
In an interview on Tel Aviv radio, he described NSO “as a private player” and said if anyone had done anything wrong, “then the justice system here and in other countries will throw the book at them”.
The Indian government has called on WhatsApp to submit a detailed report by next week on claims that many Indians were targeted.
Some NSO employees complained on social media after Facebook – which owns WhatsApp – appeared to have shut down accounts of employees at the cyberweapons company. One referred to Facebook as “the world’s greatest privacy violator”.
“Facebook, you never cease to amaze me,” wrote one executive in a publicly available post on LinkedIn, which was liked by several other NSO employees.
“Yesterday, both of my personal Facebook and Instagram profiles were intentionally disabled by the world’s greatest privacy violator in the history of mankind, aka Facebook.”
NSO declined to comment on the remarks.
Facebook also declined to comment, but pointed to the WhatsApp lawsuit, which urged the court to order “a permanent injunction enjoining and restraining (NSO) and their agents, servants, employees from accessing or attempting to access WhatsApp’s and Facebook’s service, platform and computer systems.”