It’s the latest salvo in a multi-front battle against foreign commercial spyware. That battle has been pursued in the executive branch, Congress, the courts and the tech industry. In fact, the lawsuit came the same day that Google called out a Spanish firm it says is a spyware vendor.
Wednesday’s lawsuit accuses NSO Group of violating the main federal anti-hacking law, as well as a computer access and fraud law in California, the location of the federal court where the plaintiffs filed their complaint. The plaintiffs are reporters and others who work for El Faro, a Salvadoran news organization, who allege they were targets of NSO Group’s Pegasus spyware.
The plaintiffs want a judge to declare that NSO Group has violated U.S. law. They also want a judge to order the company to disclose the client who spied on them, Carrie DeCell, senior staff attorney with the Knight First Amendment Institute, told me.
“We do view the use of spyware against members of the press in particular as one of the biggest threats to democracy and independent press freedom today,” said DeCell, whose organization is co-representing the plaintiffs with Columbia University. “We think an order requiring NSO Group to disclose its client would really deter future government actors from seeking to use NSO’s technology in their own efforts to repress journalism and stifle free speech.”
The lawsuit relies on research from the University of Toronto’s Citizen Lab, Access Now and Amnesty International. Researchers at those organizations determined that the El Faro employees were targets of Pegasus “zero-click” spyware that allows attackers to install it without human interaction.
NSO Group criticized those groups in a statement responding to the lawsuit. The three organizations “repeatedly recycle each other’s reports and knowingly release speculative, inaccurate and incomplete reports to the media,” according to the emailed statement from an NSO spokesperson.
Ronan Farrow of the New Yorker detailed the experience of U.S. citizen Roman Gressier, a case plaintiff and journalist working abroad. There have been U.S.-based lawsuits against NSO Group, most prominently the one filed by Meta, the parent company of Facebook and WhatsApp.
- The Supreme Court is expected to decide soon on if it will hear a case on whether Meta can pursue its lawsuit, which alleges that NSO Group illegally targeted its users with spyware. NSO Group maintains that its work for foreign governments makes it immune to such lawsuits, but the Biden administration has a differing interpretation.
The plaintiffs in the latest case are especially interested in holding NSO Group to account in U.S. courts, DeCell said. The most important reason is because “the value of the spyware really derives from its ability to infect the most smartphones around the world,” and U.S. infrastructure and companies give them the best opportunity to do so, DeCell said.
NSO Group says “it is technologically impossible for Pegasus to operate on U.S. soil,” a claim some have rebutted.
“NSO is a software provider, the company does not operate the technology or is privy to the collected data,” its emailed statement reads. “The company does not and cannot know who the targets of its customers are, yet developed and implements rigorous and unique compliance policies, and has terminated contracts when misuse was found following its investigations.” The company argues that its…
Read More: Here’s a first: Journalists and a U.S. citizen are suing NSO Group
