The governments of Mexico, Saudi Arabia and Uzbekistan were among several countries accused of being behind the 2019 hacking campaign aimed at more than 1,200 Whatsapp users with NSO Group’s Pegasus Spyware, according to a lawyer working for Israeli Makere.
During a hearing in the lawsuit between WhatsApp and the NSO Group last Thursday, NSO Group lawyer Joe Akrotirianakis specifically named the three governments as customers using Spyware, According to a copy of the hearing acquired by TechCrunch this week.
This is the first time that NSO Group representatives have publicly recognized who Spyware Maker (or were) customers, after years of refusing to discuss its clientele, arguing that the company was “incapable” to do so, a NSO Group spokesman told TechCrunch in 2023.
The revelation comes as part of a statement brought by Whatsapp Meta in 2019, which accused the NSO team of hacking about 1,400 WhatsApp users, taking advantage of a vulnerability in the messaging systems between April and May of the same year.
Contact us
Do you have more information about NSO Group or other Spyware companies? From a device and non-work network, you can contact Lorenzo Franceschi-bicchierai safely on the signal on +1 917 257 1382, or through the telegram and keybase @lorenzofb or email.
Last week’s listening content was first mentioned by Court news service.
In the complaint of the lawsuit, WhatsApp claimed that there were more than 100 targeted victims working as human rights activists, journalists and “other members of civil society”. Citizen Lab, a team of digital rights that has explored government spyware abuses for more than a decade, said in a report at that time That has helped WhatsApp to identify these victims.
Last week, NSO lawyer Akrotirianakis told the judge that “there are at least eight customers whose names are part of the discovery in this case”, but only named three during the hearing.
At the same time, the lawyer also hints that a list of countries included in a judicial document It was detached last week, which shows countries with 1,223 victims of the 2019 Spyware campaign, is also a list containing clients of the NSO Group.
“Pegasus was licensed for territory and can only be used in these territories,” said Akrotirianakis, referring to the NSO Group Spyware.
In addition to Mexico and Uzbekistan, the list of 51 countries includes Bahrain, India, Morocco, Spain, the United Kingdom and the United States. Saudi Arabia, mentioned by the NSO lawyer at the hearing, however, does not appear on the list.
This could be explained by the fact that some NSO clients can target people outside their own territory. For example, in 2017, Reported the citizen workshop That there were “casual data” suggesting that one or more of the NSO Group’s government customers in Mexico are targeting many people, including the child of a well -known Mexican journalist who was in the United States while he was aiming.
Achieved by TechCrunch before the publication, NSO Group spokesman Gil Lainer refused to comment. When asked, Lainer did not question that Mexico, Saudi Arabia and Uzbekistan were three customers of the company at the time of the Whatsapp Spyware campaign.
WhatsApp spokesman Zade Alsawah told TechCrunch that the company is looking forward to the upcoming trial to determine compensation and secure an order against the NSO to protect Whatsapp and people’s private communication. “
On Tuesday, in a preliminary orderA judge chaired by the lawsuit said that while the NSO group stated that the documents provided as part of the discovery period of the lawsuit detect “at least four countries as NSO customers”, the company has not yet publicly confirmed that these countries are its customers.
‘The evidence is opaque as to which one of [NSO’s] Customers were responsible for the attacks in question and so [WhatsApp] They were unable to find out if the control procedures were followed in relation to these customers, “the judge wrote.
For years, organizations such as Citizen Lab and Amnesty internationally have been documented cases where Pegasus was used to target or lose journalists, dissidents and human rights defenders in some of the countries referring to the list of victims, such as Mexico; HungarySpain and the United Arab Emiratesamong many others.
TechCrunch has arrived for comments at the embassies of Mexico, Saudi Arabia and Uzbekistan in the US and will inform the story if we receive an answer.
Was updated throughout the background and additional framework.
