WhatsApp sues NSO Group for allegedly helping spies hack phones around the world

https://www.reuters.com/article/us-facebook-cyber-whatsapp-nsogroup/whatsapp-sues-israels-nso-for-allegedly-helping-spies-hack-phones-around-the-world-idUSKBN1X82BE

by adventured • 7 years ago

534 239 7 years ago

reuters.com

pesenti• 7 years ago

WaPo Oped https://www.washingtonpost.com/opinions/2019/10/29/why-whats...

teh_klev• 7 years ago

Paywall.

tedivm2• 7 years ago

Just open it in incognito mode to bypass the paywall.

tyingq13• 7 years ago

https://outline.com/8TFYuj

(Put the URL in bitly then submit to outline)

inglor8• 7 years ago

My wife works for NSO, Facebook closed down the personal accounts of anyone working for NSO which is quite the aggressive move. I definitely see things warming up.

tedivm2• 7 years ago

Good. People who work for companies doing immoral things should definitely face repercussions for it.

JumpCrisscross• 7 years ago

Facebook closed down the personal accounts of anyone working for NSO which is quite the aggressive move

I’m sure your wife is a lovely lady. But NSO Group is a hostile intelligence asset. They actively undermine Americans and American security interests, here and abroad.

It’s not only reasonable for American companies to block them and their affiliates, it would also be reasonable for their travel to the country to be restricted (or monitored in the way a known spy would be).

einpoklum4• 7 years ago

There's no real distinction between US intelligence and "hostile" intelligence. They're both hostile to most people in the world, including most US residents and citizens.

So I would say NSO is just another outfit of money-grubbing intelligence-industrial complex SOBs, who happen to be mostly Israelis rather than US citizens.

rndgermandude5• 7 years ago

I’m sure your wife is a lovely lady.

I am not so sure. People who knowingly work for organizations that help plots to torture, murder and dismember journalists are not "lovely". She might not have known about it before, but she does now, and yet she still works for them.

jjoske• 7 years ago

Aren't both Israel and Saudi Arabia are allies of the US?

yyyk3• 7 years ago

They actively undermine Americans and American security interests

NSO can be justifiably blamed for selling to a regime like Saudi Arabia, but it can't be blamed for undermining 'Americans and American security interests' when the American government itself does not see SA's actions as contrary to 'American security interests'.

NSO could at least argue that they did not predict beforehand that SA would go to such lengths - Khashoggi himself did not expect it - but the US obviously knew after the fact. Yet, the US keeps selling weapons to SA and applied no penalty.

We can't expect NSO Group to take a stricter view of 'American security interests' than the US government does.

inglor8• 7 years ago

I think it's funny to say that about a company regulated and controlled by the US intelligence community.

The US is truly great at claiming things are bad while _controlling those things_ at the same time.

For what it's worth _personally_ I believe that NSO is a bad company and US regulation needs to change - but those things need to change together at the same time.

olliej4• 7 years ago

The NSO contributed to the murder of a journalist, has repeatedly aided in attacks on human rights activists, and according to the complaint, actively assisted or even ran these "operations".

Any of those would have been sufficient to ensure I wouldn't work for them for any amount of money, and I'd quit if I found out about them after I was employed.

Honestly, that's blood money.

sacrificedcapon• 7 years ago

Your "morals" precludes anyone from working at any major company. Let alone companies like WashingtonPost who helped start many illegal wars and led to the death of millions of innocent people with their lies.

Using your logic, the murdered journalist took blood money.

https://www.washingtonpost.com/archive/opinions/2003/02/06/i...

If you work for pretty much any major company in the world, you are receiving "blood money". If you are working for the US government or any major government, you are receiving "blood money".

Can you point me to a company that is "without sin"?

flyinglizard2• 7 years ago

Would you work for Lockheed or Boeing?

stefan_• 7 years ago

Aggressive? More like pitiful. This is export controlled technology sold indiscriminately to third world nation states custom tailored by NSO to target and entrap journalists and civilians, many in different locales or conflict zones. Ideally, NSO employees would be in chains In Den Hague charged with the very war crimes they enabled.

notzuck6• 7 years ago

Link to more info about export controls for this kind of technology?

bertil3• 7 years ago

Facebook doesn’t have the ability to prosecute people for War Crimes. They can (and routinely) share information with law enforcement for things that they deem abhorrent (human trafficking, notably of children).

What they can do —like in this case— is to sue in civil court. What they can also do is to kick the people that they are suing away from their platform for violating their terms. It’s actually not rare (several people involved with Cambridge Analytica were locked out of their account) so “aggressive” is a stretch, but that kind of side-show is representative of the internal tone of the discussion.

A friend talked about “their large legal team” and, yes, that’s more to the point. Said legal team has a lot of friends familiar with Den Hague so I wouldn’t be surprised if your wishes become reality.

markdown2• 7 years ago

How does she sleep at night?

pnako3• 7 years ago

Probably the same as anyone working for Chinese, American, Russian, French, Iranian or Egyptian intelligence services.

Many people are patriots and defend their country's interests.

caf• 7 years ago

This is unsurprising, given that one of the remedies they're asking for is:

The lawsuit seeks to have NSO barred from accessing or attempting to access WhatsApp and Facebook’s services...

onetimemanytime4• 7 years ago

>I definitely see things warming up.

I think torched is the right word. As in, NSO will be torched, and having them on your resume is not gonna be a good thing. https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act

lawnchair_larry5• 7 years ago

How does she feel about the whole thing?

inglor8• 7 years ago

People working for NSO believe they are doing good for mankind and helping stop terrorism. I am not buying the shitty nerative but still love her :)

rodgerd• 7 years ago

How does she feel about her employer's role in aiding torturing journalists to death?

inglor8• 7 years ago

She claims they are more regulated then other companies with the tech and like all weapons mistakes can happen. Also that they did not do a lot of the stuff they are blamed for.

I personally don't believe them but she does :)

alasdair_2• 7 years ago

NSO are directly implicated in aiding the Saudis murder a US resident and Washington Post journalist. They knew exactly who they were selling to and how their tools would be used.

NSO are of the same level of people as those who sold cattle prods to Saddam after knowing how their tool would be used.

rndgermandude5• 7 years ago

Your wife should stop working for NSO. Or rather, never even started working for them.

inglor8• 7 years ago

I would not work for NSO myself but I am extremely privileged to have written some popular open source stuff and it's a great market for software.

My wife is in finance, it was this or an abusive boss and constant unpaid overtime.

For what it's worth I think it's the same as working for any weapons producing company (a big no no for me but plenty of people there who are very idiological)

WhatDoIKn0w• 7 years ago

I think this IS probably too aggressive and this move probably would not change anything but make such organization just more hostile towards Facebook and their products. I don’t see them as such a big deal, they are somewhat monitored (might be imperfect) aside from the fact that every intelligence corps (including US) is also attacking civilians, tourists and more - even if not with “bad purpose”, sometimes it might even save lives (if they prevent a terrorist attack or so, using that technology). So why not let other countries have this ability? Obviously if you give someone a weapon it might turn against you but how can you be so sure it won’t help defend the lives of their citizens? Everyone is using this “weapon” the same way, the only question is on what side you’re on. In my opinion, this is not a very destructive weapon that actually risks people’s lives so it’s fair to share, it will also get there one way or another.

keyme2• 7 years ago

That's straight from a Black Mirror episode... Unsurprisingly no one here cares, because NSO bad.

bertil3• 7 years ago

It’s not that rare: breaking terms of services will get your kicked out quite rapidly.

Being a little assertive with your marketing will get you a couple of warnings and temporary bans but systematic efforts, after Facebook sent Cease & Desist letters, etc. will. Being one of the very few able to hack WhatsApp, refusing to submit the generous bug bounties but instead using that to get US journalists killed… that will get you at the top of the naughty list.

