NSO Group faces legal action after Pegasus used against UK activists

The Israeli company behind Pegasus spyware, NSO Group Technologies, faces the prospect of legal action in a British court after Pegasus was used against the mobile phones of targets in Britain.

Lawyers have sent pre-action letters to NSO and the governments of the United Arab Emirates and Saudi Arabia claiming that Pegasus was used to spy on human rights activists in the UK. The case comes amid growing concern about the misuse of Pegasus spyware by governments.

Separately, law firm Bindmans has filed pre-action letters against NSO Group Technologies, the United Arab Emirates and Saudi Arabia on behalf of three people in the UK involved in sensitive human rights work.

The three claimants are part of a larger group of activists, academics, politicians and other prominent figures, represented by Bindmans and the Global Legal Action Network, a non-profit organisation that pursues legal action across borders. The three claimants have also issued legal letters against the United Arab Emirates and Saudi Arabia, which have so far not responded to the allegations.

The case brought by the three claimants will test whether courts in England and Wales have the jurisdiction to hear a case against the Israeli company. The three individuals bringing the legal claims against NSO were initially identified on a leaked list of potential Pegasus targets.

NSO Group Technologies, which denies the claims, is accused of breaching the General Data Protection Regulation (GDPR), the misuse of private information, harassment and trespass to goods. According to the legal letters, NSO has supplied Pegasus to states with poor human rights records.

The spyware has been used against human rights defenders, lawyers, journalists and political protestors. Pegasus is capable of extracting and recording all information on the phone, including text messages, contact lists, passwords, browsing history, phone calls and the geographic location of the phone.

Pegasus can also be used to remotely turn on a camera and microphones on an infected phone, effectively turning it into a bugging device, and to bypass encryption in messaging services such as WhatsApp or Signal.