A number of international papers report today on the Israeli hacking company NSO which sells snooping software to various regimes. The software is then used to hijack the phones of regime enemies, political competition or obnoxious journalists. All of that was already well known but the story has new legs as several hundreds of people who were spied on can now be named.
How that came to pass is of interest:
The phones appeared on a list of more than 50,000 numbers that are concentrated in countries known to engage in surveillance of their citizens and also known to have been clients of the Israeli firm, NSO Group, a worldwide leader in the growing and largely unregulated private spyware industry, the investigation found.The list does not identify who put the numbers on it, or why, and it is unknown how many of the phones were targeted or surveilled. But forensic analysis of the 37 smartphones shows that many display a tight correlation between time stamps associated with a number on the list and the initiation of surveillance, in some cases as brief as a few seconds.
Forbidden Stories, a Paris-based journalism nonprofit, and Amnesty International, a human rights group, had access to the list and shared it with the news organizations, which did further research and analysis. Amnesty’s Security Lab did the forensic analyses on the smartphones.
The numbers on the list are unattributed, but reporters were able to identify more than 1,000 people spanning more than 50 countries through research and interviews on four continents.
Who might have made such a list and who would give it to Amnesty and Forbidden Stories?
NSO is one of the Israeli companies that is used to monetize the work of the Israel’s military intelligence unit 8200. ‘Former’ members of 8200 move to NSO to produce spy tools which are then sold to foreign governments. The license price is $7 to 8 million per 50 phones to be snooped at. It is a shady but lucrative business for the company and for the state of Israel.
NSO denies the allegations that its software is used for harmful proposes with a lot of bullshittery: