What are the current trends associated with commercial spyware?听听
Used for both military and civil purposes, , often referred to as 鈥�,鈥� is software that works through non-consensual infection of a user鈥檚 device to monitor their activity and collect data, all while remaining undetected. Government actors commonly use this software to facilitate on individuals to 鈥渇ight terrorism,鈥� but in reality, it is being infamously used against dissenting civilians and politicians, posing a threat to the safety of these individuals. One notorious spyware product used by governments is the 鈥楶egasus Spyware,鈥� developed and sold by the Israeli NSO Group Technologies (NSO) company. Founded in 2009 NSO is an acronym of its founders began as a technology start-up headed by Shalev and Omri, two entrepreneurial high school friends. Niv, a former Mossad operative (a member of Israel's National Intelligence Agency), was later brought on to market the group's technology within the military intelligence community. NSO only sells its surveillance software to government law-enforcement and intelligence agencies globally and its exports are governed by the Israeli Ministry of Defence.听
NSO introduced Pegasus to the in 2011 and the Mexican authorities were one of the few governments to publicly announce its purchase in 2012, whereas European investigators were secretly using Pegasus in the prevention of terrorist schemes and organized crime. Surreptitiously, with NSO, such as Saudi Arabia, United Arab Emirates and Morocco. The spyware technology has become increasingly powerful as governments are using this software under the guise of state security permitting them to spy on individuals without warrant thus, that usually protect individuals living in democracies. NSO and its spyware have consistently been criticized for facilitating human rights violations. Most recently, they made headlines for allegedly undermining the security of technology companies and the safety of their infrastructure, according to multiple lawsuits launched against NSO by companies including WhatsApp (owned by Meta) and Apple.听听
Little is publicly known about how spyware firms operate, mainly because most deal exclusively with governments within secretive public-private transactions. The ongoing lawsuits by these companies against NSO will further expose the opaque and problematic business models of such surveillance technology firms. The business model at hand refers to NSO鈥檚 strategies for profitability, including how the firm develops its products, the services it provides, and its trade plans.听听
听
How does it work?听
Originally, NSO was able to carry out a of the targeted person by transmitting malicious spyware code through a WhatsApp call; the targeted person did not even have to answer the call. After WhatsApp fixed the vulnerabilities which allowed this exploit in 2019, NSO developed a 鈥榸ero-click鈥� technique called 鈥�,鈥� where the Pegasus hacking software can turn a device into a 24-hour surveillance device. The governments and law-enforcement agencies that deploy such spyware have access to the victim鈥檚 personal data and can control the camera and microphone to gather any information on the targeted person. argues that its spyware services are created to 鈥渉elp government agencies prevent and investigate terrorism and crime鈥aiming]鈥o save thousands of lives鈥�. However, this technology not only undermines internationally recognized human rights, including , but it also poses a threat to the voice of journalists and human rights activists that represent civilians鈥� opinions against governmental interests. It doesn鈥檛 end there; NSO鈥檚 product development also depends on its encroachment onto the property of other technology companies to weaken the pillars of their security and undermine the safety of their products and services.听听
What does the business model look like?听听
recognizes that the business model of surveillance-technology firms 鈥渞elies on the ongoing discovery and exploitation of vulnerabilities in widely used third-party digital operating systems.鈥� This business model is aimed at assaulting users鈥� right to privacy when monetizing data about civilians. Surveillance-technology firms like NSO grow and profit by continuously undermining the products of other technology manufacturers such as iOS, Windows, and commonly used messaging services. These attacks not only create less secure products for the users of technology companies but also generate costs for these technology manufacturers when they have to improve their infrastructure or remedy reputational damage, reassure investors, etc... In other words, the operation of NSO surveillance products rests on compromising other companies鈥� efficacy and public standing. The ongoing and lawsuits are examples of how companies are attempting to fight back against the harms caused by spyware firms and help ensure the safety of their users and products. These lawsuits provide insight into the strategies used by NSO, revealing their vectors of attack and how they profit from the targeted surveillance of political oppositions.听
