Apple seeks dismissal of NSO Group lawsuit

Photo: Kevin Pham, digital security intern

Digital Security Intern

This is the Digital Security Training team at Freedom of the Press Foundation (FPF), with security news that keeps you, your sources, and your devices safe. If someone has shared this newsletter with you, please subscribe here.

It’s Kevin Pham, intern on the Digital Security Training team, taking over the newsletter this week.

Freedom of the Press Foundation (CC BY 4.0)

Get Notified. Take Action.

In the news

Apple has filed a motion to withdraw a lawsuit against NSO Group, an Israeli spyware company, claiming that a protracted case would reveal sensitive security information it uses to combat targeted spyware attacks. Although the lawsuit weakened the NSO Group, other targeted spyware companies may take advantage of this security information.

The court filing states, “The result is that even complete victory in this suit will no longer have the same impact as it would have in 2021; instead of eliminating with one judgment a significant portion of the threat environment, other spyware companies unaffiliated with Defendants would be unaffected by the suit and able to continue their destructive tactics.”

Such new threat actors could target the released information on Apple’s security practices even if kept confidential by the court. Apple cites an incident in which Israel interfered in a WhatsApp lawsuit against the NSO Group, claiming that the firm gained access to “controlled materials” by hacking Israel’s Ministry of Justice. Read more here.

What you can do

Despite intense media coverage, the NSO Group is just one part of an expanding targeted spyware industry. As more companies join this space, here are some actionable steps you can take to protect your devices against them:

  • If you are concerned about being targeted by spyware and have an iPhone, you can enable Apple’s Lockdown Mode for more restrictive security settings. According to a report from Access Now, researchers “observed that activating Lockdown Mode for the iPhone appears to have blocked some attempts to compromise Apple devices with Pegasus.”
  • Although not perfect, iVerify for iOS can help scan for less sophisticated malware.
  • Android users may need additional work. The Mobile Verification Toolkit requires some technical knowledge to set up. If you are not comfortable trying out this approach on your own, Amnesty International’s Security Lab and Access Now’s digital security helpline can assist those involved in civil society work.
  • Advanced attacks rely on vulnerabilities that have not yet been reported or patched in security updates. By downloading and installing the latest security updates, you can protect your device against most kinds of spyware. My colleague David Huerta wrote an excellent blog on why software updates are so important.

Updates from our team

  • As my internship ends, this will be the last newsletter written by me. If you ever want to stay connected, please feel free to reach out to me here.
  • We’re co-hosting “Source!” the London Logan Symposium, with The Centre for Investigative Journalism on Nov. 14-15 in London, England. Hear from journalists from all over the world about press freedom issues and the challenges they face in protecting themselves and their sources. Register to attend here.
  • From Sept. 18-21, some of our digital security training teammates will be in attendance at the Online News Association's annual conference in Atlanta. Will you be there? Come say hi.
  • Freedom of the Press Foundation (FPF) staff will be in attendance at the 2024 Team CommUNITY Global Gathering in Estoril, Portugal. From Sept. 27-29, reach out if you’d like to say hi, or if you want some digital security digest stickers.

Our team is always ready to assist journalists with digital security concerns. Reach out here, and stay safe and secure out there.

Best,

Kevin

Kevin Pham
Digital Security Training Intern

Freedom of the Press Foundation

Donate to support press freedom

Your support is more important than ever.

Read more about Digital Security Digest

Indicted NYC mayor forgets phone passcode

Eric Adams allegedly claimed that he had changed the passcode and told the FBI he did not remember it.

Discord boosts private call encryption

Discord announced its rollout of end-to-end encryption for voice and video calls in one-to-one and group direct messages, voice channels, and Go Live streams.

Telegram rethinks messaging on content moderation

Following the arrest of Telegram founder and CEO Pavel Durov, the messaging app modified its FAQ page to clarify some new rules.