The Israeli government took extraordinary measures to frustrate a high-stakes US lawsuit that threatened to reveal closely guarded secrets about one of the world’s most notorious hacking tools, leaked files suggest.
Israeli officials seized documents about Pegasus spyware from its manufacturer, NSO Group, in an effort to prevent the company from being able to comply with demands made by WhatsApp in a US court to hand over information about the invasive technology.
Documents suggest the seizures were part of an unusual legal manoeuvre created by Israel to block the disclosure of information about Pegasus, which the government believed would cause “serious diplomatic and security damage” to the country.
Pegasus allows NSO clients to infect smartphones with hidden software that can extract messages and photos, record calls and secretly activate microphones. NSO’s clients have included both authoritarian regimes and democratic countries and the technology has been linked to human rights abuses around the world.
Since late 2019, NSO has been battling a lawsuit in the US brought by WhatsApp, which has alleged the Israeli company used a vulnerability in the messaging service to target more than 1,400 of its users in 20 countries over a two-week period. NSO has denied the allegations.
The removal of files and computers from NSO’s offices in July 2020 – until now hidden from the public by a strict gag order issued by an Israeli court – casts new light on the close ties between Israel and NSO and the overlapping interests of the privately owned surveillance company and the country’s security establishment.
The July 2020 seizures were made after Israeli officials and the company appear to have discussed how to respond to WhatsApp’s requests for NSO to disclose internal files about its spyware, raising questions about whether they coordinated to conceal certain information from US legal proceedings.
At one stage, one of NSO’s lawyers, Rod Rosenstein, a former US deputy attorney general in the Trump administration, appears to have asked one of Israel’s US lawyers whether the Israeli government would “come to the rescue” in the legal battle with WhatsApp.
Israel’s hidden intervention in the case can be revealed after a consortium of media organisations led by the Paris-based non-profit Forbidden Stories, and including the Guardian and Israeli media partners, obtained a copy of a secret court order relating to the 2020 seizure of NSO’s internal files.
Details of the seizures and Israel’s contacts with NSO regarding the WhatsApp case are laid bare in a separate cache of emails and documents reviewed by the Guardian. They originate from a hack of data from Israel’s ministry of justice obtained by the transparency group Distributed Denial of Secrets and shared with Forbidden Stories.
Combining US court records, information from sources and a forensic analysis by Amnesty International’s security lab of some of the files, the consortium has been able to confirm key details revealed in the hacked files.
According to Amnesty’s researchers, the files “are consistent with a hack-and-leak of a series of email accounts” but it is “not possible to cryptographically verify the authenticity of the emails as critical email metadata was removed by the hackers”.
In April this year, Israeli authorities obtained another sweeping gag order to prevent the country’s media from publishing information from the hack. The large cache of emails and documents was posted online by a self-described “hacktivist collective”, Anonymous for Justice. The identity of those behind the group is unclear.
Details of Israel’s behind-the-scenes activities in the WhatsApp case have emerged as litigation continues to play out in federal court in northern California.
Earlier this month, WhatsApp accused NSO of resisting its obligations to share internal files as part of a legal process, known as discovery, that would allow WhatsApp to gather information to help build its case and shed unprecedented light on how Pegasus has been used by NSO’s government clients.
However, the Israeli government’s hidden intervention has hindered WhatsApp’s ability to compel NSO to hand over crucial information. Lawyers for WhatsApp recently told the US court that NSO has “only produced 17 internal documents of its own”.
A spokesperson for NSO said that “as a law-abiding company” it cannot comment on the Guardian’s questions about the 2020 seizures. A spokesperson for the justice ministry said it “rejects the claim that it has acted in any manner as to harm or obstruct the [US] legal proceedings”.
‘Strange procedures’
Within months of WhatsApp filing the lawsuit against the company in October 2019, senior Israeli officials are understood to have closely monitored the progress of the case and considered how to prevent WhatsApp gaining access to classified information held by NSO.
Both Israel and NSO anticipated expansive requests from WhatsApp for sensitive internal company files, such as lists of its customers.
As discovery loomed large in the first half of 2020, NSO weighed asking the Israeli government for a “blocking order” that would prohibit the company from producing certain information to WhatsApp. An NSO memo considering the proposal was shared with Israel’s justice ministry in April of that year.
NSO’s fears were confirmed in early June 2020 when WhatsApp served its first discovery requests on the company and demanded access to a wide range of detailed information about its activities, customers and the technological capabilities of Pegasus.
The leaked emails reviewed by the Guardian suggest that senior Israeli officials met NSO’s representatives “to discuss issues related to disclosure” a day after WhatsApp’s requests for production of documents were received by the company.
At around this time, NSO and its lawyers at the elite US firm King & Spalding appear to have been seeking Israel’s help in trying to defend itself from WhatsApp’s lawsuit.
After Rosenstein is said to have asked if the Israeli government was going to “rescue” the company, one of Israel’s US-based lawyers, John Bellinger, a former senior national security lawyer in the George W Bush administration and now a partner at Arnold & Porter, appears to have told Rosenstein that Israel was “acutely focused on the discovery dangers and is still considering its options”.
Three days later, in mid-July 2020, Israel made a significant but secret intervention. At an urgent meeting with NSO, Israeli officials presented the company with an order issued by a Tel Aviv court granting the government powers to execute a search warrant at its office, access its internal computer systems and seize files.
The court order prohibited NSO from disclosing or transferring any documents or technical materials to “any external person or entity” without the authorisation of Israeli authorities. The order itself was also made secret; a gag order has prevented the government’s actions being made public in Israel.
Scott Horton, a US lawyer and adjunct professor at Columbia Law School, said these were “strange procedures to be taking in relation to a private entity”, suggesting NSO was in fact an “integral part of the Israeli defence establishment and they are trying to shield [this] from public discovery”.
According to court records and Israeli justice ministry files, the order obtained by Israel had a specific loophole that allowed NSO’s lawyers to inform the US court in the WhatsApp case of the seizures and the restrictions that had been imposed on the company prohibiting disclosure.
NSO persuaded a US judge in the case to keep information about these developments under seal, ensuring they have remained out of public view. It is not clear whether NSO has disclosed to the court its contacts and meetings with Israeli officials prior to the seizures.
Leaked files suggest that at one stage NSO’s lawyers drafted a declaration to be filed in the US proceedings informing the court the Israeli seizure order was not “announced in advance to, nor expected by” the company. Ultimately, however, it appears this statement was not included in the declaration that was filed. A spokesperson for King & Spalding said it “does not appear” in the declaration.
Israel’s actions appear to have had a material impact on the case. NSO has argued that its ability to participate in discovery has been limited by various restrictions under Israeli law.
Earlier this month, WhatsApp’s lawyers told the court they had not yet received any documents relevant to Pegasus and accused NSO of a “continued refusal to meaningfully participate in discovery”.
Additional reporting by Phineas Rueckert and Karine Pfenniger of Forbidden Stories.