I understand that, without details, OC’s wife might be an innocent accountant, someone motivated by good values but misinformed or an active and knowledgeable participant to gruesome abuses. We can agree that Facebook doesn’t know yet. I would understand why once the problem is detected, Facebook might want to take precautions and only revise their individual bans later.

hannob• 7 years ago

"They deleted my social media account just because I assisted in the murder of a human rights activst, how aggressive!"

buboard• 7 years ago

Aw shoot. All they need to do is spy on a few high ranking FB people and blackmail them with their dirty laundry to get their accounts back. A walk in the park for them

notacoward2• 7 years ago

I don't generally condone punishing employees for what their employers do, but this is a company whose whole business centers on unauthorized control of private resources. It's not at all a stretch to suppose that they exert such control over their own employees' accounts, or would consider doing so, making those accounts effectively proxies for the company. It's unfortunate that the employees are caught in the middle, but their inconvenience (this is social media not bank accounts) is outweighed by other concerns.

londons_explore• 7 years ago

Whatsapp still processes complex data from any stranger in the world entirely without a sandbox. It's E2E encryption is like sending and receiving messages with a top security truck, but then on arrival, storing them in a tent.

The fault here really relies on the design of whatsapp. Not the thieves who saw an open door.

tptacek6• 7 years ago

That's... not how culpability works.

darawk• 7 years ago

The fact that you leave your door unlocked doesn't excuse someone burglarizing your house. Facebook and Whatsapp totally deserve blame for lax security here, but that does absolutely nothing to absolve NSO of exploiting that weak security.

olliej4• 7 years ago

Let's look at a house analogy:

* If I leave the door unlocked is someone entering it and taking my property my fault? According to insurance companies it often is, but not the law. Who's side are you on?

* If I've locked the door, but there's a window that doesn't latch properly, is it my fault?

* If my door doesn't have a kick plate, is it my fault for not providing adequate security?

* if they break the windows, is it my fault for not having bars on my windows?

Making software secure is hard, but saying that the existence of any bug instantly means that the software manufacturer is culpable for how someone [ab?]uses those flaws is clearly nonsense. No one wants to deliver software with bugs in it, but NSO is clearly ok using those flaws to attack and kill reporters and HRAs.

saagarjha2• 7 years ago

What kind of sandbox should WhatsApp have used?

olliej4• 7 years ago

A magic one that fixes all security holes of course :)

More seriously: I thought they popped WhatsApp on iOS as well? That would imply sandbox escape there as well - although the default iOS sandbox is more a quarry :)

kd32• 7 years ago

I tend to agree with op. Surely the NSO has blame but the real problem is the hole in WhatsApp and the fact that their security could use serious improvement. They even allow making backups of the unencrypted database to the cloud defeating the whole e2e encryption.

Buge7• 7 years ago

Whatsapp still processes complex data from any stranger in the world entirely without a sandbox.

Isn't that also the case with every phone and desktop email client?

ahbyb• 7 years ago

I wonder if this will create a precedent?

Jerry2• 7 years ago

Where's the DoJ in all of this? Why aren't they filing criminal charges against the NSO?

AndrewBissell• 7 years ago

Probably for the same reason the Trump admin whitewashed the Khashoggi murder.

tw044• 7 years ago

See: Jared Kushner

tptacek6• 7 years ago

Is there some relationship between NSO Group and Jared Kushner? I don't see any connection other than that Kushner notoriously is a user of WhatsApp.

anon007• 7 years ago

Why is the moderator censoring "Israel" out of the title of the original article?

"WhatsApp sues Israel's NSO for allegedly helping spies hack phones around the world"

enjoyyourlife• 7 years ago

Because it's a company, not a country. It's like referring to Google as "America's Google."

Also, the article has nothing to do with Israel besides the company being located there. Don't try to politicize everything.

tyingq13• 7 years ago

It does take a lot of context out. I know what Google is. No idea what "NSO" is.

markdown2• 7 years ago

Typical double standards. See any post on HN (or anywhere else in the western media) about any chinese company.

Barrin92• 7 years ago

Given how strongly the Israelian security sector is tied to its national government, including directly recruiting from the military and often acting on its behalf the distinction is quite ridiculous.

Would HN have censored "China's Huawei?" Obviously not, it's the typical bias concerning western governments and allies that seems to be getting more blunt as time goes on the website.

fortran773• 7 years ago

It's owned by European private equity fund Novalpina Capital. Not really an Israeli company.

bmarquez• 7 years ago

Without clarification it's unclear exactly what NSO stands for. If Google was relatively unknown, it probably would be referred to "America's Google."

