Apple v. NSO Group: How will it affect security researchers?

Trouble with the CFAA

The ongoing lawsuit involves the CFAA, a federal anti-hacking law that prohibits access to a computer without authorization. The outdated and often broad legislation was enacted in 1986 and not been updated since 2008, despite rapidly evolving digital transformations.

"From my perspective, outdated makes it sound like it was a good idea at one point in time. The CFAA was never a good idea," Cohn said.

Apple is accusing NSO of violating that law by "knowingly accessing the operating system on users' devices without authorization." More specifically, Apple alleges that NSO installed Pegasus without user authorization.

The CFAA, according to Cohn, is a rough tool for this lawsuit.

"What Apple is saying is that breaking into the user's computers, their phones, was done without the consent of the user. Security researchers are generally working on either their own tools or tools where they have the ability to get permission to break into the actual device," Cohn said.

However, the CFAA in relation to this lawsuit presents several questions for Cohn, including: Who gets to do that authorizing? It is a central piece, she said, not only because users are on other peoples' computers constantly, but the software is also owned by other companies. In this instance, will authorization be up to the user, or to Apple?

If it continues to be the user who can hack their own devices or give permission to someone else to do so, then Cohn said there will be a wide lane for security researchers, which is good.

"If Apple becomes the person who gets to decide what they do on your device, that would be a misreading of the complaint. This isn't what Apple has said, but this is where some of the confusion lies in this very big statute," Cohn said.

Asaf Lubin, associate professor of law at the Indiana University Maurer School of Law, also addressed that confusion during The Lawfare Podcast with senior editor Alan Rozenshtein and Orin Kerr, professor of law at the UC Berkeley School of Law. Lubin said the lawsuit may have a problem, because Apple is suing over what happened on devices they do not own, but the company claims ownership of the operating system on iOS devices.

The case's potential side effects on security researchers, according to Pfefferkorn, demonstrate that the CFAA, like the Digital Millennium Copyright Act (DMCA) statute at issue in another Apple lawsuit, both need to be amended by Congress in order to protect good-faith security research.

In 2019, Apple sued Corellium, a vendor that provides mobile penetration testing and security research. Apple alleged that Corellium "infringed Apple's copyrights in iOS and circumvented its security measures in violation of the federal Digital Millennium Copyright Act (DMCA)." Corellium denied the allegations, and Apple dropped the lawsuit this year.

There is some suspicion, Pfefferkorn said, that part of Apple's motivation behind the NSO lawsuit may be to relitigate its claims against Corellium, this time against a less sympathetic defendant.

"A defendant that exists to undermine user security rather than to improve it," she said. "Granted, the new complaint doesn't contain the DMCA claims seen in the Corellium lawsuit, but assertions remain similar."

While there are clear issues with the CFAA, Shawn Tuma, partner at law firm Spencer Fane LLP, which specializes in data privacy and cybersecurity risk management, said it has made progress over the past 10 years in regard to online services and software as "devices."  He compared Apple v. NSO Group to a past case involving Sony Computer Entertainment America. Sony sued an individual, George Hotz, for hacking into his own PlayStation3 and accused him of "jailbreaking" the device.

"It relied on the CFAA and the DMCA, and Sony ultimately prevailed on a temporary injunction on the DMCA claim," Tuma said in an email to SearchSecurity. "Since that time the CFAA has come a long way and I think is much stronger today, in this case, than it was back in 2011, especially considering how integrated the Apple devices and iOS are with Apple's network's servers, which makes the case much stronger for an 'unauthorized access' to Apple's devices."

If this application of the CFAA is done correctly in Apple v. NSO, Cohn said it can be good.

"That's not something we say all the time," she said. "I hope other companies will follow suit."

Impact on the spyware industry

Though its impact on security researchers remains compounded, the lawsuit's influence on the spyware industry appears more straightforward, particularly in combination with the pending Facebook trial and the addition of the NSO group to the Commerce Department's sanctioned entities list.

Silicon Valley companies taking action against zero-day brokers was one trend security vendor Kaspersky Lab predicted last year. Costin Raiu, director of the global research and analysis team at Kaspersky, said the so-called "legal spyware" companies are out of control and noted a "lack of transparency, audit and generally unregulated sales for technologies against which there is no defense."

"The offensive security industry is out of control and the abuses we are seeing are probably just the tip of the iceberg," Raiu said in an email to SearchSecurity. "Going forward, we expect more companies and governments to put pressure on offensive technology sellers."

With this mounting pressure, Pfefferkorn said it shows that big tech companies will no longer limit their skirmishes with spyware makers to simply exploiting and patching vulnerabilities.

"The Apple lawsuit should make it harder for NSO to do business, scare off international investment and send a signal that enabling human rights abuses will not go unpunished," she said.

While there has been a good amount of talk in recent years about suing companies that facilitate hacking, or those that provide services to help the hackers, Tuma said that at the end of the day, litigation is very expensive. "Given that Apple has as big of a war chest as any private company and is the plaintiff in the case, the chances of seeing substantive merits on this issue get addressed in a court of law are much greater," Tuma said.

Though WhatsApp really paved the way for cases such as these, Cohn said, Apple joining is important because now it represents two giants of the tech industry.

"It's a start of the end of this business model and we're not going to be able to write this kind of software. It's not something I think we can prevent entirely, but we can make this business model illicit and that's what we need to do," Cohn said.