NSO Spyware Was Used to Hack Clergy in Togo

Researchers have identified more people targeted with spyware made by the Israeli hacking company NSO Group. 

On Monday, researchers from the internet watchdog Citizen Lab published a new report that detailed how hackers targeted a Catholic bishop, a priest, and two members of the political opposition in Togo—all people who had been vocal about government reform in the African country. 

This is the latest in a long series of reports that allege NSO’s customers use the company’s surveillance technology to spy on dissidents, human rights activists, or political opponents of the government that purchased NSO’s spyware. Similar alleged cases of abuse have been exposed in Spain, Morocco, Mexico, and the United Arab Emirates, among others.   

“The 2019 targeted espionage against the four Togolese individuals coincided with major political demonstrations in Togo which were violently disrupted by armed security personnel, and after which numerous Togolese were arrested and sent to prison,” Ron Deibert, the director of Citizen Lab, which operates out of the Munk School of International Affairs at the University of Toronto, wrote in an email sent to reporters. “This case adds to a long and growing list in which NSO Group’s spyware was clearly and seriously abused. NSO Group claims that it sells its powerful surveillance technology as a tool to help governments fight crime and terrorism. However, Togo is a flawed democracy ruled by a single family for 57 years with a long track record of human rights abuses (including reports that torture is routine in the country’s prisons). The four individuals targeted are clearly neither ‘criminals’ nor ‘terrorists’ by any international human rights-respecting standards.”

Citizen Lab did not conclusively attribute these spying attempts to the Togo government, but Deibert said that “the timing (and the fact that NSO Group sells only to governments) suggests that the spyware was used by elements of Togo’s security forces to spy on domestic political opposition.”

An NSO Group spokesperson said in a statement that “as NSO has now stated on several occasions, due to strict contractual and legal confidentiality requirements we cannot confirm or deny who our customers are.” 

“As we have also made clear before, we are not privy to who our authorised and verified sovereign government clients target using our technology, though they are contractually obliged to only do so against terrorists and criminals,” read the emailed statement. 

The targets identified in Togo are: Monseigneur Benoît Comlan Alowonou, the Bishop of Kpalimé; Father Pierre Marie-Chanel Affognon; Elliott Ohin, a former minister of State Reform and Modernization and former president of the opposition party; Raymond Houndjo, a member of the opposition party. 

According to Citizen Lab, these four people were among the around 1,400 people targeted with NSO spyware sent via WhatsApp last year, taking advantage of a flaw found in the popular messaging app. That series of attacks is at the heart of a blockbuster lawsuit brought against NSO by Facebook, the owner of WhatsApp.   

Subscribe to our cybersecurity podcast, CYBER.