"The Marari report shows a severe violation of the privacy and rights of suspects"

"This is a harsh and serious report that indicates significant failures in the functioning of the police, and as a result - a serious violation of the privacy and rights of suspects," - said Attorney Gil Gan-Mor, Director of the Department of Civil and Social Rights at the Civil Rights Association, in response to the report by the Marari Commission which investigated the NSO case revealed by Calcalist earlier this year.

Attorney Amit Marari on Pegasus spyware NSO

"The team determined that the police, in violation of law and judicial orders, extracted information from phones that were being spied on," Gan-Mor added. "To the extent that the Attorney General is allowing the police to return to using foot soldiers without explicit legislation, the association will consider turning to the High Court," he said.

The Marari Committee report published Monday found that the police extracted information from mobile devices in violation of the law and in excess of their authority. In addition, serious failures were identified in the procedures for supervising and controlling the police and it was found that the legal accompaniment was inadequate and the procedures were hidden from the Ministry of Justice.

"The importance of Calcalist's investigation is enormous," said Prof. Michael Birnhack from the Faculty of Law at Tel Aviv University. "The newspaper article may not have been accurate in all the details, but it exposed the confusion in the police force and the prosecutor's office regarding this issue. Marai’s recommendations are very important, especially if they are implemented."

Prof. Michael Brinhak

Prof. Birnhack explained that although the law allows to tap conversations, including communication between computers, it does not refer to the use of spying, which opens the door to different interpretations. He disagrees with the Marari Committee's interpretation, according to which when a judge issues a wiretapping order this also includes the use of means to bypass encryption." The report interprets the law according to police need, but as the High Court clearly states regarding other contexts of privacy: need is not a source of authority. Using spyware, even degenerated spyware, is, in my view, a means whose harm exceeds its necessity." Therefore, Prof. Birnhak claims the wiretapping law must be amended.

Human rights activist, attorney Eitay Mack, who previously petitioned against NSO and the Ministry of Defense, said: "What an eye roll by the Ministry of Justice. They really didn't know the power of Pegasus. Have they been living on the moon in recent years?"

According to Mack, updating the legislation will only lead to more widespread use of the Pegasus system and the like: "In a democratic country, law enforcement authorities must not have powerful and total Pegasus-type systems. There is no way to have effective supervision that would prevent unusual use or abuse. The Marari Committee's recommendation on legislative amendments, if accepted, will increase the frequency of use of Pegasus-type systems by the police and normalize them. Instead, the Marari Committee should have recommended the prohibition of the police's use of the Pegasus system and others and allow the police to use only more limited and less offensive technologies."

Attorney Rivki Dvash, a senior fellow at the Israel Institute for Policy and Technology and former head of the Authority for the Protection of Privacy (in practice), said that "the report refers to an exception in the use of surveillance in relation to a wiretapping order - both in relation to wiretapping carried out before the order was issued and in relation to the type of information collected. However, the report does not refer at all to the fact that it must be assumed that the information is kept in the cyber unit and may be used (and may even be used in practice) for the intelligence database that is used, presumably, also through automatic investigation of the information."

"Beyond the fact that a system cannot test itself, questions arise regarding the degree of understanding and the fact that the appropriate questions regarding the use of spyware were not asked in the cyber department at the state attorney's office," added Attorney Dvash. "The report specifically states that the department was aware of the use of NSO's Saifen system, but was not aware of all aspects of the use of the spyware. The expectation of all of us is that the cyber department will understand and know what spying means and will know how to ask the appropriate questions before the appropriate authorities in government and in the legal advisory system for the government and the police." Dvash concluded that "it is to be hoped that the recommendations of this important report will be promoted soon, and that the upheaval caused by this affair will not cause the system to sink into the depths of the sea like many other reports".

Attorney Jonathan Klinger from the Movement for Digital Rights criticized the fact that the investigation committee was established and operated within the Ministry of Justice, which creates a "built-in conflict of interest", according to him. "The team that made the examination was in fact the customer of the product, so it will be difficult for such a team to give a meaningful review."

Klinger claimed that the committee "washed away" the offenses committed by the police. "A search in violation of a warrant is a criminal offense of invasion of privacy, and in this case the police violated the law," he said. “The team also claims that judicial orders were issued with authority and at the same time explains that there is no legal infrastructure. Let the team choose a legal position and stand behind it. In a funny way, the team recommends training for judges, who anyway approve 99% of the orders, as if that training would lead to the rejection of one order or another."

Klinger also criticized the claim that part of the report is confidential, which "does not add to public trust", according to him. "The report gives too much trust in NSO,” he added. "Everywhere it is written that NSO reports cannot be changed by the police, but nothing is written about NSO holding on to the reports, which could indicate the problematic nature of communication between the organizations.”

"What emerges from the Marari report is the complete lack of oversight by the police," concluded Klinger. "The police operated for years in the dark, did not share with law enforcement authorities the ways in which they investigate and obtain information, and law enforcement authorities ignored the way in which information was obtained."

Prof. Eran Toch from the Faculty of Engineering at Tel Aviv University criticized the Marari Committee's focus only on legal aspects of the use of Pegasus. "The problem here is that the Marari report ignores in a very significant way a technological analysis of the spyware, and it treats them as a type of eavesdropping, only with a different technology," he explained. "But that's not the case. The use of spyware is completely different from traditional tapping, beyond the issue of the additional information that can be extracted and the time window in which the information can be obtained. Both violate privacy, but infection with malicious software requires intrusion into the phone, an intrusion that is largely based on deceiving the person who operates the phone (the 'target'), and requires him to click on a link or run certain software.

"The report claims that the characteristics of each spyware system be checked separately (which makes sense), but it really does not continue this line of thought, and does not report how the tools that were used manage to break into phones. In general, it can be said that using spyware is much more similar to breaking into a house, while establishing fraud, than for wiretapping. The report makes a distinction, without foundation in my view, between computer search authority and wiretapping, but in the case of spying, there really is no such difference. Intrusions into the phone are most often based on weak points in the cellular operating system we use, and contrary to the house metaphor, exploiting such a weak point is also harmful to the security of all of our information, because weak points do not usually remain secret, and trickle down to criminal entities."

Attorney Haim Ravia, head of the internet and cyber group at the Pearl Cohen Zedek Latzer Baratz office, said: "The report shows the complete failure of the Attorney General’s office and the legal advice to the police. While it seems that they gave instructions to degenerate the system - they forgot to examine whether the instructions on the subject were taken care of. It is embarrassing to read the report's claims about not reporting to the Attorney General. If a legal advisor in a public company had been responsible for a failure of this magnitude, he would have been dismissed on the spot."

Attorney Naama Matarasso Karpel, who until recently served as the CEO of the Israel Privacy Association, said that "with the publications of Calcalist, I thought that spying had no place in the police force. Moreover, as someone with intelligence experience in the field of cyber - I thought that the risk of misuse of offensive cyber tools was high. However, day by day my opinion has become more complex: today I think there is a place for surveillance systems that are restrained and limited in their technological capacity in the force. In order to enable the operation of spyware, we must set several preconditions: use of spyware in accordance with and subject to a specific and goal-oriented legal authority - not in every case, not for every offense; A system of technological and legal audit and supervision, which, among other things, knows how to match the type of surveillance and the purpose of use in the most optimal and proportionate way; Public transparency regarding the scope of the use of spying, the scope of errors and malfunctions in use, the effectiveness of these tools in the face of indictments and more."

Prof. Karine Nahon Reichman University

Prof. Karine Nahon, Head of the Data, Governance and Democracy Division at Reichman University, stated that "it is not correct that in a democratic country the police have the ability to use spyware against citizens. However, in extreme circumstances, such as organized crime and in cases where there are no alternative ways to access information, the police should be allowed exceptional abilities and tools. However, the activation of those exceptional cases cannot be a decision made by the police alone, and it is important that there be close supervision, external to the police and sufficiently senior, of the output resulting from access to sensitive content and the use of these products. Since these are exceptional measures, it is important to decide on the process through legislation first and not procedures."

Prof. Yoav Sapir of the Faculty of Law at Tel Aviv University and former national public defender says that "the use of spyware cannot be seen as an ordinary search of computer material or ordinary eavesdropping, of the type that the legislator envisioned when enacting the laws that allow this. Great caution must be exercised against opening the door that would allow state authorities to spy on their citizens. Such use, which is always initially presented as use against criminals and terrorists, can soon reach innocent citizens against whom there is suspicion, as it has already turned out is being using in other parts of the world," Sapir added.

Attorney Gil Shapira, director of the department for representing prisoners at the National Public Defender's Office, said that "the main question is not necessarily one specific means or another, but the way in which the state regulates, attacks, controls and supervises the use of the various technological means, including spyware. The situation that exists today, where there is no normative framework that regulates the use of technological means in investigations and regulates the judicial, professional and parliamentary supervision and control of the use of these means, is a problematic, flawed situation that causes a lot of difficulties."

Following the publication of the report after a series of Calcalist investigations, Head of the Bar Association, Avi Himi, appealed to the Minister of Justice Gideon Sa'ar, and demanded that an authorized body investigate the findings.

"Given the conclusions that are disturbing, to say the least," said Himi, "I believe that the most serious findings contained in the Marari report cannot and should not be ignored, including findings that emerge from it, even if they were not explicitly stated."

As a follow-up to the report, Himi is demanding the establishment of an independent commission of inquiry, because according to him "it is not possible to accept a situation in which, despite the long period of time in which the spyware was activated, the frequent dialogue that takes place between the prosecution authorities and the police in general contexts of wiretapping, and the specific contexts of handling individual cases, that no one asked, heard or saw what was happening."