"Lawyer allegedly hacked with spyware names NSO founders in lawsuit", 13 November 2024

A lawyer who was allegedly hacked with government-grade spyware made by the infamous surveillance tech maker NSO Group has filed a complaint in court against two of the company’s founders and one executive. It appears to be the first attempt to hold the people behind a spyware company accountable for hacking crimes, rather than just the company itself. 

... the Barcelona-based human rights nonprofit Iridia announced that it had filed a complaint in a Catalan court earlier this week accusing NSO’s founders Omri Lavie and Shalev Hulio, as well as Yuval Somekh, an executive of two affiliate companies, of hacking crimes. 

Iridia represents lawyer Andreu Van den Eynde, an attorney and university professor who specializes in cybersecurity. According to a 2022 investigation by Citizen Lab, a nonprofit that has been investigating government spyware for more than a decade, Van den Eynde was among the victims of a wide-ranging hacking campaign against at least 65 Catalans linked to the region’s attempts to become independent from Spain, which was carried out using NSO’s Pegasus software. Amnesty International independently confirmed Citizen Lab’s findings. 

Van den Eynde and Iridia filed a lawsuit against NSO in a Barcelona court in 2022. Until this week, the lawsuit named NSO and Osy Technologies and Q Cyber Technologies, two Luxembourg-based affiliates of NSO as defendants. Today, the nonprofit and the lawyer asked the judge presiding over the lawsuit to expand it to include Lavie, Hulio, and Somekh.  

“The people responsible for NSO Group have to explain their concrete activities,” a legal representative for Iridia and Van den Eynde wrote in the complaint, which was written in Catalan. 

...

The complaint alleges that three executives were responsible for “selling illegal software” and participating and cooperating in the illegal use of the software. 

Gil Lainer, vice president of global communications for NSO, told TechCrunch that the company has no comment. 

Shalev did not respond to messages asking for comment. Lavie referred questions to his representative Hedan Orenstein. 

“I understand that the plaintiffs are requesting to include Omri’s name as a defendant. But is there a specific allegation about an act attributed to Omri? They could theoretically ask to include both your name and mine as well,” Orenstein told TechCrunch. 

Van den Eynde told TechCrunch that he is not happy to be a victim because he’d rather focus on his own work and interests in technology. 

Other victims of the alleged hacking campaign have put pressure on the Spanish government to disclose details of the alleged surveillance against them.

...