The image is by Alex Castro.
According to a report, at least nine employees of the US State Department working in or with Uganda had their phones hacked by NSO Group. NSO Group says it only sells its software to government organizations that have been approved by the Israeli government.
NSO claims that it isn't able to target US phone numbers with a country code. The people targeted were employees of the State Department, but they were using foreign telephone numbers, according to the report. The devices were used for official State Department business, suggesting that NSO may be implicated in an espionage effort against the US government.
The attacks took place in the last several months.
The user could not notice that the phone was being attacked by Pegasus.
NSO has a program that can be used to covertly turn on a phone's microphones or cameras. It is also designed to install spyware without the target clicking a link or taking action, which is why it is called a zero-click attack.
It is not supposed to leave any trace, though investigators have developed methods to determine if a phone was hacked by it. You can read our explainer on it here, which explains the media investigations of its use by governments to target journalists, politicians, and activists.
NSO has to get approval from the Israeli Ministry of Defense before it sells its software to another government agency. NSO co-founder Shalev Hulio insists that the company doesn't know who its clients are snooping on. If there is evidence of abuse, the company will cut off the client's access to the software.
It is meant to be used against criminals and terrorists, but has a long history of abuse.
The Israeli embassy told the outlet that a government targeting US officials with Pegasus would be a severe violation of its licensing agreements.
Heavy restrictions on American companies being able to sell their products or services to the group have been added by the US. Apple filed a lawsuit against NSO Group, claiming that the company broke Apple's terms of service by creating over a hundred iCloud accounts to send malicious data. Apple patched the vulnerability that NSO used to install Pegasus with the new version of its software, but it hasn't seen a breach yet.
Apple said it would notify users who had been targeted by a state-sponsored espionage campaign when it announced its lawsuit. In November, Mao said he received one of the notifications.
There are reports that the US government is working with other countries to stop the sale of technology to authoritarian governments. According to The Wall Street Journal, the effort will focus on export controls and will likely be announced at the Summit for Democracy, which starts December 9th.
