Late in October, WhatsApp, a Facebook-owned social media company, sued NSO Group, an Israeli technology firm, for abusing a flaw in WhatsApp’s code to spy on its users. Current and former employees of NSO are now suing Facebook, claiming that their individual Facebook and Instagram accounts were unlawfully blocked when Facebook filed suit in October. Facebook does not deny disabling accounts. A statement by the company explains that the disabled accounts were relevant to the “sophisticated cyber-attack” by NSO and its employees. NSO employees all claim that accounts of their family members have been blocked.
The original suit is underway in the Northern District of California. The NSO employees brought their suit to the Tel Aviv District Court in Israel. This included a petition for Facebook to be ordered to unblock the accounts. WhatsApp accused NSO of violating WhatsApp’s terms of use and the Computer Fraud and Abuse Act. NSO employees now accuse Facebook of violating their own terms of service and an Israeli privacy law.
Facebook claimed that blocking the accounts is a necessary security precaution to prevent further attacks. In May WhatsApp stated it had fixed vulnerabilities soon after the attack was discovered. The NSO employees said they only filed the suit after they failed to get responses from Facebook. Facebook stated that some of the employees of NSO had their accounts restored after they followed Facebook’s appeal process.
The WhatsApp suit against NSO accuses them of aiding the government of 20 countries, including Bahrain, Mexico, and the United Arab Emirates in hacking. NSO, whose stated purpose is to help governments prevent crime and terrorism, denied that they had any hand in such hacking. The NSO employees’ lawsuit stated that the information Facebook uses to identify them as employees of the company was private. In a statement, the NSO employees said that “the idea that personal data was searched for and used is very disturbing.”
The NSO employees’ lawyer said Facebooks actions in this case were part of a pattern of behavior by the company that Israeli courts had already ruled to be illegal, specifically stating that “[t]he court made it clear, in two separate instances, the prohibition against Facebook’s blocking of user accounts for a violation that is not a material violation or without proof of the agreement’s violation.”
Shiri Dolev, president of NSO, spoke at a conference in Tel Aviv last month, saying “[w]e develop the technology which we sell exclusively to government intelligence agencies” in order to separate the company from the operation of the technology that they create. According to researchers at Citizen Lab at the University of Toronto’s Munk School, NSO’s clients used the vulnerability to target over 1,400 WhatsApp users, some of whom were human rights defenders, lawyers, and activists. WhatsApp stated that some of the 1,400 instances were the result of governments spying on other governments. Previous research has concluded that some of NSO’s technology has been used to hack journalists.
The NSO issued a statement distancing the company from the lawsuit made by its employees.
