The Israeli government exerted strained efforts to thwart a high-stakes US lawsuit that threatened to expose closely guarded details about one of the world’s most infamous hacking tools, The Guardian reported, citing leaked files.

Israeli officials seized documents related to Pegasus spyware from its manufacturer, NSO Group, in an attempt to prevent the company from complying with demands from WhatsApp in a US court to provide information about the invasive technology.

Documents indicate that these seizures were part of an unusual maneuver devised by "Israel" to block the release of information about Pegasus, which the government claimed could cause "serious diplomatic and security damage" to the entity.

How did 'Israel' conceal information from US legal proceedings?

Israeli spyware Pegasus enables NSO clients to infect smartphones with covert software that can extract messages and photos, record calls, and secretly activate microphones. NSO's clients have included both authoritarian regimes and democratic nations, and the technology has been linked to human rights abuses globally.

Since late 2019, NSO has been engaged in a US lawsuit brought by WhatsApp, which states that the Israeli company exploited a vulnerability in the messaging service to target over 1,400 users in 20 countries within a two-week period. NSO has denied these claims.

The removal of files and computers from NSO’s offices in July 2020, previously kept secret by a strict gag order from an Israeli court, sheds new light on the close relationship between "Israel" and NSO, as well as the overlapping interests of the privately owned surveillance firm and the entity’s security establishment.

The July 2020 seizures occurred after Israeli officials and NSO seemingly discussed how to handle WhatsApp’s requests for NSO to disclose internal files about its spyware, raising concerns about possible coordination to conceal information from US legal proceedings.

At one point, NSO’s lawyer, Rod Rosenstein, a former US deputy attorney general under former US President Trump, reportedly asked one of "Israel’s" US lawyers if the Israeli government would "come to the rescue" in the legal conflict with WhatsApp.

Dive deeper

"Israel’s" covert involvement in the case has been uncovered following a joint investigation by a consortium of media organizations led by the Paris-based non-profit Forbidden Stories, which includes The Guardian and some Israeli media outlets. They reportedly obtained a copy of a secret court order related to the 2020 seizure of NSO’s internal files.

Additional details about the seizures and "Israel’s" interactions with NSO concerning the WhatsApp lawsuit have been revealed through a separate set of emails and documents reviewed by The Guardian. These documents originated from a hack of data from "Israel’s Ministry of Justice", acquired by the transparency group Distributed Denial of Secrets and shared with Forbidden Stories.

By combining US court records, information from various sources, and a forensic analysis by Amnesty International’s security lab of some of the files, the consortium has verified key details disclosed in the hacked documents. Amnesty’s researchers noted that while the files appear consistent with a hack-and-leak of several email accounts, the authenticity of the emails cannot be cryptographically verified due to the removal of critical email metadata by the hackers.

'Israel' secures gag order as WhatsApp, NSO clash over confidential files

In April of this year, Israeli authorities secured another extensive gag order to block the country’s media from publishing information related to the hack. The large cache of emails and documents was released online by a group calling itself Anonymous for Justice, though the identity of its members remains unknown.

As the litigation continues in federal court in northern California, details of "Israel’s" covert activities in the WhatsApp case have come to light.

Earlier this month, WhatsApp accused NSO of obstructing its legal obligations to provide internal files during the discovery process. This process is crucial for WhatsApp to gather information and reveal how Pegasus has been used by NSO’s government clients.

Despite this, "Israel’s" hidden intervention has impeded WhatsApp’s efforts to compel NSO to produce essential information. WhatsApp’s lawyers recently informed the US court that NSO has only provided 17 internal documents.

Within months of WhatsApp filing its lawsuit against NSO in October 2019, senior Israeli officials are understood to have closely monitored the case and explored ways to prevent WhatsApp from accessing classified information held by NSO.

Both "Israel" and NSO anticipated that WhatsApp would make broad requests for sensitive internal documents, including customer lists.

As the discovery phase approached in early 2020, NSO considered asking the Israeli government for a “blocking order” to prevent the company from disclosing certain information to WhatsApp. An NSO memo outlining this proposal was shared with "Israel’s Justice Ministry" in April of that year.

NSO’s concerns were confirmed in early June 2020 when WhatsApp issued its initial discovery requests, seeking extensive information about NSO’s activities, customers, and the technological capabilities of Pegasus.

Why it matters?

The leaked emails reviewed by The Guardian suggest that senior Israeli officials met with NSO representatives "to discuss issues related to disclosure" a day after WhatsApp's document production requests were received by the company.

Around this time, NSO and its lawyers from the elite US firm King & Spalding seemed to be seeking "Israel's" assistance in defending against WhatsApp's lawsuit.

After Rosenstein reportedly asked if the Israeli government would "rescue" the company, one of "Israel's" US-based lawyers, John Bellinger, a former senior national security lawyer in the George W. Bush administration and now a partner at Arnold & Porter, apparently informed Rosenstein that "Israel" was "acutely focused on the discovery dangers and is still considering its options."

Three days later, in mid-July 2020, "Israel" made a major but secret intervention. During an urgent meeting with NSO, Israeli officials presented the company with a Tel Aviv court order granting the government authority to execute a search warrant at its office, access its internal computer systems, and seize files.

The court order prohibited NSO from disclosing or transferring any documents or technical materials to “any external person or entity” without Israeli authorities' authorization. The order itself was also kept secret, with a gag order preventing the government's actions from being made public in "Israel".

On this issue, a US lawyer and adjunct professor at Columbia Law School Scott Horton told the Guardian that these were “strange procedures to be taking in relation to a private entity," suggesting NSO was in fact an “integral part of the Israeli defense establishment and they are trying to shield [this] from public discovery."

According to court records and Israeli "Justice Ministry" files, the order obtained by "Israel" included a specific loophole allowing NSO’s lawyers to inform the US court in the WhatsApp case about the seizures and the imposed restrictions prohibiting disclosure.

NSO convinced a US judge to keep information about these developments under seal, ensuring they remained hidden from the public. It is unclear whether NSO disclosed its prior contacts and meetings with Israeli officials to the court before the seizures.

Leaked files indicate that NSO’s lawyers at one point drafted a declaration to inform the US court that the Israeli seizure order was not “announced in advance to, nor expected by” the company, as per the Guardian. However, this statement was ultimately not included in the filed declaration. A spokesperson for King & Spalding confirmed that it "does not appear" in the declaration.

"Israel’s" actions seem to have significantly impacted the case. NSO has stated that various restrictions under Israeli law have limited its ability to participate in discovery.

Earlier this month, WhatsApp’s lawyers informed the court that they had not yet received any documents related to Pegasus and accused NSO of “continued refusal to meaningfully participate in discovery."