Israel Maneuvered to Prevent Disclosure of State Secrets amid WhatsApp vs NSO Lawsuit
Documents reveal how Israel seized files, suppressed information related to WhatsApp’s lawsuit against Pegasus spyware vendor NSO
- Amid a lawsuit pitting WhatsApp against the Israeli company NSO, the state of Israel ordered documents to be seized from the offices of the Pegasus spyware vendor
- Israel also emitted a gag order on the seizure to prevent further dissemination of the information
- Leaked files from the Israeli Ministry of Justice accessed by Forbidden Stories suggest that the MoJ pushed for language in NSO court filings to be modified
Credit: Melody Da Fonseca / Forbidden Stories
By Phineas Rueckert and Karine Pfenniger
July 25th, 2024
Additional reporting by Stephanie Kirchgaessner and Harry Davies (The Guardian)
The government of Israel maneuvered to sway the ongoing lawsuit filed by WhatsApp in the United States against Israeli spyware company NSO in an attempt to prevent state secrets from being shared in legal proceedings, documents accessed by Forbidden Stories and shared with a consortium of international and Israeli media reveal.
In July 2020, about nine months after WhatsApp sued NSO in a California court, the Israeli government requested for files in NSO’s office in Israel to be seized as NSO faced a potential discovery process, the consortium found. This pre-trial procedure, typical to common law jurisdictions such as the U.S., can lead to sensitive, internal documents being produced in court through a subpoena. Israel feared that these documents, if included in the lawsuit through discovery, could reveal information about Israeli state secrets.
The state of Israel also maneuvered to keep the seizure under wraps. Israel filed a gag order on information pertaining to the seizure of files at NSO’s offices, effectively preventing Israeli media from publishing information about the seizure. This publication ban, which has been in place for more than a year, aimed to protect Israel’s national security and foreign relations. The gag order referred to the WhatsApp litigation, suggesting that it could have been issued in response to the lawsuit.
“Such revelations call into question Israel’s commitment to impartially regulate NSO Group and casts doubt on its ability to provide justice, truth and reparation to those affected by Pegasus spyware,” said Donncha Ó Cearbhaill, Head of the Security Lab at Amnesty International.
Israel’s tip-toeing around the WhatsApp case demonstrates its sensitivity to information about crown jewel NSO possibly leaking into the public domain. Forbidden Stories previously helmed an investigation that led to revelations about the spyware tool Pegasus, sold by NSO and capable of remotely infecting the phones of targets without interaction on the part of the phone’s user. Marketed as a tool in the fights against terrorism and organized crime, Pegasus was allegedly abused against more than 180 journalists, as well as human rights defenders, lawyers, opposition politicians and governing party members in dozens of countries around the world, we revealed in the 2021 Pegasus Project.
Following up on this case three years later, we accessed leaked emails and files from the Israeli Ministry of Justice. The more than a million emails, documents and other files, obtained by non-profit Distributed Denial of Secrets (DDoSecrets) and shared with Forbidden Stories, show how Israel sought to shield NSO and the confidential information it retains from the lawsuit launched by WhatsApp. Through background sources, an additional official Israeli document and forensic analysis of some of the leaked files, conducted by Amnesty International’s Security Lab for Forbidden Stories, the consortium, which includes Israeli partners, has been able to confirm the main findings presented in this piece.
According to Amnesty International’s Security Lab, the data dump, which was claimed online by the hackers from self-described “hacktivist collective” Anonymous for Justice, corresponds to the format of a hack-and-leak of a series of email accounts. Amnesty was not able to cryptographically verify the authenticity of the leaked emails, which had been converted into HTML format and did not include metadata. Technical indicators in other files from the leak, including PDFs and Microsoft Word documents cited by Forbidden Stories in this piece, do not show obvious signs of having been tampered with.
Amnesty’s analysis of the leak found indications that the hackers were located in the Iranian time zone. “The tactics seen here are consistent with previous hack-and-leak operations claimed by alleged hacktivist groups, but which have been attributed by the cybersecurity industry to Iran-linked hacker groups,” the Security Lab said. We decided to publish the story because of its public interest.
In a response to questions from The Guardian, a partner on this project, a spokesperson for the Ministry of Justice responded that it “rejects the claim that it has acted in any manner as to harm or obstruct the legal proceeding referenced in your questions.”
Support us so that we can continue investigating
We need your help to expose what the enemies of the press try to keep quiet.
“Strange procedures”
The order for a seizure of documents at NSO’s offices in Herzliya was issued by a Tel Aviv judge on behalf of the Israeli government in the context of a closely-followed lawsuit in the state of California.
