The NSO Group is the company (based in Israel but American-owned) which appears to be responsible for the software used to penetrate WhatsApp.

The case seems to have a lot of parallels with the Marcus Hutchins case. Hutchins was originally indicted on 6 counts for selling malware which was subsequently used by an unknown person to hack banks. The indictments were under the Computer Fraud and Abuse Act and also under 18 U.S.C. 2512, which prohibits the sale of wiretap devices. Orin Kerr wrote an analysis of the indictments at the time. Hutchins subsequently pleaded guilty, so the legal theories in the indictments were never tested in court.

In the WhatsApp case NSO Group appear to have sold malware to a number of governments, and at least one of these governments has used the malware to spy on legal activities, including at least one lawyer engaged in a lawsuit against NSO.

If NSO Group has sold software to governments who are known to target dissidents carrying out legal activities, and those governments then used that software in this way, would that be a crime by the NSO Group under either US law or Israeli law?

  • Creating a 0day and selling it is completely legal. Using the 0day for malicious purposes is not. – Digital fire May 15 '19 at 18:28
  • It's a legal grey area, especially if you know that the exploit will be used illegally and sell it anyway. Unfortunately, selling 0days to governments is rarely prosecuted. – forest May 17 '19 at 0:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.