Rod Rosenstein is working with NSO Group, the Israeli firm accused of spying on dissidents

The former number two at the Department of Justice has been providing counsel to NSO Group, the firm accused of spying on associates of Jamal Khashoggi.

Rod Rosenstein, a former deputy attorney general at the Department of Justice, has been providing counsel on cybersecurity and national security to NSO Group, the Israeli software surveillance firm accused of spying on human rights activists and journalists, according to court documents obtained by CyberScoop.

Rosenstein’s work with NSO Group was revealed in court documents in relation to a lawsuit WhatsApp filed against the company, accusing them of surveilling over 1,000 WhatsApp users.

“I have counseled NSO about cyber and national security issues and assisted the defense team” in the WhatsApp v. NSO Group case, Rosenstein said in the signed declaration.

Rosenstein has been employed by King & Spalding, the firm representing NSO Group, since January of this year. He previously served as deputy attorney general from 2017 through May 2019.

The filing is an attempt to rebut WhatsApp’s claims that King & Spalding has a conflict of interest in the case because it has represented NSO’s opponent, WhatsApp, in a different case. WhatsApp’s parent company, Facebook, claims King & Spalding’s past work with WhatsApp should disqualify the firm from working on the current lawsuit. That case remains under seal.

The revelation that Rosenstein has been advising NSO Group and its defense team against accusations of spying stands in stark contrast to some of Rosenstein’s work at the DOJ, where he prosecuted foreign hackers and characterized the murder of Khashoggi as “lawless.”

His involvement in the WhatsApp case also raises questions about what knowledge Rosenstein has about the FBI investigation into NSO Group, which was opened in 2017.

NSO Group has been accused of creating and selling a mobile spyware tool that’s been used against journalists, human rights activists, and political dissidents around the world. Most notably, NSO Group’s software had allegedly been used to spy on associates of American journalist Jamal Khashoggi before his murder in 2018. NSO has denied the claims and says that it only sells its tools to governments and intelligence agencies for legitimate purposes, such as tracking down terrorists.

NSO Group reportedly has other connections with the Trump administration.  David Zolet, a former director of NSO Group’s U.S. branch, simultaneously worked with Trump administration officials on FirstNet, the encrypted nationwide network for first responders, according to Forensic News.

NSO Group did not return requests for comment on Rosenstein’s declaration. WhatsApp declined to comment.

You can read Rosenstein’s statement in full here:

[documentcloud url=”http://www.documentcloud.org/documents/6933591-Rosenstein-NSO-Group-Declaration.html” responsive=true]

Meta accuses NSO Group of defying spyware injunction, files contempt of court complaint

The company said it spotted a spearphishing campaign linked to the Israeli spyware maker targeting WhatsApp users, despite a court order prohibiting it.

WhatsApp releases account feature that looks to combat spyware

NSO Group argues WhatsApp injunction threatens existence, future U.S. government work

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure