Recent legal action by tech giant Facebook has critical implications for the rise of private sector actors in the fight for dominance and security in the Middle East cyber domain. On Oct. 29, Facebook filed a lawsuit against the Israel-based company NSO Group for allegedly breaching users of the Facebook-owned communications platform WhatsApp. NSO Group has previously faced legal action from Omar Abdulaziz, a Saudi dissident who alleged that its software had breached personal data on his cell phone. Amnesty International has similarly taken legal action against Israel’s Ministry of Defense to strip NSO Group of its export license after a staff member was allegedly targeted by the company’s software. NSO spyware products are designed to grant the buyer access to individual data on the targeted device, with uses for private intelligence, counterterrorism, and more.
The lawsuit may represent the first time that NSO Group has been implicated in legal action not by an individual victim of its software, but by the affected platform itself. Facebook has recently made a public pivot to emphasize privacy on its platforms, especially as the U.S. Department of Justice has pressured Facebook to limit encryption protection in its apps.
Facebook, one of the most ubiquitous and powerful companies in the world, may bring new and more pronounced attention to the controversy around NSO Group’s software that prior, smaller lawsuits by Amnesty International and Omar Abdulaziz could not. Immediately after the lawsuit became public, WhatsApp head Will Cathcart published an opinion piece in The Washington Post outlining Facebook’s reasoning for suing NSO Group. The Washington Post came under fire just last week for hiring Juliette Kayyem, an NSO Group senior advisor, as a columnist. It is increasingly the case that private actors like Facebook behave like state powers in the Middle East and elsewhere, leveraging their significant influence over political discourse, information security, and more.
According to NSO Group, Kayyem has helped the firm to enhance its governance policies and balance its role in policing and counterterrorism with human rights to privacy and freedom of expression. NSO Group recently adopted a human rights policy to align with the UN Guiding Principles on Business and Human Rights, although this has been met with skepticism by its critics. A month after publishing the policy, Amnesty International uncovered NSO software on the phones of two Moroccan human rights activists, raising questions about the limits of a spyware company’s ability to factor human rights concerns into its business. Even if a country purchases NSO’s software for a legitimate counterterrorism or law enforcement need, the firm has little recourse if the government then uses it to spy on journalists or activists.
While NSO Group has faced fierce criticism from many journalists and activists, it has made friends with governments around the world — including many countries not traditionally allied with Israel. NSO Group’s software has reportedly been used as far away as Uzbekistan, and it has been alleged that the FBI paid the NSO Group as much as $1 million to unlock the iPhone 5C of one of the San Bernardino shooters. Israel recently loosened its export restrictions on dual-use software like that sold by NSO Group, and it is perceived by some Israeli government leaders as a tool for diplomacy.
As Facebook has faced criticism from across the political spectrum in connection to Cambridge Analytica, fake news, and political ads, it recently appears to be aligning with the pro-privacy positions of tech giants like Apple. Apple on principle refused to assist the FBI in decrypting one of the San Bernardino shooters’ iPhones in 2015, representing a consensus position among cryptographers that backdoors for law enforcement can also be exploited by foreign governments or criminals, leaving all customers vulnerable. With Facebook’s recent tensions with Attorney General Bill Barr over its plans to end-to-end encrypt its chat apps, it is essentially in the same position Apple was four years ago (although the dispute is nowhere near as dramatic).
The question remains: As private technology firms stand to play a larger and more unique role in the economics, politics, and privacy concerns of the Middle East and beyond, how will the limits of this power be negotiated? A greater examination of how technology and private firms interact with power politics in the region will be critical, both for questions of security and human rights.
Michael Sexton is a Fellow and the Director of MEI's Cyber Program. Eliza Campbell is the Associate Director of the Cyber Program.
Photo by JACK GUEZ/AFP via Getty Images
The Middle East Institute (MEI) is an independent, non-partisan, non-for-profit, educational organization. It does not engage in advocacy and its scholars’ opinions are their own. MEI welcomes financial donations, but retains sole editorial control over its work and its publications reflect only the authors’ views. For a listing of MEI donors, please click here.