Apple sues Israeli company over spyware

Apple sued the Israeli surveillance company NSO Group on Tuesday, representing another notable step taken by a major tech firm to push back against the spyware industry.

The lawsuit follows the lead of Facebook, which has sued NSO, alleging it targeted WhatsApp users, and signals that rival tech companies are collaborating to restrict the use of surveillance technology they say is used by foreign governments to spy on journalists, human rights activists and dissidents.

Craig Federighi, Apple's senior vice president of software engineering, emphasized in a statement the harm posed by "sophisticated surveillance technologies without effective accountability."

"Apple devices are the most secure consumer hardware on the market -- but private companies developing state-sponsored spyware have become even more dangerous," he said.

NSO did not respond to requests for comment.

Will Catchcart, chief executive of WhatsApp, said on Twitter that he's "glad to see Apple join the effort to hold spyware companies accountable."

"We've long called for industry action against NSO and today's lawsuit shows that technology providers are united in fighting spyware and ensuring more security for our users," he wrote.

NSO develops and sells to foreign governments invasive spyware known as "Pegasus," which allows the covert extraction of information from virtually any mobile device once installed. It can record using a phone's microphone and camera, track the device's location and intercept any communication, including emails, texts and browsing history.

Apple seeks to permanently enjoin NSO from using Apple software, services and devices. This could leave NSO's lucrative business nearly obsolete since most of the world's smartphones run on operating systems from Apple and Google. Apple Inc., v. NSO Group Technologies, CV21-09078 (N.D. Ca.., filed Nov. 23, 2021).

Cindy Cohn, executive director of the Electronic Frontier Foundation, welcomed Apple's entry into the battle to curb the use of invasive spyware.

"I suspect that if companies like Apple and WhatsApp get the relief they want, they will make sure that this isn't something that just goes away and another company pops up to replace NSO," she said.

Apple alleged that NSO has exploited its products, injured its users and damaged its reputation as a leader in privacy. The complaint claimed that NSO's spyware has required Apple to devote thousands of hours to investigate the attacks, identify the harms and develop any necessary repairs to ensure that Apple servers, products and services remain safe for more than 1.65 billion users.

"Defendants force Apple to engage in a continual arms race: Even as Apple develops solutions and enhances the security of its devices, defendants are constantly updating their malware and exploits to overcome Apple's own security upgrades," wrote Sonal N. Mehta, a partner at Wilmer Cutler Pickering Hale and Dorr LLP representing Apple.

Apple said it will contribute $10 million in addition to any damages from the lawsuit to organizations pursuing cybersurveillance research and advocacy.

In a pivotal ruling in the case brought by WhatsApp, the 9th U.S. Circuit Court of Appeals this month rejected NSO's bid to dismiss the lawsuit. NSO argued that it was immune because it was acting as an agent of a foreign state, but the federal appeals court found that foreign sovereign immunity doesn't protect private companies. WhatsApp Inc. V. NSO Group Technologies, 2021 DJDAR 11550.

NSO has represented that it only sells spyware to governments for lawful national security and law enforcement purposes, but findings by journalists, researchers and human rights groups say otherwise.

The Washington Post reported in July that NSO helped foreign governments deploy Pegasus to attack and surveil numerous people in more than 50 countries. The Guardian reported in July that six Palestinian human rights activists, including a U.S. citizen, were hacked using NSO spyware.

President Joe Biden's administration this month blacklisted NSO, saying it was engaging in activities contrary to the national security and foreign policy interests of the United States.