Apple is suing NSO Group, a controversial Israeli cybersecurity company, for spreading spyware to iPhones belonging to activists, journalists, and government officials.
On Wednesday, the company filed a lawsuit that calls on a US district court to ban NSO Group from using Apple products and services ever again. The goal is to stop the Israeli company from developing new spyware tools to attack previously unknown vulnerabilities in macOS and iOS.
“State-sponsored actors like the NSO Group spend millions of dollars on sophisticated surveillance technologies without effective accountability. That needs to change,” said Apple senior vice president Craig Federighi in the announcement.
The company points out the spyware from NSO Group only targeted a relatively “small number” of Apple users worldwide. Nevertheless, in some cases, the surveillance tools were powerful enough to hijack an iPhone or Mac device simply by sending a maliciously crafted message to the intended victim.
“Apple devices are the most secure consumer hardware on the market— but private companies developing state-sponsored spyware have become even more dangerous,” Federighi added.
The lawsuit arrives weeks after the White House sanctioned NSO Group for allegedly supplying the spying tools to foreign governments. In July, a massive leak involving NSO Group's clients showed the Israeli company's surveillance tools were allegedly used to target 50,000 phone numbers.
The Biden administration has now banned hardware and software exports to the Israeli company, unless a US-government license is secured. But applicants should presume they'll face denial.
Apple’s action piggybacks on another lawsuit currently facing NSO Group. In 2019, WhatsApp also sued the Israeli company for spreading spyware to its users. In response, NSO Group argued the lawsuit should be dismissed, citing “sovereign immunity” because of the company’s work with the Israeli government. But earlier this month, a US appeals court affirmed an earlier ruling rejecting NSO Group’s claim of immunity.
As a result, Apple’s lawsuit notes: “Defendants’ malicious and harmful activities have brought them well within the long arm of the law and the jurisdiction of this Court, which has the authority to hold them to account for their violations of US federal and state laws and for the damage they have inflicted on Apple and its users.”
The same lawsuit also claims NSO Group broke US law by hosting spyware from data centers based in the US and abusing Apple servers in the country.
"Defendants force Apple to engage in a continual arms race," the company added. "Even as Apple develops solutions and enhances the security of its devices, Defendants are constantly updating their malware and exploits to overcome Apple’s own security upgrade." So in response, Apple is demanding NSO Group also pay damages to compensate for all the resources it spent on investigating the Israeli company's spyware attacks.
NSO Group did not immediately respond to a request for comment. But earlier this month, the company said it was lobbying the US to remove the sanctions.
"We look forward to presenting the full information regarding how we have the world’s most rigorous compliance and human rights programs that are based the American values we deeply share, which already resulted in multiple terminations of contacts with government agencies that misused our products,” the company said.
In the meantime, Apple says it's never encountered NSO Group's spyware successfully exploiting iOS 15. So to stay protected, the company is urging all iPhone users to upgrade. "Any time Apple discovers activity consistent with a state-sponsored spyware attack, Apple will notify the affected users in accordance with industry best practices," the company added.