Oliver Holmes & Stephanie Kirchgaessner
The Guardian / January 16, 2020
Judge orders NSO Group to fight case brought by Saudi activist and pay his legal costs.
An Israeli judge has rejected an attempt by the spyware firm NSO Group to dismiss a case brought against it by a prominent Saudi activist who alleged that the company’s cyberweapons were used to hack his phone.
The decision could add pressure on the company, which faces multiple accusations that it sold surveillance technology, named Pegasus, to authoritarian regimes and other governments that have allegedly used it to target political activists and journalists.
A Tel Aviv court ruled that the case brought by Omar Abdulaziz, a dissident based in Canada, could go ahead. In his lawsuit, he has argued that Saudi spies used Pegasus to read his conversations with Jamal Khashoggi, a Washington Post columnist later murdered in the Saudi Arabian consulate in Istanbul.
The Guardian understands that Abdulaziz and Khashoggi exchanged hundreds of messages in the months before he died.
NSO had attempted to get the case thrown out of court by arguing that it lacked “good faith” and was abusing Israel’s judicial system, according to a copy of the ruling on 22 December.
However, the judge, Guy Hyman, found no grounds for dismissal. Separately, while he agreed that the trial related to sensitive security issues, he did not accept that meant it should be held in secret.
“The scope [of the case] is very broad, especially in matters of the roots of constitutional values and fundamental rights,” he said. “The ruling, therefore, in my view, must be public.”
NSO should also pay Abdulaziz’s legal costs of 23,000 shekels (about £5,100), he added.
Alaa Mahajna, the lawyer representing Abdulaziz in Israel, welcomed the ruling and said the decision would push the trial forward.
“It will force NSO to provide a defence and not just hide behind procedural delay tactics,” he said. “To my knowledge, this is the most advanced stage any private lawsuit against spyware developers has ever reached.”
In his lawsuit, Abdulaziz has claimed 600,000 shekels in damages. He argued that the intercepted communications between him and Khashoggi – including discussions about how to push for democratic change in Saudi Arabia – were critical elements in the decision to kill Khashoggi.
“While the deceased Khashoggi’s political activities were not new, and officials from the Saudi government knew of them a long time ago, the tightening collaboration between the plaintiff and the deceased in developing joint projects was the main reason for the decision to kill him,” the lawsuit claimed.
An NSO spokesperson said the company would appeal against the decision. “The latest judgement was part of an interim proceeding which did not address the merit of [Abdulaziz’s] allegations; we remain confident that, once considered, the court will reject them,” he said.
The spokesperson would not comment on specifics of the case but said Khashoggi was never targeted by one of the firm’s products.
On Thursday, an Israeli court ruled that a separate case related to NSO should be held behind closed doors. In that lawsuit, Amnesty International and other rights groups have sought to force Israel’s ministry of defence to revoke some of the spyware company’s export licences.
Amnesty claims that multiple rights activists, and one of its own staff members, have been targeted by NSO products. Meanwhile, the ministry’s legal team argued that the case should be held in secret on national security grounds.
While NSO has not commented on specific cyberattacks cited in the Amnesty lawsuit, it has said it would “do whatever is necessary” to ensure its technology is not abused to undermine human rights.
NSO faces a further case in the US, brought against it in October by WhatsApp, which accuses the company of a series of sophisticated cyber-attacks that breached its messaging platform.
While Abdulaziz claims that his phone was hacked after he clicked a fake link in an SMS message that he thought was from a courier service, WhatsApp believes that hundreds of others had their mobile phones hacked last year via its software.
Last month, the Guardian reported that a least two dozen Pakistani government officials were allegedly targeted in this way, the first public instance of how Pegasus could have been used for “state-on-state” espionage.
WhatsApp’s legal team said last week that NSO had not yet responded to the California lawsuit, or hired a lawyer to represent it. According to an affidavit filed by WhatsApp, this was despite the fact that it had hand-delivered the complaint to NSO’s offices in Israel.
The documents, WhatsApp said, included a request for contact details and a note informing NSO of its “duty to preserve all documents that may be relevant to this litigation”.
NSO previously said it would vigorously contest claims by WhatsApp and its parent company, Facebook, and the company spokesperson said it still intended to defend itself.
“NSO’s technology is only licensed, as a lawful solution, to government intelligence and law enforcement agencies for the sole purpose of preventing and investigating terror and serious crime,” the spokesperson said.
Separately, NSO has put a new human rights policy in place to “prevent and mitigate” abuse of its spyware. The policy states that NSO customers have contractual obligations to limit the use of the company’s products to the “prevention and investigation of serious crimes, including terrorism, and to ensure the products will not be used to violate human rights”.
Oliver Holmes is the Jerusalem correspondent for The Guardian
Stephanie Kirchgaessner is The Guardian’s US investigations correspondent, based in Washington DC.
