Privacy experts slam police ‘abuse of power’ in alleged use of spyware on civilians
Researchers say revelations that police deployed NSO cyberweapon expose an organization in urgent need of oversight
Ricky Ben-David is a Times of Israel editor and reporter
The latest revelations alleging that the Israel Police used a notorious, powerful cyberweapon made by Israeli company NSO against civilians, politicians, and activists without proper legal oversight expose an organization that has a habit of overreaching and believes it is above reproach, privacy experts told The Times of Israel this week, adding that this approach has no place in a democratic country.
The police and the Israeli security services already have partial access to civilians’ cellular data through telecommunication companies, said Dr. Michael Dahan, a political scientist and senior lecturer at the departments of Communication and Public Policy and Administration at Sapir College.
“Every license issued to a telecommunications provider stipulates in a secret addendum that they have to cooperate fully with the security forces in Israel –every telecommunications service, domestic or foreign. So the police and the security services already have the back door open permanently by law. This access usually goes through some judicial process, but it’s not the most vigorous, let’s say,” Dahan told The Times of Israel this week.
But since NSO’s tools “provide a colonoscopy of anyone’s digital footprint,” the fact that the police were able to use this technology with “a complete lack of any kind of judicial review, even minor,” is striking, said Dahan.
NSO’s spyware is considered one of the most powerful cyber-surveillance tools available on the market, giving operators the ability to effectively take full control of a target’s phone, download all data from the device, or activate its camera or microphone without the user knowing.
The company has been involved in countless scandals in recent years and has faced a torrent of international criticism over allegations it helps governments, including dictatorships and authoritarian regimes, spy on dissidents and rights activists. In November, the US Department of Commerce blacklisted NSO Group, adding it to the list of foreign companies that engage in malicious cyber activities.
On Tuesday, an explosive report in the Calcalist business news outlet said police have for years been making widespread use of the spyware against Israeli civilians, including people not suspected of any crimes, exploiting a legal loophole and keeping the surveillance under tight secrecy without oversight by a court or a judge.
The Calcalist report — which cited no current or former officials from the government, police or NSO corroborating the claims — referred to eight alleged examples of the police’s secretive signal intelligence unit employing Pegasus to surveil Israeli citizens, including hacking phones of a murder suspect, opponents of the Jerusalem Pride Parade, and protesters opposed to former prime minister Benjamin Netanyahu. The report said all this was done with an okay from senior police officers.
The report sent shockwaves throughout Israel with the state comptroller vowing to probe the matter.
The police denied some of the allegations, saying they operate according to the law, though they did not deny using the spyware.
Israel’s justice minister, Gideon Sa’ar, said at a parliamentary hearing that there was an “unbridgeable gap” between the newspaper report and the police statements, and that the attorney general was also investigating the claims raised in the article.
Sa’ar said the Justice Ministry was not aware of any instances of surveillance without court authorization, but said it was important that the matter was under independent investigation by the country’s State Comptroller.
Dahan, who also serves as a digital security consultant, said the police response was “pathetic” and “exposes a really bad organizational culture.”
“They seem to have no concept of what a police force in a democratic country means. Their underlying message seemed to be: ‘We’re fine, we don’t need to provide any answers here, why are you bothering us with this,'” said Dahan.
Jonathan Klinger, an attorney and legal counsel for the Israeli Digital Rights Movement, told The Times of Israel that the fact that the use of NSO’s spyware was sanctioned without proper authority is the main concern, and it exposes very real issues with police supervision.
Abuse of power is already “a common phenomenon in the Israel Police,” said Klinger, pointing to a recent investigation conducted by the Digital Rights Movement into internal police conduct reviews that he said showed about 20 percent of cases related to data abuse. The probe revealed grave incidents in which officers used data and access to data to promote personal interests like buying property or in divorce proceedings, he said.
Klinger said that over the past 10 years, the Israel Police has used a host of tech tools to gain access to citizens’ computers or phones, including capabilities developed by Israeli digital forensics company Cellebrite, which is claimed to be able to unlock almost any phone or digital device.
“But to use Cellebrite’s technology, the police force has to have access to the actual physical phone. Meaning the suspect comes, they arrest him, they tell him ‘please hand in your phone, here is the warrant, we want to search it.’ And even if he doesn’t give the password, they can connect physically to the device and do the search,” he said, noting that this entails a legal process. But with the use of NSO, the problem is the clandestine practice, Klinger said.
The police essentially have three ways of obtaining a person’s data under current legislation, Klinger said.
“First is a wiretap, which gives the police permission to trace phone calls and a copy of messages while they are sent, meaning not stored data. The second is the metadata, meaning they can get a copy of who I sent messages to, when I sent them, but not the subject line or the content. And they can also get my location data. Both of these are done with a warrant under judicial review. The third one is a search-and-seizure warrant that allows them to search my phone, but it has to be narrowly tailored, it has to say what I am suspected of, what materials should be searched and what can be used or not used with the data.”
Spyware like NSO’s and others like it “gives the police full access to my data — they can open my camera, they can make calls on my behalf, they can delete my messages or modify them, they can send messages on my behalf, so it would require some legal juggling to authorize this,” Klinger said, certain that the police would not have sought the appropriate legal channels.
The police force is currently embroiled in another overreach case, he noted, in which an institutional appeal was filed against the organization for “using traffic cameras to set up a new database that tracks everyone’s location at all times, based on car license plates, and this was also done without any legislation or legal authority. The police claimed this comes from their general authority to protect us from crimes.”
“So, the way they do business is ‘do first, ask questions later,’ especially given that over the past three years, having any [new] legislation in Israel would have been impossible,” Klinger said, in reference to Israel’s political stalemate and four rounds of national elections since early 2020.
Dr. Tehilla Shwartz Altshuler, a digital privacy expert and the director of the Israel Democracy Institute’s Democracy in the Information Age Program, said that if indeed the police used NSO’s spyware to track civilians, such usage violates Israelis’ basic right to privacy.
“These revelations should send shockwaves through the police. For the police commissioner to authorize the use of technology in situations that are clearly illegal, left unchallenged by the entire internal chain of command, constitutes a huge failure,” she said in a statement sent to The Times of Israel.
Israel’s current privacy laws are not equipped “to cope with today’s reality” and need reforms. “Israel needs legislation that is applied transparently and is subject to clear oversight from the legislative branch, as well as from the public as a whole,” she said.
Dahan noted that technological abilities have grown “so much faster than the public’s ability to comprehend the degree of invasion of privacy, certainly in Israel.”
But “there is no democracy without privacy, period,” said Dahan. “What should be happening is that everyone who was involved should resign. I would like to see people take responsibility. We need accountability. But that’s not going to happen.”
Klinger, for his part, believes that the police, as an organization, should be scrapped.
“The Israel Police as set up is corrupt from the ground up and it should be replaced with a new entity, a more distributed entity with less power and with better connections to the community. Having smaller police forces, similar to the US where they have sheriff’s departments, would be better than having a central authority,” he said.
Times of Israel staff and AP contributed to this report.
