NSO Group is complicit, as their technology enabled violations revealed in the Pegasus Project

“This is a dangerous industry that has operated on the edges of legality for too long, and this cannot be allowed to continue” – Agnès Callamard

The vast scale of violations perpetrated through secretive cyber surveillance has exposed a global human rights crisis, Amnesty International warned today, in a new briefing published following the revelations of the Pegasus Project investigation.

The briefing, Uncovering the Iceberg: The Digital Surveillance Crisis Wrought by States and the Private Sector, reveals the devastating impact of the poorly-regulated spyware industry on human rights worldwide.  

Agnès Callamard, Amnesty International’s Secretary General, said:

“In the last few days, the world has rightly been outraged by the systematic targeting of human rights activists, journalists and lawyers revealed by the Pegasus Project.

“Not only does it expose the risk and harm to those individuals unlawfully targeted, but also the extremely destabilising consequences on global human rights and the security of the digital environment at large.

“NSO Group is just one company. This is a dangerous industry that has operated on the edges of legality for too long, and this cannot be allowed to continue.

“Now, we urgently need greater regulation over the cyber surveillance industry, accountability for human rights violations and abuses, and greater oversight over this shadowy industry.”

State and corporate responsibility

For years, Amnesty has warned of the dangers to human rights posed by the  surveillance industry generally, and the specific cases of unlawful targeted surveillance facilitated by NSO Group specifically. 

States have binding obligations under international human rights law to protect human rights from abuse by third parties, including private companies that operate outside their borders. 

According to international legal standards, a company may be complicit in human rights violations if it meets two main criteria: that through its business activities it helped in the commission of the violation, and that the company knew or should have known that its acts would help in furthering the violation. 

It is clear that NSO technology enabled the violations revealed in the Pegasus Project, and especially given that targeting has been found linked to the same countries in which NSO has previously been found, a reasonable person ought to have known the abuses were likely.

Agnès Callamard added: “Private companies like NSO Group have shown they will flout their human rights responsibilities with impunity, all the while profiting from human rights abuse.

“By allowing NSO software to be used without taking adequate steps to protect our rights, states worldwide have allowed an unlawful system to flourish resulting in rampant human rights violations and abuses on a grand scale.

"The fact that world and other political leaders themselves may have come into the spyware technology’s crosshairs will hopefully serve as a long overdue wake-up call for them and states worldwide to step up and regulate this industry.

“If world leaders are being targeted in this way then it further confirms that everyone’s rights, including human rights activists, journalists and lawyers, are at risk.

“Meaningful control of the spyware industry is now urgently needed to stop further violations. All legal steps must be taken to unveil the full extent and nature of NSO complicity in human rights abuses.”

Amnesty is calling for an immediate moratorium on the export, sale, transfer and use of surveillance technology until there is a human rights-compliant regulatory framework in place.

NSO Group is licensed to export Pegasus software by the Israeli Ministry of Defence. Amnesty is calling on the Israeli government to revoke existing export licenses to NSO Group, given the risk its spyware could be used for human rights violations. In addition, NSO Group should immediately shut down clients’ systems where there is credible evidence of misuse.

Amnesty is also calling on NSO Group to publish a human rights compliant Transparency Report that discloses incidents of misuse of their products, destination countries, contracts, and other information necessary to fully investigate the possible occurrence of human rights abuses linked to their business.

Background

The Pegasus Project is a ground-breaking collaboration by more than 80 journalists from 17 media organisations in 10 countries coordinated by Forbidden Stories, with the technical support of Amnesty who conducted cutting-edge forensic tests on mobile phones to identify traces of the spyware.

NSO Group has insisted that Pegasus software is legally used to “collect data from the mobile devices of specific suspected major criminals”. However, our recent investigation has proven that there is parallel use of the tool against civil society that is in clear violation of international human rights law.  

NSO Group’s targeted digital surveillance tool is inherently prone to human rights violations, given its design and the lack of checks in place to ensure its proper deployment. States have wilfully used Pegasus to unlawfully target individuals, completely violating their right to privacy.

Pegasus severely impacts the right to privacy by design: it is surreptitious, particularly intrusive, and has the capacity to collect and deliver an unlimited selection of personal and private data.

NSO Group has not taken adequate action to stop the use of its tools for unlawful targeted surveillance of activists, lawyers and journalists, despite the fact that it either knew, or arguably ought to have known, that this was taking place.

NSO Group said in a series of statements that it “firmly denies… false claims” in the report. It wrote that the consortium’s reporting was based on “wrong assumptions” and “uncorroborated theories”, and reiterated that the company was on a “life-saving mission”. A fuller summary of NSO Group’s response is available here.