Also, NSO's founders were members of the Israeli Intelligence Corp (source: Wikipedia). Given the military links it would be reasonable to include its origin. News outlets would likely do the same for a Chinese company.

yak0• 7 years ago

double standards. obviously it is an Israeli-led company

onetimemanytime4• 7 years ago

Ummmm...Israel Govt allows them to export these tools. So yeah. The Israeli probably gets something in return from countries, in addition to NSO getting paid.

irkekb• 7 years ago

I wonder if the same censoring would happen if it’s a Russian or Chinese company?

dang8• 7 years ago

Well, let's see:

https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que...

I don't see any reason to have a policy about this one way or the other, but in most cases there's no need to say which country a well-known company is from. There are a couple instances of "China's Huawei" from over a year ago, but that's negligible compared to the number of headlines about Huawei overall.

cbluth• 7 years ago

Because it's not hard to find out that the NSO Group is from Israel, eg googling.

lucasmullens• 7 years ago

To give the benefit of the doubt, this is the longest title on the HN homepage, even without "Israel". Perhaps it was just to shorten it?

dang8• 7 years ago

The article title is "WhatsApp sues Israel's NSO for allegedly helping spies hack phones around the world", which exceeds HN's 80 char limit, so it had to be shortened somehow. The submitted title was "WhatsApp sues Israel's NSO for allegedly helping hack phones around the world". I changed that to "WhatsApp sues NSO for allegedly helping spies hack phones around the world" because it seemed to me that the "spies" bit adds more information than the "Israel's" bit. There's a difference between "helping hack" and "helping spies hack".

For completeness, I do think the commenters pointing out a slightly nonstandard weirdness in the phrase "Israel's NSO"—like the one comparing to "America's Google"—have a fair point. (Exercise for the curious: have there ever been many titles like that?) But it was not the determining factor.

quickthrower2• 7 years ago

Until I read the article, I assumed "NSO" would be a US government three letter agency. But hard to convey it is a company too in 80 chars I guess.

pnako3• 7 years ago

Exercise for the curious: have there ever been many titles like that?

I found a few "China's Huawei", "China's Tencent" and "China's Baidu".

rimliu• 7 years ago

So it could as well be "WhatsApp sues Israel's NSO for allegedly helping spies hack phones".

notacoward2• 7 years ago

NSO founders' ties to the Israeli government are a bit more essential to their business than the Google example. See also the China examples from another commenter. I'll bet there are examples of "Russian company XYZ" as well. In cases like these, the nationality of the company and especially of its former-unit-8200 founders does seem rather germane.

kylecazar• 7 years ago

Once I clicked through to see "Israel's", it immediately clarified who they were, at least to me -- in fact I recently watched an entire 60 Minutes segment about them.

Just NSO sounds like some government agency I had forgotten about.

____a2• 7 years ago

I saw this article earlier wanted to read comments on it here. It had already been posted five or six times, but never made it to the front page. Glad it finally did as it should. But what a weird dynamic.

jb_s• 7 years ago

is there a HN discord or something?

downandout2• 7 years ago

It wouldn't surprise me, even if it were not officially sanctioned. Perhaps this is just the human desire to find patterns in everything, but I have seen at least some evidence of coordinated up/downvoting that pushes specific agendas on here. The unending GDPR fanboyism is one example. It's either the worst case of groupthink I have ever seen, or people are coordinating.

0xADEADBEE• 7 years ago

There's a semi-secret, invite-only, HN Slack channel.

[Edit: I don't think I mean channel but the terminology for what I'm saying eludes me]

dang8• 7 years ago

That's not uncommon. The easiest explanation is the simplest: randomness.

walrus01• 7 years ago

"The Canadian researchers who reported that Israeli software was used to spy on Washington Post journalist Jamal Khashoggi's inner circle before his gruesome death are being targeted in turn by international undercover operatives, The Associated Press has found."

https://www.cbc.ca/news/technology/citizen-lab-toronto-under...

wavefunction• 7 years ago

This twitter user claims an identity for one of the spies that were targeting Citizen Lab: https://twitter.com/bibken/status/1089991510203027457

Found this tweet by reverse image searching and looking a few pages down in the results.

