Self Probe Won’t Cut it for Israeli Spyware Company NSO, Says Citizen Lab Researcher

Israeli cyber surveillance company NSO Group’s self probe into the use of its mobile phone spyware software is inadequate, according to Bill Marczak, a senior fellow researcher at the University of Toronto's Citizen Lab, a digital and human rights research group. Marczak, who worked on several Citizen Lab reports concerning the alleged use of NSO’s Pegasus spyware against journalists and activists, spoke Thursday at Calcalist’s third annual Mind the Tech conference in New York.

In November, citing information from Citizen Lab, American whistleblower Edward Snowden alleged that NSO’s software played a role in the killing of Saudi journalist Jamal Khashoggi at the Saudi embassy in Istanbul. Representatives of NSO have repeatedly denied any connection between the company’s software and Khashoggi’s murder.

Companies developing spyware for the use of governments and law enforcement agencies all have a similar rationale, Marczak said: their technology is only being used to target criminals and terrorists. However, in some countries, such as Saudi Arabia—which uses NSO’s software according to a September Citizen Lab report—making fun of the regime is considered terrorism, he added.

The Saudi government has a counter-terrorism unit dedicated solely to anyone that depicts the king in an unflattering light, Marczak said.

According to Marczak, Citizen Lab first encountered NSO’s software in 2016 when an activist from Dubai forwarded a suspicious text he had received to the organization. The message contained a link that would install NSO’s software on a device using vulnarbilities in Apple’s iOS, which Citizen Lab reported to the company. NSO claimed the update Apple subsequently issued only interfered with its operation for 30 minutes but data gathered by Citizen Lab showed it operated in a limited capacity for seven months, Marczak said.

There is a significant difference between spying for democratic countries and doing the same for undemocratic regimes, Marczak said. In countries such as Saudi Arabia, the damage is much greater than in countries where citizens can demand answers and hold their governments accountable for their actions, he added.