Apple files lawsuit against NSO Group, saying U.S. citizens were targets

By Stephen Nellis

Nov 23 (Reuters) - Apple Inc (AAPL) said on Tuesday it has filed a lawsuit against Israeli cyber firm NSO Group and its parent company OSY Technologies for alleged surveillance and targeting of U.S. Apple (AAPL) users with its Pegasus spyware.

The iPhone maker said it is also seeking to ban NSO Group from using any Apple (AAPL) software, services or devices to prevent further abuse.

Apple (AAPL) is the latest in a string of companies and governments to come after NSO, the maker of the Pegasus hacking tool that watchdog groups say targeted human rights workers and journalists. Earlier this month, U.S. officials placed the company on a trade blacklist. NSO has also faced either legal action or criticism from Microsoft Corp (MSFT), Meta Platforms Inc (FB), Alphabet Inc (GOOG) and Cisco Systems Inc (CSCO) .

NSO is allegedly involved in circumventing security for products made by these companies and selling that circumvention in the form of hacking tools to foreign governments.

In a statement, NSO, which says it sells its tools only to governments and law enforcement agencies and has safeguards in place to prevent misuse, said that "thousands of lives" have been saved through the use of its tools.

"Pedophiles and terrorists can freely operate in technological safe-havens, and we provide governments the lawful tools to fight it. NSO Group will continue to advocate for the truth," a spokesperson said in a statement.

In its complaint filed in U.S. District Court for the Northern District of California, Apple (AAPL) said NSO's tools were used in "concerted efforts in 2021 to target and attack Apple (AAPL) customers" and that "U.S. citizens have been surveilled by NSO's spyware on mobile devices that can and do cross international borders."

Apple (AAPL) alleged that NSO Group created more than 100 fake Apple ID user credentials to carry out its attacks. Apple (AAPL) said that its servers were not hacked, but that NSO misused and manipulated the servers to deliver the attacks on Apple (AAPL) users.

Apple (AAPL) also alleged that NSO Group was directly involved in providing consulting services for the attacks, which is noteworthy because NSO has maintained that it sells its tools to clients.

"Defendants force Apple (AAPL) to engage in a continual arms race: Even as Apple (AAPL) develops solutions and enhances the security of its devices, Defendants are constantly updating their malware and exploits to overcome Apple's (AAPL) own security upgrades," Apple (AAPL) said.

Apple (AAPL) said it has so far seen no evidence of NSO's tools being used against Apple (AAPL) devices using iOS 15, the latest version of its mobile operating system.

The iPhone maker said that it will donate $10 million, as well as any damages recovered in the lawsuit, to cybersurveillance research groups including Citizen Lab, the University of Toronto group that first discovered NSO's attacks. (Reporting by Eva Mathews in Bengaluru, Stephen Nellis in San Francisco, Chris Bing in Washington and Steven Scheer in Tel Aviv; Editing by Shounak Dasgupta, Mark Porter and Cynthia Osterman)