Buge7• 7 years ago

There have been a number of articles mentioning that same guy. Apparently he's an employee of Black Cube.

https://www.nytimes.com/2019/01/28/world/black-cube-nso-citi...

jammygit• 7 years ago

Twice in the past two months, men masquerading as socially conscious investors have lured members of the Citizen Lab internet watchdog group to meetings at luxury hotels to quiz them for hours about their work exposing Israeli surveillance and the details of their personal lives. In both cases, the researchers believe they were secretly recorded.

Apparently Canada has a digital rights advocacy group that is being intimidated through these meetings?

On the plus side, now we know their group exists. Hope they get some more funding now!

RaiseProfits• 7 years ago

What are you referring to?

matheusmoreira3• 7 years ago

The truth is that strongly encrypted platforms are often used by pedophile rings, drug kingpins, and terrorists to shield their criminal activity.
Without sophisticated technologies, the law enforcement agencies meant to keep us all safe face insurmountable hurdles.
NSO's technologies provide proportionate, lawful solutions to this issue.

Funny how the same technologies meant to protect children are also being used to intimidate researchers and kill dissidents and journalists. Nobody could possibly have foreseen this!

dandare• 7 years ago

Let's not forget, totalitarian governments are way, way more dangerous for its citizens than any kind of criminals.

dathinab• 7 years ago

Also funny that it's not so hard to find pedophile material, drugs and people associated with terrorism _outside of the strong encrypted platforms_.

tomp• 7 years ago

Funny how most of those could easily be eliminated by other means... drug kingpins by legalizing drugs, and terrorists (to a large extent) by stronger KYC requirements (which are already being implemented). But, of course, those measures don't provide ability to spy on your political opponents and dissidents / journalists.

mmjaa• 7 years ago

This shouldn't be such a big surprise to those who inform themselves about the war business and its criminal usurpation of democracy in the West.

The same legal machinations that are used to suppress free speech in the West, especially regarding Western military failures, are also being used to suppress reporting on Julian Assange's torture in Bellmarsh today.

We have well and truly slipped.

secfirstmd• 7 years ago

Yes, kudos to Citizen Lab and Raphael Satter for detecting this and exposing it publicly. I've seen many attacks like this by corporate intelligence targeting activists over the years and the extent that they will go to are very concerning. Moreover they seem to be increasing. Bugging, physical surveillance, digital surveillance, placing someone inside, turning someone inside, private/public smear campaigns etc - the list goes on. We see it all the time but for obvious reasons having public examples that we can reference when training or investigating others is really useful.

____a2• 7 years ago

An incredible quote: "Defendants subsequently complained that WhatsApp had closed the vulnerability. Specifically, NSO Employee 1 stated, “You just closed our biggest remote for cellular ... It’s on the news all over the world.”"

chmod775• 7 years ago

What are you quoting? That sentence doesn't appear in the article.

tptacek6• 7 years ago

They're quoting the actual civil complaint.

TheHypnotist2• 7 years ago

Someone posted the .pdf above, it's in there.

rushikesh98• 7 years ago

Source?

TheHypnotist2• 7 years ago

https://regmedia.co.uk/2019/10/29/ngogrouplawsuit.pdf

Arbalest• 7 years ago

Found in https://regmedia.co.uk/2019/10/29/ngogrouplawsuit.pdf

StavrosK• 7 years ago

Holy fuck these people

matheusmoreira3• 7 years ago

Won't someone think of the malware company? How are they suppposed to sell their services to oppressive governments if WhatsApp keeps patching all the vulnerabilities they depend on?

nurettin• 7 years ago

irony is always lost when one massive surveillance company takes the bread away from a massive surveillance government agency.

nostromo• 7 years ago

This is the same company (NSO) that helped the Saudis brutally murder and dismember a journalist.

https://www.nytimes.com/2018/12/02/world/middleeast/saudi-kh...

gnode2• 7 years ago

I find it interesting that NSO, an Israeli surveillance technology company, was allowed to have such dealings with Saudi Arabia. Their statement that "the sole purpose of NSO is to provide technology to licensed government intelligence and law enforcement agencies [...]" implies that their technology is subject to export controls.

