Facebook wanted to purchase NSO Group spyware to surveil users, court documents allege

The fight between Facebook and NSO Group is starting to get ugly.

Two Facebook representatives approached NSO Group in 2017 asking to purchase rights to use its surveillance software to monitor its users, according to court documents filed this week by the Israeli-owned surveillance software company in an ongoing lawsuit with Facebook-owned WhatsApp.

The Facebook representatives specifically told NSO Group they wanted to monitor users on Apple devices, NSO Group CEO Shalev Hulio said, according to court documents obtained by CyberScoop.

NSO Group and WhatsApp are currently battling it out in court after Facebook sued NSO Group for allegedly targeting thousands of WhatsApp users with its spyware.

At the time, Facebook was working to use a VPN product, Onavo Protect, to track users’ web traffic. According to Shalev, Facebook was not satisfied with the results for users on Apple devices and wanted to use NSO Group’s signature Pegasus spyware as a way to monitor Facebook users better.

“The Facebook representatives stated that Facebook was concerned that its method for gathering user data through Onavo Protect was less effective on Apple devices than on Android devices,” Hulio wrote in the filing. “The Facebook representatives also stated that Facebook wanted to use purported capabilities of Pegasus to monitor users on Apple devices and were willing to pay for the ability to monitor Onavo Protect users.”

After Apple said Onavo Protect violated the App Store’s terms on data collection, Facebook pulled it from the store, according to The Wall Street Journal.

Just last year Facebook removed the Onavo VPN application from the Google Play store after TechCrunch revealed the app was collecting data on teenagers.

Facebook accused NSO Group of misrepresenting the conversation, a Facebook spokesperson told CyberScoop in a statement.

“NSO is trying to distract from the facts Facebook and WhatsApp filed in court over six months ago,” the spokesperson said. “Their attempt to avoid responsibility includes inaccurate representations about both their spyware and a discussion with people who work at Facebook.”

CyberScoop could not independently verify the claims made in court.

Pegasus spyware has allegedly been used to target human rights activists and journalists in the past, a claim that NSO Group has repeatedly disputed. The company claims that their software is used by governments for legitimate law enforcement or intelligence reasons.

Shalev said NSO Group declined Facebook’s requests because it is not a government or government agency.

The disclosure of Facebook’s interest in purchasing surveillance software from NSO Group appeared to be part NSO Group’s planned defense in the WhatsApp lawsuit: that it only sells its products to governments. NSO Group did not immediately return request for comment.

You can read the court filings below.

[documentcloud url=”http://www.documentcloud.org/documents/6824740-NSO-Group-on-Facebook-April-2020.html” responsive=true]

Meta accuses NSO Group of defying spyware injunction, files contempt of court complaint

The company said it spotted a spearphishing campaign linked to the Israeli spyware maker targeting WhatsApp users, despite a court order prohibiting it.

Google and Amnesty International teamed up to make it harder for spyware vendors to hide

One House Democrat is pressing Commerce on the government’s spyware use

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems