NSO Group, an Israeli spyware firm known for its flagship product Pegasus, is attempting to gain insights into "how Citizen Lab conducted its analysis" through a lawsuit related to the WhatsApp exploit, The Intercept reported on Tuesday.

For years, cybersecurity researchers at Citizen Lab have been closely monitoring NSO Group, which has been blacklisted by the US government due to its sale of spyware for countries to surveil their citizens. In 2019, Citizen Lab reported discovering numerous instances where Pegasus was utilized to target the smartphones of journalists and human rights activists through a security vulnerability in WhatsApp.

This lawsuit, initiated in US federal court in 2019 by WhatsApp and Meta (formerly Facebook), said that NSO distributed Pegasus and other malware to roughly 1,400 devices worldwide. Despite ongoing efforts by NSO, the case has persistently withstood attempts for dismissal for over four years.

Citizen Lab stands firm: Refuses to share Pegasus investigation data with NSO

As the lawsuit progresses, NSO has adopted a new strategy: Repeatedly demanding that Citizen Lab, based in Canada, hand over all documents related to its Pegasus investigation. However, a judge recently rejected NSO's latest attempt to access Citizen Lab's materials.

Citizen Lab's lawyers argued against providing raw work to NSO, stating that it could expose individuals already targeted by NSO to further harassment, including from their own governments, and could hinder their future work. NSO has declined to comment on the lawsuit, as per the report.

In recent years, NSO has launched an aggressive campaign to improve its reputation, particularly after being blacklisted in 2021. Last November, following October 7, the company requested a meeting with the State Department to discuss Pegasus as a "critical tool" in the ongoing fight against terrorism.

NSO has encountered additional legal challenges in US courts related to Pegasus, including ongoing cases initiated by Salvadoran journalists, Apple, and Hanan Elatr Khashoggi, the widow of slain journalist Jamal Khashoggi. These lawsuits draw upon research conducted by Citizen Lab to varying extents.

The WhatsApp lawsuit, which NSO recently characterized as a potential "show trial," has not progressed favorably for the spyware company thus far. Initially, NSO contended that it was entirely immune from lawsuits in American courts, an argument dismissed by a federal appeals court in 2021, and subsequently declined by the US Supreme Court in early 2023.

Subsequently, NSO argued that the lawsuit should have been filed in "Israel" rather than in the US District Court for the Northern District of California, where both WhatsApp and Meta (the parent company of WhatsApp) are headquartered. However, Judge Phyllis Hamilton rejected this argument as well.

The big picture

Earlier this year, Hamilton dealt a significant blow to NSO by ordering the company to disclose not only its software code for Pegasus, but also any NSO spyware aimed at or using WhatsApp servers to access target devices.

During the discovery process, NSO acquired numerous documents from Meta and WhatsApp regarding Citizen Lab's investigation into Pegasus. Despite this, NSO has attempted and failed twice to extract additional information directly from Citizen Lab, situated at the University of Toronto. In March, Hamilton rejected NSO's initial request to send a cross-border demand, known as a "letter rogatory," to her counterparts at the Ontario Superior Court of Justice.

NSO made a second attempt last month, arguing that the evidence provided by the plaintiffs about Citizen Lab's investigation was insufficient, as it did not reveal the methodology or basis for its conclusions regarding Pegasus targeting individuals in civil society rather than criminals or terrorists.

Citizen Lab strongly objected to NSO's requests, citing the company's hostile stance towards its research efforts.

In her latest ruling, Judge Hamilton deemed NSO's demand as excessively broad. While she left open the possibility for NSO to make another attempt, she stipulated that this would only be considered if NSO could provide evidence that specific individuals identified by Citizen Lab as "civil society" targets were engaged in criminal or terrorist activities.

“We are pleased the court has recognized that NSO Group’s request for information was overbroad and not necessary at this time to resolve the disputed issues,” Citizen Lab’s director, Ronald Deibert, said as quoted by The Intercept.

Read more: Israeli Pegasus, among others, puts media freedom in EU at climax risk