FBI found out who illegally used NSO spyware: It was the FBI

Using NSO spyware has been illegal in the US since the government banned its import and use back in November 2021. When it was discovered that a US contractor had illegally used the spyware in April of this year, the FBI was asked to find out the identity of the end client.

That client turned out to be… the FBI.

Questions are now being asked about whether the FBI was the only government agency to receive illegally obtained data from the contractor, whose other clients include the Department of Defense and the Drug Enforcement Administration …

NSO spyware: Pegasus and Landmark

NSO is an Israeli company best known for its Pegasus spyware, which can be used to remotely hack an iPhone. Simply receiving a particular iMessage – without opening it or interacting with it in any way – can allow an iPhone to be compromised, with almost all of the personal data on it exposed.

But the company also makes a second spyware product known as Landmark. Instead of targeting phones, this one exploits vulnerabilities in cellphone base stations. When a target phone connects to a base station, Landmark can identify the location of the phone.

Triangulation with multiple base stations typically allows a location to be narrowed down to around 100-200 meters.

The use of NSO spyware was declared a national security risk in 2021, adding it to the Bureau of Industry and Security’s Entity List. This made it illegal for the tools to be used by any US company or government agency.

FBI investigation leads to… the FBI

A New York Times investigation back in April found that a US company, Riva Networks, had illegally purchased and used NSO spyware on behalf of a then-unknown US government client.

The secret contract, reviewed by The Times, stated that the “United States government” would be the ultimate user of the tool, although it is unclear which government agency authorized the deal and might be using the spyware.

The White House said that it was unaware of this, and it asked the FBI to investigate. The NYT now reports that the client was successfully identified.

After an investigation, the FBI uncovered at least part of the answer: It was the FBI […]

The FBI now says that it used the tool unwittingly and that Riva Networks misled the bureau. Once the agency discovered in late April that Riva had used the spying tool on its behalf, Christopher A. Wray, the FBI director, terminated the contract, according to U.S. officials.

The FBI said it had given Riva several Mexican phone numbers believed to be used by drug dealers and fugitives, and asked the company to locate those devices. The agency believed that Riva was using an in-house tool to do so, but Riva subsequently switched to using NSO’s Landmark spyware.

The FBI may not be the only US agency indirectly involved here. Government databases show that Riva also has contracts with the Department of Defense, the Drug Enforcement Administration (DEA), and the Air Force Research Laboratory.

The DEA is also reported to be using a similar tool to Pegasus sold by an NSO competitor, Paragon Graphite. Use of this tool is not illegal, though it is equally questionable.