-
WhatsApp v NSO听听
In their 2019 lawsuit against NSO, WhatsApp sought an injunction before the U.S. Ninth Circuit Court to block NSO鈥檚 access to Meta鈥檚 platforms and servers and sought to recover damages from NSO for allegedly targeting around 1,400 users of its messaging services. WhatsApp鈥檚 claims against NSO included and of its Meta servers and products, breach of contract, and wrongful trespass on Meta鈥檚 property. WhatsApp alleged that NSO violated its user agreement terms when it relied its Spyware operation on vulnerabilities found in WhatsApp鈥檚 security infrastructure. In their lawsuit, WhatsApp also claimed that NSO committed wrongful trespass when it transmitted harmful software through WhatsApp鈥檚 platform to gain unauthorized access to user information.听听
An was prepared by international non-governmental and non-profit organizations, like Amnesty International and Access Now, who have been closely monitoring NSO鈥檚 operations and fighting for the protection of digital human rights. These organizations filed the brief to draw the court鈥檚 attention to the international law and human rights concerns that weigh against NSO鈥檚 defence in this lawsuit. The brief highlighted NSO鈥檚 lack of consideration for (UNGPs). These non-state watchdog organizations criticized NSO for prioritizing profits from governments over the detrimental effects on human rights and the stability of other third-party technology companies in its cost-benefit analysis. According to the firm displayed a lack of regard for business policies and processes that ensure human rights obligations, a lack of active engagement in performing human rights due diligence, and a failure to implement remedies when its business dealings or relationships contributed to adverse impacts.听
-
Apple v NSO听听
In November of 2021, Apple filed a lawsuit against NSO to hold it accountable for the surveillance and targeting of Apple users by seeking damages and a permanent injunction to ban NSO from using any Apple software services or devices. This complaint revealed new ways through which the NSO could infect victims鈥� devices, developed by NSO as a response to the improvements made to WhatsApp鈥檚 security infrastructure. Apple characterizes these cyberattacks as a threat to Apple鈥檚 self-professed reputation of making 鈥溾�� and a threat to the safety of its products as well as the customer鈥檚 trust in the company.听听
NSO has been aiming to dismiss the lawsuits entirely by , claiming that the lower courts have failed to recognize the firm as a 鈥榝oreign government agent鈥� entitled to foreign sovereign immunity from lawsuits in the U.S. This argument is , according to pundits. However, if the court were to accept NSO鈥檚 claims that it is a 鈥�,鈥� the precedent would enable further concealment of NSO鈥檚 business dealings, foreign governments鈥� abusive applications of NSO鈥檚 spyware technology, and the firm鈥檚 technological toolkit.听听
听
What are the revelations from the lawsuits?听
These lawsuits will give exclusive access into the opaque business model of spyware surveillance companies, giving the public a better understanding of their operations and corporate governance. Consequently, the findings from these cases could be used to investigate and potentially ban different surveillance companies with similar business models according to a standardized set of criteria. Although the US has , the US department of commerce should extend the decision to a wider range of spyware firms with similar business models. Accordingly, US bans on similar spyware firms could lead to these businesses struggling to operate without access to the American market.听听
Governmental restrictions on the sale and use of spyware in the U.S. could spark a chain reaction, leading more countries or transnational bodies to implement bans. The U.S. would not be the first country to call for greater restrictions on the commercial trade of cyber-surveillance technologies. On April 13th, 2022, Costa Rica became the first country to call for a global moratorium on spyware technology. This is These moratoriums could apply to the sale, transfer and use of such technology and be critical of firms that invest in or adopt a business model similar to NSO鈥檚.听
The lawsuits against NSO are shedding a light on the how spyware firms operate, highlighting their reliance on an intrusive and unethical basis of conducting operations. These findings will provide actors with the legitimate grounds to call for the ban on surveillance corporations with similar business models, to diminish the scale of their business processes, and protect the welfare of both civilians and companies.听
听