A recently discovered security vulnerability on WhatsApp, currently used by over 1.5 billion people worldwide, has been found to have been exploited by NSO Group developed spyware.

Spyware developer NSO Group is usually quick to dismiss the evidence that its customers have abused its Pegasus mobile phone spyware. This pattern of denials was repeated in a recent 60 Minutes investigation, which gives a rare look into NSO Group’s management.

The window of a murdered Mexican journalist was targeted with Pegasus, a spyware product which can secretly access the contents of a phone and turn on its camera and microphone.

Published by the Review of Policy Research, this paper by the Citizen Lab’s Ron Deibert, Joshua Oliver, and Adam Senft takes a deep dive into data provided by the circumvention tool Psiphon to reveal Iran’s increasingly sophisticated Internet blocking strategy around elections.

He provided oral comments to the committee which were, substantially, a truncated version of the brief he submitted. His oral comments are available to download, and what follows in this post is the actual brief which was submitted.

Without Novalpina Capital—or the parties that you hired to conduct due diligence—concluding that Citizen Lab reporting is flawed and providing a substantiated basis to prove such a finding, it remains the case that you are purchasing a company implicated in serious human rights abuses and have decided to simply ignore this fact. It also remains the case that, without meaningful engagement with our research, your due diligence process will appear to many as nothing more than a superficial effort to check boxes and appease stakeholders concerned by NSO Group.

The purpose of this letter is to alert Jefferies Financial Group and lending firms interested in the syndicated loan to the Citizen Lab’s structured, evidence-based research into the abuse of NSO Group spyware, as well as investigations and research conducted by organizations such as Amnesty International, security companies, and the security team at Google Inc.

Citizen Lab research associate Christopher Parsons, in conversation with CBC Radio Spark, comments on the security concerns associated with Huawei technology should it be used in Canada’s 5G infrastructure.

We appreciate your commitment—as stated in your letter of February 15, 2019—to “helping NSO Group become more transparent about its business.” As a first step, we ask that Novalpina Capital provide answers to the following questions regarding Novalpina Capital and NSO Group’s human rights due diligence and corporate social responsibility practices.