US senator to investigate if foreign spyware used to target Americans
An influential US senator has told the Guardian he is examining the possible hacking of US citizens with technology sold by the NSO Group and other foreign surveillance companies, an issue he said raised “serious national security issues”.
Ron Wyden’s remarks come just weeks after a lawsuit was filed by WhatsApp against NSO, alleging that the Israeli company’s malware was used against 1,400 WhatsApp users in 20 countries over a 14-day period this year.
The lawsuit says thatmore than 100 human rights activists, journalists, lawyers and academics were among those targeted, and that at least one US phone number with a Washington DC area code was among those potentially compromised.
In a rare move for a major US company, WhatsApp has also twice referred its complaints about NSO to the US Department of Justice. The Facebookowned company alerted the DoJ in May, when it first became aware of the issue, and again in October.
WhatsApp said it believed NSO had violated criminal laws, including the Computer Fraud and Abuse Act, a federal law that is used to prosecute hackers.
The justice department declined to comment.
NSO has said it would defend itself against the lawsuit, insisting it sells its signature spyware, known as Pegasus, to foreign governments solely for the purpose of fighting crime and preventing terrorist attacks.
“We’re proud that our technology helps governments save lives and address the challenges posed by criminals and terrorists using encrypted messaging technology,” a spokesperson said.
“NSO software is specifically designed to not function on US phone numbers and cannot be used on phones with US area codes,” the spokesperson added.
The company has come under mounting scrutiny because of allegations that it has sold its product to authoritarian regimes, including Saudi Arabia, and other governments with poor human rights records, which, activists allege, have used it to target members of civil society.
Wyden, who is the highest-ranking Democrat on the Senate finance committee, declined to comment on the WhatsApp suit. He expressed concern about “mercenary contractors” and “foreign hackers” in the cyber surveillance industry who could be targeting Americans.
“Congress has a clear role in ensuring that Americans are not helping authoritarian governments to hack or engage in other similar conduct that raise human rights concerns,” the Oregon senator and privacy advocate said.
He also said he asked the US Commerce Department to provide his office with an update on the implementation of regulations that would prevent US nationals from providing services to “foreign military intelligence services” without first obtaining a US licence.
“If foreign surveillance companies like NSO are helping their foreign government customers hack or spy on Americans, particularly US government employees and contractors, that would raise serious national security issues,” Wyden said. “I am looking into this topic, and expect to have more to say in the coming weeks.”
His remarks come as David Kaye, the UN special rapporteur on freedom of opinion and expression, said governments needed to do a better job of controlling the export of spyware.
NSO was just one participant in a global industry that seemed to him to be “out of control, unaccountable and without constraint”, Kaye said. “The companies involved in such activity – and their defenders – will say this is a price to pay to confront terrorism.”
Neither companies, nor governments, were doing enough to try to tackle the issue, Kaye said. “In fact, governments have been happy to have these companies help them carry out this dirty work.
“This isn’t a question of governments using tools for lawful purposes and incidentally, or inadvertently, sweeping up some illegitimate targets: this is using spyware technology to target vulnerable yet vital people that healthy democracies need to protect.”
Kaye has called for an immediate moratorium on the transfer of spyware until viable international controls are placed on them.
NSO defended its record, saying: “NSO’s technology is only licensed after a thorough vetting process that goes well beyond the legal requirements that we follow. All potential customers must meet strict export authority regulations before any sale, in addition to NSO’s internal vetting process that includes a focus on human rights.”
The company introduced a new human rights policy this year which it said would help stem potential abuse. NSO said it would take all reasonable steps to prevent and mitigate the risk of misuse of its products and promised to pay “specific attention” to protect individuals or groups at elevated risk of “arbitrary digital surveillance and communication interception”.
But Kaye, and other human rights defenders, have questioned whether it goes far enough.
NSO is facing multiple lawsuits in different countries. The WhatsApp claim is the most recent and alleges the most widespread abuse.
In the weeks since the lawsuit was filed in a California court, more than a dozen alleged hacking victims, including activists and reporters from India, Rwanda, and Morocco, have come forward to allege that they received notice from WhatsApp that their accounts were breached.
They include Aboubakr Jamaï, a campaigner and former journalist who lives in France and won the prestigiousInternational Press Freedom award from the Committee to Protect Journalists in 2003.