My understanding is that Saudi Arabia has poor diplomatic relations with Israel.

hassancf• 7 years ago

Sorry to say this but your understanding on Israel - Saudi relations is poor: they are excellent. I don’t blame you since the media usually carry that narrative.

Anyone who can protect the rulers from the people is in excellent terms with the rulers. The rest is just posturing.

nradov• 7 years ago

It's complicated. Officially Saudi Arabia has no diplomatic relations with Israel and considers them as illegal occupiers in Palestine. But that's just for PR purposes in the Arab Muslim world. However behind the scenes they frequently cooperate and share intelligence on matters of mutual interest.

einpoklum4• 7 years ago

Your understanding is wrong. Saudi Arabia has great relations with Israel - they're just not being officially flaunted that much. In fact, not only is Israel's politicians and state apparatus acting in synch with Saudi positions and interests, but even the media and academia are awash with pundits and so-called experts which are essentially parroting the skewed Saudi outlook: Demonization of Iran, presentation of almost every conflict in the region as Shiites vs Sunni, suppression of criticism of US/Saudi-supported regimes and strong men, ignoring the government's active support of Islamic fundamentalists etc.

kd32• 7 years ago

Woooow. Im almost speechless. Unprecedented indeed. I never would have expected this from zuckerberg.

einpoklum4• 7 years ago

Hmph... pot calling the kettle black.

Facebook (which owns WhatsApp) engages in mass surveillance / info gathering / spying on its users. It does so on behalf of its paying clients (= not the users); and also on behalf of the US government: The NSA gets a copy of most of everything (as we know due following Snowden's revelations).

So, Facebook definitely intrudes on people privacy, even if it doesn't "hack phones".

Still, I wish _both_ companies had to face harsh consequences for their conduct.

tw044• 7 years ago

Facebook has been selling information about journalists to governments who intend to assassinate said journalists? Do you have a source for that claim?

Otherwise equating the two is ridiculous.

einpoklum4• 7 years ago

Facebook has been giving out information for free, about all people, including anyone the US intends to assassinate, to the US government.

Whether the US government was actually intending to assassinate any of Facebook's users - I have no idea; I don't have access to the assassination lists the president signs.

jrochkind1• 7 years ago

Sued them under what law/legal theory?

Wait... is it CFAA? That would be... an interesting door to open!

Found the complaint, yep!

Plaintiffs bring this action for injunctive relief and damages pursuant to the Computer Fraud and Abuse Act, 18 U.S.C. § 1030, and the California Comprehensive Computer Data Access and Fraud Act, California Penal Code § 502, and for breach of contract and trespass to chattels.

I like the idea of using the CFAA like this, of that becoming a thing.

Had to find the complaint cause none of the articles I could find on it mentioned the CFAA, which is weird since that's news.

tptacek6• 7 years ago

Civil CFAA (unauthorized access to WhatsApp infrastructure, including their relay servers, to target WhatsApp users), California's Computer Data Access & Fraud act (same, but CCDAF also has kickers like specific liability for spreading malware), breach (WhatsApp has a EULA), and trespass to chattels.

(sorry, wrote this before you fleshed out your comment, but presumably it's helpful to someone else)

MikeGale2• 7 years ago

The architecture of the system is important here too.

1. Do the regimes buy the software and set it up themselves, or does NSO set it up and they use the service provided?

2. If the former is there a route to go for Saudi, Mexican, UAE, Bahraini... governments?

---

tptacek6• 7 years ago

You are explicitly (and, if you read Dan's moderator comments, repeatedly) asked not to conduct public hunts for astroturf comments on HN threads. If you think you've seen a pattern of corrupt comments, tell hn@ycombinator.com directly.

MikeGale2• 7 years ago

Thanks, I haven't noticed any of those comments. I'll mull that over.

lawnchair_larry5• 7 years ago

The Citizenlab report will probably answer most of your questions about this.

https://citizenlab.ca/2019/10/nso-q-cyber-technologies-100-n...

comex2• 7 years ago

Link to the actual complaint (PDF):

https://assets.documentcloud.org/documents/6532395/WhatsApp-...

Always annoys me when news reports leave that out.

