Saudi Arabia’s Phone Hacking Shows We Need Better Encryption — Not Backdoors

Before the world learned that history’s richest man had been hacked by agents of Saudi Arabia’s crown prince, Saudi dissidents and human rights activists such as Yahya Assiri had received similar treatment.

In May 2018, Assiri opened a message purporting to be from the Saudi government. The innocuous-looking message installed Pegasus spyware, which allows remote surveillance of cellphones, he told PBS Frontline. The spyware was made by NSO Group, the Israeli company that researchers credit for the Bezos hack. “If I take [these attacks] serious, I must stop my work,” said Assiri. 

The recent incident shows the importance of strong consumer encryption technology, both between phones and for backup data, of the sort the U.S. government is seeking to undermine. WhatsApp, owned by Facebook, offers end-to-end encrypted messages. But the Bezos hack, and the others like it, show the limits of even good message security in the face of a known attacker. 

Stories like this have been emerging from Saudi Arabia in the three years since Mohammad bin Salman was named successor to the throne. The rise in online surveillance is largely credited to Saud al-Qahtani, a media advisor to the prince who runs social media campaigns on behalf of the Saudi government and is believed to have placed a mole among Twitter’s employees to better track dissident Saudis around the world.  Widely believed to have played a key role in the 2018 murder of Washington Post journalist Jamal Khashoggi, he was exhonerated in a Saudi court to the alarm of press freedom watchers everywhere. 

On Wednesday, two UN officials called for an investigation into The Guardian’s report that Saudi agents had obtained files from Jeff Bezos’ cellphone by sending him malware via Facebook’s WhatsApp service. 

“The Special Rapporteurs note that the allegations regarding the hacking of Bezos' mobile phone are also consistent with the widely reported role of the Crown Prince in leading a campaign against dissidents and political opponents. The hacking of Mr. Bezos' phone occurred during a period, May-June 2018, in which the phones of two close associates of Jamal Khashoggi, Yahya Assiri and Omar Abdulaziz, were also hacked, allegedly using the Pegasus malware,” read the statement from David Kaye, Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, and Agnes Callamard, Special Rapporteur on summary executions and extrajudicial killings.

The Guardian’s report rests on the conclusions of a cybersecurity research group named FTI. It asserts that the malware was delivered in a movie file sent from the crown prince’s personal cellphone. One prominent security researcher with deep experience in mobile exploits was dubious. “They didn’t find any evidence, it looks like,” said the researcher.

An annex to the UN officials’ statement says that it’s not yet clear what malware was used.

Related: China Is Watching the FBI-Apple Battle Very Closely

Related: The Fight Over Consumer Encryption Is Moving Into a Strange New Phase

Related: The Best Way To Stick It To Dictators, Help Dissidents, and Boost Privacy

But if there is some question about the how, there is little debate on the who. The security researcher did say that they believed the NSO was the likely candidate. 

In October, WhatsApp sued NSO Group for sending malware via a WhatsApp video call. “This encryption protocol was designed to ensure that no one other than the intended recipient could read any communication sent using the WhatsApp Service,” WhatsApp’s lawyers wrote. “Unable to break WhatsApp’s end-to-end encryption, Defendants developed their malware in order to access messages and other communications after they were decrypted on Target Devices.” 

NSO Group has not responded to the filing. A court date is set for Feb. 13. 

The Bezos hack shows that governments, even those of “allies'” such as Saudi Arabia, don’t feel constrained by U.S. laws against attacking U.S. citizens. 

While not foolproof, strong message-encryption services like WhatsApp raise the difficulty and cost for would-be hackers. Furthermore, because these force attackers to rely on personal relationships, it can also help expose the culprits. 

“The attack we saw provides several urgent lessons. First, it reinforces why technology companies should never be required to intentionally weaken their security systems. ‘Backdoors’ or other security openings simply present too high a danger,” WhatsApp head Will Cathcart wrote in an October op-ed.

But the Bezos saga also shows the importance of encrypting other files such as in storage on the device, which is common, or backup files stored on clouds like iCloud, which is not. The Justice Department has knives out for both end-to-end encryption and for backup file encryption. Reuters reported this week that U.S. officials persuaded Apple to drop plans to allow people to encrypt the files they back up using the company’s iCloud service. In the two years since, Apple has given users’ files to the government when presented with a warrant — including in December, after a Saudi military pilot killed several people at a Florida naval air station, Reuters reported.

But Apple’s cooperation didn’t stop U.S. Attorney General William Barr from publicly pressuring the company to decrypt the shooter’s iPhone as well, and to build backdoors into future products. The company responded: “We have always maintained there is no such thing as a backdoor just for the good guys. Backdoors can also be exploited by those who threaten our national security and the data security of our customers.”