FBI Confirms It Obtained NSO's Pegasus Spyware

An anonymous reader quotes a report from The Guardian: The FBI has confirmed that it obtained NSO Group's powerful Pegasus spyware, suggesting that it bought access to the Israeli surveillance tool to "stay abreast of emerging technologies and tradecraft." In a statement released to the Guardian, the bureau said it had procured a "limited license" to access Pegasus for "product testing and evaluation only," and suggested that its evaluation of the tool partly related to security concerns if the spyware fell into the "wrong hands." The bureau also claimed it had never used Pegasus in support of any FBI investigation. "There was no operational use in support of any investigation, the FBI procured a limited license for product testing and evaluation only," it said. The statement marks a direct acknowledgment by the FBI that it acquired Pegasus, one of the world's most sophisticated hacking tools. [...] A person with close knowledge of the FBI deal, who spoke to the Guardian on the condition of anonymity, claimed that it occurred after a "long process" of negotiations between US officials and NSO. It is claimed one disagreement centered on how much control NSO would retain over its software. The source claimed that NSO usually kept sensors on its technology so that the company could be alerted in Israel if the technology was moved by a government client. But the source claimed the FBI did not want the technology to be fitted with sensors that would have allowed NSO to track its physical location. The source also claimed that the FBI did not want NSO's own engineers to install the technology and did not want to integrate the spyware into its own systems. Ultimately, it is understood that NSO and the FBI agreed to keep the technology in a large container. The FBI was also concerned about possible "leakage" of any data to another foreign intelligence service, the source said. The source claimed the Pegasus license was acquired by the FBI using a financial "vehicle" that was not easily identified as being linked to the bureau. In the end, the source claimed, the FBI did not actually use Pegasus. "They weren't using it at all. Like, not even switching it on. But they kept paying for it, and they wanted to renew. It was a one-year test project and it cost about $5 million, and they renewed for another $4 million," the source claimed. "But they didn't use it." In response to the claims, the FBI said: "The FBI works diligently to stay abreast of emerging technologies and tradecraft -- not just to explore a potential legal use but also to combat crime and to protect both the American people and our civil liberties. That means we routinely identify, evaluate, and test technical solutions and problems for a variety of reasons, including possible operational and security concerns they might pose in the wrong hands. There was no operational use in support of any investigation, the FBI procured a limited license for product testing and evaluation only."

Read more of this story at Slashdot.