Edit: IANAL, but quick take: WhatsApp might succeed, but their case would be much stronger if they had one or more of the victims as co-plaintiffs. As it is:

- Their CFAA claim can only cover unauthorized access to WhatsApp’s servers – but NSO didn’t hack those servers; the servers just fulfilled their normal job of acting as a relay for WhatsApp messages, except in this case the messages were designed to exploit other clients. A victim would be able to sue over unauthorized access to their phone itself. (WhatsApp does also have the terms-of-service complaint though.)

- WhatsApp can only seek damages for reputational harm the hacks caused to the company itself - not any kind of harm to the victims. However, they’re also seeking an injunction preventing NSO from continuing to exploit WhatsApp, which might be more interesting than damages if they can get it.

onetimemanytime4• 7 years ago

Not a lawyer either but CFAA has been used for more than plain hacking. WhatsApp servers and infrastructure was used to hack WhatsApp users. Clearly they violated the spirit of the law, it's fraud at least.

sterlind• 7 years ago

Their CFAA claim can only cover unauthorized access to WhatsApp’s servers – but NSO didn’t hack those servers; the servers just fulfilled their normal job of acting as a relay for WhatsApp messages,

By that logic a website provider wouldn't have standing if they suffered an XSS attack (though any affected users would), which is interesting.

IANAL, but it looks like the CFAA defines offenses in terms of the "protected computer" that was accessed - for instance, unauthorized access to that computer, or stealing information from that computer, or damages that computer.

That seems weird, but the alternative would be weirder: if every computer in the chain were a violation, the ISP for each hop of the network connection would have standing together. It's hard to make a case that WhatsApp is different from a regular router which might also pass malicious messages.

meowface3• 7 years ago

That's debatable. Also, it depends if it's persistent, reflected, or DOM-based XSS. Persistent XSS would be more likely to be considered an attack against the server/application, though I could see the counterargument as well. Reflected could go either way, and DOM-based would be the least likely to be considered a server attack.

snagglegaggle• 7 years ago

Their CFAA claim can only cover unauthorized access to WhatsApp’s servers – but NSO didn’t hack those servers;

Walking into an unlocked building is still breaking and entering. This is why people are tried for recording information but technically accessible but unauthorized-for-access pages.

comex2• 7 years ago

Walking into an unlocked building is still breaking and entering.

Yes, if you weren't authorized to be in the building. But this is more like... walking into an open store and then punching another customer. You didn't exceed your access to the store; you just used your authorized access to do something the store owner wouldn't want you to do (and which constitutes a crime and a tort against someone else). That's not trespassing. However, if the store owner noticed, they could then tell you to leave, at which point remaining in the store would be trespassing.

Does the same apply to the CFAA? Well, it's not entirely clear. There's been a spate of precedents in the last decade, the most recent from just last month, and, well... they're a bit of a mess, including a circuit split which will have to be resolved by the Supreme Court eventually [2], and even within the Ninth Circuit, a "zigzagg[ing]" series of decisions [1] with ambiguous dividing lines.

In particular, unlike in the store analogy, NSO had to agree to a ToS before using WhatsApp, which NSO then violated. That definitely gives WhatsApp a claim for breach of contract. But do actions that violate a ToS also automatically "exceed authorized access" and give WhatsApp a CFAA claim? Not according to Ninth Circuit precedent, but potentially yes according to other circuits' precedents.

That said, many of those precedents turned on the question of whether it makes sense to apply a "hacking" statute to something that's clearly not hacking. In this case, there undoubtedly is hacking involved, and the court may not draw as fine distinctions as I have regarding what exactly was being hacked.

By the way, like in the store analogy, WhatsApp could notify NSO that they're banned from accessing their service altogether, and ignoring that would result in a CFAA violation according to Ninth Circuit precedent. And indeed it seems that WhatsApp has banned NSO now. But they apparently didn't do so prior to the conduct the lawsuit complains about, so that isn't a factor in this case.

[1] (about Ninth Circuit precedent) https://reason.com/2019/09/09/scraping-a-public-website-does...

[2] (about circuit split) https://technology.findlaw.com/modern-law-practice/circuit-s...

Buge7• 7 years ago

WhatsApp sues NSO Group for allegedly helping spies hack phones around the world

Related Stories