In October 2019, messaging platform WhatsApp (owned by Facebook, which has since been renamed Meta), sued NSO in California’s 9th District Court for allegedly abusing its platform to hack the phones of 1,400 targets. (NSO has contested the claims.) WhatsApp’s move has since gained wide support, with several major technology firms such as Microsoft, Google and LinkedIn, as well as NGOs – including Amnesty International – and scholars joining the lawsuit as amici curiae (non-party advisers to the case) in support of WhatsApp.
According to multiple documents, the government of Israel requested to seize NSO documents in order to prevent the disclosure of information deemed to cause “grave damage to the State of Israel’s national security and foreign relations.”
Scott Horton, a lecturer at Columbia Law School, said that these were “strange procedures to be taking in relation to a private entity. The only way to make sense of it is to say, ‘well that masks a reality, which is that [NSO] is an integral part of the Israeli defense establishment and they are trying to shield it from public discovery.’”
“It doesn’t remotely surprise me,” he added, “and it really is revelatory of the relationship between the [Israeli] government and NSO.”
Leaked files reviewed by Forbidden Stories suggest that the Israeli Ministry of Justice also pushed NSO to remove language from court filings that implied Israel is a customer of NSO and uses Pegasus technology.
A March 2020 document authored by NSO lawyers asking the court to dismiss the case appears to have been edited by a government official and their counsel (NSO and their counsel also appear to have edited the document). References to Israel’s use of NSO technology were removed and do not appear in the filed version of the motion to dismiss.
Some suggestions that appear to have been made by the Israeli Ministry of Justice were included verbatim in the official filing, Forbidden Stories was able to confirm through a review of publicly-available court documents.
Another document seen by Forbidden Stories and that seems to have been accessed by officials at the Ministry of Justice shows that in 2020, NSO’s legal team believed that sensitive documents, such as its full customer list including “U.S. customers,” contracts, or even information related to “the Jeff Bezos hack or Khashoggi killing” could be among the files that might fall under the discovery.
“Litigation is a way to bring to light wrongdoing, so the transparency enabled by discovery in US litigation is highly valuable,” Maggie Gardner, Professor of Law at Cornell Law School, said. “That doesn’t mean there shouldn’t be limits on it or checks by courts, but judges have to stay constantly vigilant that tools like protective orders or deference to foreign sovereign interests don’t displace the ability of litigants to use U.S. courts to enforce their U.S. rights.”
Israel editing court filings is not “presumptively inappropriate,” Gardner added, “as long as [NSO] isn’t making a representation to the court that its filing solely represents its own views.”
The immunity argument
In California, high-power U.S. law firms have jockeyed back and forth since October 2019, when WhatsApp filed the case against NSO.
NSO’s legal counsel at the law firm King & Spalding included Rod Rosenstein, the former U.S. Deputy Attorney General under Donald Trump. Israeli officials at the Ministry of Justice kept close eyes on the case, hiring the U.S. law firm Arnold & Porter for legal advice, according to an invoice seen by Forbidden Stories. Israel’s Justice Ministry paid over $88,000 for 108.50 hours of work in February 2020, for an hourly rate as high as $913.
In court, NSO has tried to argue that the company should be entitled to immunity under U.S. law as a foreign government agent. In April 2022, the spyware company appealed the case to the U.S. Supreme Court. That appeal was rejected in January 2023, effectively allowing WhatsApp to pursue the lawsuit.
In February 2024, the court handling the case ruled NSO should produce “all relevant spyware” to WhatsApp but did not force the company to share its client list or information regarding its server architecture.
July 2024 court filings by WhatsApp suggest that NSO has refused to “meaningfully participate in discovery.” In a memorandum on the “discovery matter,” WhatsApp’s lawyers wrote that, “because of NSO’s continued stonewalling,” as of July 17, 2024, they had “yet to receive any [emphasis original] document discovery related to the relevant spyware.” “The Court should not reward NSO for its refusal to produce documents,” they wrote.
In a statement shared with Forbidden Stories, a WhatsApp spokesperson reiterated that “NSO needs to answer for their cyberattacks that have targeted human rights activists, journalists and government officials.” “NSO violated US law, and they must be held accountable for their illegal hacking operations,” they added.
Gil Lainer, Vice President for Global Communications at NSO Group, said: “As a law-abiding company, NSO cannot comment on your questions.”
Lawyers from NSO and the Israeli Ministry of Justice did not respond to requests for comment; nor did the Israeli Prime Minister’s office.