The Israeli government took extraordinary measures to frustrate a high-stakes US lawsuit that threatened to reveal closely guarded secrets about one of the world’s most notorious hacking tools, the Guardian reported late Thursday.
Leaked documents suggest the seizures were part of an unusual legal maneuver created by Israel to block the disclosure of information about Pegasus, which the government believed would cause "serious diplomatic and security damage" to the country.
Pegasus allows NSO clients to infect smartphones with hidden software that can extract messages and photos, record calls and secretly activate microphones. NSO’s clients have included both authoritarian regimes and democratic countries and the technology has been linked to human rights abuses around the world.
Since late 2019, NSO has been battling a lawsuit in the US brought by WhatsApp, which has alleged the Israeli company used a vulnerability in the messaging service to target more than 1,400 of its users in 20 countries over a two-week period. NSO has denied the allegations.
The removal of files and computers from NSO’s offices in July 2020 – until now hidden from the public by a strict gag order issued by an Israeli court – casts new light on the close ties between Israel and NSO and the overlapping interests of the privately owned surveillance company and the country’s security establishment.
The July 2020 seizures were made after Israeli officials and the company appeared to have discussed how to respond to WhatsApp’s requests for NSO to disclose internal files about its spyware, raising questions about whether they coordinated to conceal certain information from US legal proceedings. The Guardian claims that "Israel’s hidden intervention in the case can be revealed after a consortium of media organizations led by the Paris-based non-profit Forbidden Stories, and including the Guardian and Israeli media partners, obtained a copy of a secret court order relating to the 2020 seizure of NSO’s internal files."
According to Amnesty’s researchers, the files "are consistent with a hack-and-leak of a series of email accounts” but it is “not possible to cryptographically verify the authenticity of the emails as critical email metadata was removed by the hackers".
In April this year, Israeli authorities obtained another sweeping gag order to prevent the country’s media from publishing information from the hack. The large cache of emails and documents was posted online by a self-described "hacktivist collective," Anonymous for Justice. The identity of those behind the group is unclear.
In July, WhatsApp accused NSO of resisting its obligations to share internal files as part of a legal process, known as discovery, which would allow WhatsApp to gather information to help build its case on how Pegasus has been used by NSO’s government clients. However, the Israeli government’s hidden intervention has hindered WhatsApp’s ability to compel NSO to hand over crucial information. Lawyers for WhatsApp recently told the U.S. court that NSO has “only produced 17 internal documents of its own."
A spokesperson for NSO said that "as a law-abiding company" it cannot comment on the Guardian’s questions about the 2020 seizures. A spokesperson for the Justice Ministry said it "rejects the claim that it has acted in any manner as to harm or obstruct the [U.S.] legal proceedings."
As discovery loomed large in the first half of 2020, NSO weighed asking the Israeli government for a “blocking order” that would prohibit the company from producing certain information to WhatsApp. An NSO memo considering the proposal was shared with Israel’s Justice Ministry in April of that year.
NSO’s fears were confirmed in early June 2020 when WhatsApp served its first discovery requests on the company and demanded access to a wide range of detailed information about its activities, customers and the technological capabilities of Pegasus. The leaked emails reviewed by the Guardian suggest that senior Israeli officials met NSO’s representatives "to discuss issues related to disclosure" a day after the company received WhatsApp’s requests for production of documents.
After one of NSO's lawyers, Rod Rosenstein, asked if the Israeli government was going to “rescue” the company, one of Israel’s U.S.-based lawyers, John Bellinger, a former senior national security lawyer in the George W. Bush administration and now a partner at Arnold & Porter, appears to have told Rosenstein that Israel was "acutely focused on the discovery dangers and is still considering its options."
Three days later, in mid-July 2020, Israel made a significant but secret intervention. At an urgent meeting with NSO, Israeli officials presented the company with an order issued by a Tel Aviv court granting the government powers to execute a search warrant at its office, access its internal computer systems and seize files.
The court order prohibited NSO from disclosing or transferring any documents or technical materials to “any external person or entity” without the authorization of Israeli authorities. The order itself was also made secret; a gag order has prevented the government’s actions from being made public in Israel.
According to the Guardian, Israel’s actions appear to have had a material impact on the case. NSO has argued that its ability to participate in discovery has been limited by various restrictions under Israeli law. In July, WhatsApp’s lawyers told the court they had not yet received any documents relevant to Pegasus and accused NSO of a "continued refusal to meaningfully participate in discovery."