NSO Group spyware used against Moroccan journalist after company pledged to respect human rights; Inc. Co. comments
A new investigation led by Amnesty International revales that NSO Group, the Israeli company marketing its technology in the fight against COVID-19, contributed to a sustained campaign by the government of Morocco to spy on Moroccan journalist Omar Radi.
According to the rights group, the findings of the latest report are especially significant because Omar Radi was targeted just three days after NSO Group released its human rights policy. These attacks continued after the company became aware of Amnesty International’s first report that provided evidence of the targeted attacks in Morocco. This investigation thus, demonstrates NSO Group’s failure to conduct adequate human rights due diligence and the inefficacy of its own human rights policy.
Amnesty International has called on NSO Group and the private equity owning Novalpina Capital to urgently take pro-active steps to ensure that they do not cause or contribute to human rights abuses, and to respond to any human rights abuses when they do occur. In order to meet that responsibility, NSO Group must carry out adequate human rights due diligence and take steps to ensure that HRDs in Morocco do not continue to become targets of unlawful surveillance.
In response to the report, NSO group expressed being troubled by the allegations and mentioned the company will review the information therein as well as initiate an investigation if warranted.
All components of this story
Author: Amnesty International
"Moroccan Journalist Targeted With Network Injection Attacks Using NSO Group’s Tools", 22nd of June 2020
In October 2019 Amnesty International published a first report on the use of spyware produced by Israeli company NSO Group against Moroccan human rights defenders Maati Monjib and Abdessadak El Bouchattaoui. Through our continued investigation, Amnesty International’s Security Lab identified similar evidence of the targeting of Omar Radi, a prominent activist and journalist from Morocco from January 2019 until the end of January 2020. Evidence gathered through our technical analysis of Omar Radi’s iPhone revealed traces of the same “network injection” attacks we described in our earlier report that were used against Maati Monjib. This provides strong evidence linking these attacks to NSO Group’s tools.These findings are especially significant because Omar Radi was targeted just three days after NSO Group released its human rights policy. These attacks continued after the company became aware of Amnesty International’s first report that provided evidence of the targeted attacks in Morocco. This investigation thus, demonstrates NSO Group’s continued failure to conduct adequate human rights due diligence and the inefficacy of its own human rights policy.
Author: Amnesty Internrational
Appendix I: NSO Group’s Response
“We have received your letter of 9 June 2020, regarding the alleged targeting of a human rights defender by authorities in Morocco using our technology. Due to the confidentiality constraints detailed below, we cannot confirm or deny that such authorities use our technology. We appreciate your bringing this issue to our attention. Consistent with our Human Rights Policy, NSO Group takes seriously its responsibility to respect human rights, and is strongly committed to avoiding causing, contributing to, or being directly linked to negative human rights impacts.
We are deeply troubled by the allegations in your letter, and will immediately review the information therein and initiate an investigation if warranted. While you have provided certain information regarding the alleged misuse, to investigate the issue thoroughly, we need certain details, such as a phone number, the name of the individual, or a MSISDN (Mobile Station International Subscriber Directory Number) as set out in our public Whistleblowing Policy. Absent that information, our inquiries will be substantially constrained. If you would provide some or all of that information, it would greatly facilitate our ability to determine whether our products have been used in a manner inconsistent with our policies, any commercial agreements that may exist, international norms, or applicable domestic laws. In accordance with our policies we shall maintain this information in strict confidence and not divulge it other than as required to conduct a thorough investigation.
Your letter also poses several questions regarding any relationship NSO Group might have with Moroccan authorities, and the actions we undertook following a report by Amnesty International into alleged misuse of NSO's products by those authorities. While we seek to be as transparent as feasible in response to allegations that our products have been misused, because we develop and license to States and State agencies technologies to assist in combatting terrorism, serious crimes, and threats to national security, we are obligated to respect state confidentiality concerns and cannot disclose the identities of customers. However, the attached correspondence with UN Special Rapporteur David Kaye contains a fulsome description of how we address human rights due diligence, measures that we may require in individual customer relationships to mitigate or prevent the risk of human rights impacts, our investigatory steps when we receive allegations of potential misuse, and a range of responses when a misuse is identified. We can assure you that we followed this approach with respect to your previous report, though due to the aforementioned confidentiality constraints we are unable to provide further details.
We do hope you will provide us with further details, as noted above, to allow us to investigate the disconcerting allegations described in your letter.
Chaim Gelfand, Adv. Head of Compliance NSO Group"