NSO threatens legal action against Calcalist over ‘sensationalist’ spyware report

Israeli surveillance company NSO Group sent a letter to the Calcalist newspaper on Thursday threatening legal action over a report claiming NSO allows clients to hide evidence they used its spyware.

The company said Calcalist has published “sensationalist” claims without providing any evidence to back them up, but did not explicitly deny the allegations, according to Hebrew media reports.

The letter appeared to be threatening action in response to a Tuesday report by Calcalist that said NSO Group allows clients to hide their footprints when using its technology, which could undermine investigations into its use. Previous reports have largely alleged wrongdoing by police using NSO’s technology, not illegality by the company itself.

The company has been embroiled in controversy for weeks over Calcalist’s reports, which have alleged unsupervised use of spyware against Israeli civilians by law enforcement. The reports have spurred a state investigation and statements of concern from lawmakers, including Prime Minister Naftali Bennett.

Police have continuously denied any wrongdoing.

Calcalist on Monday published specific, but unsourced, allegations of hacking against 26 targets by police. The bombshell report said NSO Group’s Pegasus program was deployed against senior government officials, mayors, activist leaders, journalists and former prime minister Benjamin Netanyahu’s family members and advisers, all without judicial authority or oversight.

In response to Thursday’s report, NSO wrote to Calcalist that the relevant systems “include full documentation of the actions performed in them,” and that the records are kept for legal purposes and to prevent tampering with evidence. It further denied the newspaper report’s claim that it had sold client software that does not include the documentation feature or only in a limited way.

Calcalist published an interview with an unnamed source “with very close knowledge” of the architecture of NSO’s Pegasus spyware, who claimed that the company’s tech can be configured to not create data logs of everything the spyware does. According to Calcalist, without the data logs, a complete investigation of who was targeted with the spyware and what data was gleaned is not possible.

Calcalist had explained that the spyware is designed to create data logs for legal purposes and to enable NSO Group, if necessary, to verify that the software is not being misused.

However, the source told the newspaper that deniability is built into the architecture of the spyware, as clients had requested the feature for various reasons, including the possible exposure of sources or targets if the information was demanded by a court, or a change in a regime in their countries that would then use the records for other purposes.

Police have insisted that any use of spyware to access phones was done under strict adherence to court orders, denying media reports of widespread abuse of their powers to spy on innocent citizens without court oversight.

After the allegations of spying against 26 individuals, police said an internal probe found that only three of them had been targeted, only one successfully, and all with judicial oversight. The police report was delivered to Bennett.

Police Commissioner Kobi Shabtai and police officers involved in using the spyware have insisted that their actions were legal and supervised.

The internal investigation ordered by Shabtai has so far found “no evidence of breaking the law.”

Publicly addressing the scandal for the first time on Wednesday, former police chief Roni Alsheich, who was in office between 2015-2018 when some of the alleged spying took place, denied any police wrongdoing under his watch, saying the allegations had “no connection to reality.”

NSO’s Pegasus has made headlines due to its alleged use by countries around the world, in many as an undemocratic means to spy on dissidents and quash opposition.