Two separate lawsuits — one in Cyprus and another in Israel — accuse the Israeli firm NSO Group of extrajudicial surveillance. One of the lawsuits also alleges that Mexican journalists and human rights activists were targets of NSO Group surveillance at the behest of their government.
The spyware, called Pegasus, was also weaponized against a Saudi national and Amnesty International employee who was doing work on human rights in the kingdom.
Previously, the New York Times reviewed internal documents and concluded that NSO Group charges governments $650,000 to hack 10 iPhone or Android phone users; $500,000 for five BlackBerry users; and $300,000 for five Symbian users — all in addition to a one-time $500,000 installation fee. The company also gives a discounted rate to states with big target lists, charging just $800,000 to hack 100 phones.
Pegasus begins by working like any old spear phishing campaign. A target is sent a link intended to be enticing. The attempt at hacking the Amnesty employee came with a link posing as an Amnesty press release; in the case of the UAE, an NSO Group affiliate recommended messages such as ""Ramadan is near — incredible discounts."
But once the user clicks the link, they're basically doomed. Pegasus, once in effect, secretly lets the hacker review text messages, track and record phone calls, steal passwords, track GPS coordinates from the device and review information from Gmail, Facebook, WhatsApp, Telegram and Skype accounts.
NSO Group has sworn up and down over the years that its software is only used for surveillance against terrorists and criminals, but documents in the lawsuit, as well as Amnesty International's statement and testimony from victims in years past, indicate otherwise.
When the firm offered the Emiratis an expensive update on the tech, the monarchy wanted assurances that it was as powerful as it was pitched, leaked emails introduced to the case on Thursday show. In order to demonstrate its effectiveness, a company representative offered up phone call recordings belonging to Abdulaziz Alkhamis, then an editor at the London-based Al Arab newspaper. Alkhamis told The New York Times that he wasn't all that surprised to learn his phone had been hacked, since he has published "sensitive" articles about the Persian Gulf.
UAE authorities also wanted to surveil a Saudi prince in charge of the monarchy's national guard, Lebanese Prime Minister Saad Hariri and the Qataris.
One of the lawyers for the plaintiffs, Alaa Mahajna, told the Times, "We are pushing to make the law catch up with technology."
Both the Emiratis and NSO Group declined to comment.
