Fri 17 May 2019:
WhatsApp’s latest security flaw allegedly allowed governments to spy on dissidents, activists and journalists around the world. An Israeli cyber company is reportedly behind the loophole — and not for the first time. The messaging app WhatsApp identified a security loophole that allowed attackers to install spyware on phones using the app’s regular call function, the Financial Times reported earlier this week. The targeted device owner doesn’t even have to take the call, the report explained, as minutes after the attacker dials “the target phone starts revealing its encrypted content.”
NSO, an Israeli cybersecurity firm, is believed to be behind exploitation of the app. The group has not denied the reports, but said in a statement that it would investigate “any credible allegations of misuse and if necessary, take action, including shutting down the system.” A London-based human rights lawyer brought the case to light after complaining of mysterious WhatsApp calls from Swedish numbers at unusual hours of the night. The man is involved in lawsuits against NSO over the alleged use of its phone-hacking tools to spy on Canada-based Saudi dissident Omar Abdulaziz, a Qatari citizen and a group of Mexican journalists.
Weapons like any others
The abuse of WhatsApp’s loophole is just the latest of many blamed on an Israeli company, prompting the question: How is it that so many private firms from the small Middle Eastern country have managed to become such significant players in the international cyber arena. One answer is that the development of cyber skills is a state priority. Most Israeli cyber security firms recruit former intelligence officers, mainly from a military unit called 8200 — considered the largest in the Israeli Defense Forces. “It’s important to understand that soldiers serving in intelligence units are gaining extremely practical training,” says Amitai Ziv, senior hi-tech editor at the Israeli newspaper TheMarker. “Starting from day one after their training, they are tasked with real systems to break into across the globe.”
NSO in one of numerous Israeli cybersecurity firms started by veterans
Close relations between Israel’s intelligence community and the private tech scene allow army veterans to use invaluable information learned in the military and implement it in independent cybersecurity companies they later run as professionals. Israel sees cybertechnologies as weapons for all intents and purposes, so all such exports — including those from private firms — must be approved individually by the Defense Ministry. But while the ministry is extremely sensitive to security risks to Israel from exports, it seems to show less concern for human rights violations by potential buyers. “It’s strictly business,” claims Ziv. “As long as Israel doesn’t see a potential risk to its own citizens, it’s likely that security authorities don’t regard themselves as the moral compass of the world.” Indeed, private companies appear untroubled by moral qualms. Although NSO maintains that its software is used to prevent terrorist attacks, infiltrate drug cartels and help rescue kidnapped children, traces of its spyware, Pegasus, have been found in countries with dubious human rights records, such as Saudi Arabia and the United Arab Emirates.
News of the WhatsApp breach began to emerge when internet watchdog Citizen Lab reported that Israeli software, allegedly developed by NSO, was used to spy on the inner circle of slain journalist and Saudi dissent Jamal Khashoggi. According to the group’s members, international undercover operatives then started targeting them.
Middle East Frenemies?
The WhatsApp breach has shown that Israeli products may very well end in the hands of regimes that don’t even officially recognize Israel or have any diplomatic relations with it — at least not openly, making the country’s relationship with its seemingly hostile neighbors more financial than ideological. As early as 2010, a company named Logic, owned by Israeli businessman Mati Kochavi, signed a deal with an unknown Gulf state to implement border protection technologies and turn its capital into a “smart city.” Among other things, the system could trace the real-time movement of people throughout the capital.
Although Logic acquired products made by other Israeli companies, its employees oversaw the implementation of the system and trained local law enforcement personnel. This required regular flights between the two countries, which otherwise don’t maintain diplomatic relations. “Turning a capital into a smart city is at least not offensive,” Ziv laughs. “Israel seems to be selling real weapons to real dictatorships. I’m much more worried about that.”
