Apple Drops Spyware Case Against NSO Group, Citing Risk of Threat Intelligence Exposure

Apple has filed a move to "voluntarily" withdraw its case against commercial spyware provider NSO Group, claiming a changed risk environment that might lead to disclosure of crucial "threat intelligence" material.

The news was initially reported by The Washington Post on Friday.

The iPhone manufacturer claimed its actions, together with those of others in the industry and national governments to curb the proliferation of commercial spyware, had "substantially weakened" the defendants.

"At the same time, unfortunately, other malicious actors have arisen in the commercial spyware industry," the firm warned. "It is because of this combination of factors that Apple now seeks voluntary dismissal of this case."

"While Apple continues to believe in the merits of its claims, it has also determined that proceeding further with this case has the potential to put vital security information at risk."

Apple first launched the case against the Israeli corporation in November 2021 in an effort to hold it responsible for improperly targeting customers with its Pegasus monitoring tool.

It branded NSO Group, a subsidiary of Q Cyber Technologies Limited, as "amoral 21st century mercenaries who have created highly sophisticated cyber-surveillance machinery that invites routine and flagrant abuse."

Earlier this January, a federal judge denied a motion from NSO Group to dismiss the lawsuit under the grounds that the company is "based in Israel and Apple should have sued them there," with the court stating that "the anti-hacking purpose of the [Computer Fraud and Abuse Act] fits Apple's allegations to a T, and NSO has not shown otherwise."

In its request for voluntary dismissal, Apple noted three main events have been a contributing factor: The possibility that the threat intelligence information it has created to safeguard users against spyware assaults might be leaked, according to a July 25, 2024, piece from The Guardian.

The British newspaper revealed that Israeli officials had seized documents from NSO Group in July 2020 in an apparent effort to stop the handover of information about the notorious hacking tool as part of the company's ongoing legal tussle with Meta-owned WhatsApp, which filed a similar lawsuit in 2019.

"The seizures were part of an unusual legal maneuver created by Israel to block the disclosure of information about Pegasus, which the government believed would cause 'serious diplomatic and security damage' to the country," The Guardian observed at the time.

Apple also cited as reasons the changing dynamics in the commercial spyware industry and the proliferation of different spyware companies, as well as the possibility of revealing to third-parties "the information Apple uses to defeat spyware while defendants and others create significant obstacles to obtaining an effective remedy."

The development comes as the Atlantic Council divulged that the individuals behind some of the spyware vendors in Israel, Italy, and India that have come under the scanner for enabling authoritarian regimes to spy on human rights advocates, opposition leaders, and journalists have sought to rename them, start new ones, or undertake strategic jurisdiction hopping.

Case in point, Intellexa, the now-sanctioned business behind the Predator spyware, has emerged with new infrastructure in conjunction with its continuous usage by potential clients in countries such as Angola, the Democratic Republic of the Congo (DRC), and Saudi Arabia.

"Predator's operators have significantly enhanced their infrastructure, adding layers of complexity to evade detection," cybersecurity firm Recorded Future's Insikt Group claimed.

"The new infrastructure includes an additional tier in its multi-tiered delivery system, which anonymizes customer operations, making it even harder to identify which countries are using the spyware."