5 things to know about the Israeli firm at the center of the spyware scandal
An Israeli woman uses her iPhone in front of the building housing the Israeli NSO group, on August 28, 2016, in Herzliya, near Tel Aviv. – Apple iPhone owners, earlier in the week, were urged to install a quickly released security update after a sophisticated attack on an Emirati dissident exposed vulnerabilities targeted by cyber arms dealers. Lookout and Citizen Lab worked with Apple on an iOS patch to defend against what was called “Trident” because of its triad of attack methods, the researchers said in a joint blog post. Trident is used in spyware referred to as Pegasus, which a Citizen Lab investigation showed was made by an Israel-based organization called NSO Group. (Photo by JACK GUEZ / AFP) (Photo by JACK GUEZ/AFP via Getty Images) Photo by Getty Images
An Israeli spyware company is in the news Monday after the “Pegasus Project,” a collaboration between more than a dozen media outlets and human rights group Amnesty International, revealed findings that suggest thousands of cell phones belonging to elected officials and other prominent individuals may have been compromised. Here’s what you need to know about NSO Group, the firm that creates the Pegasus spyware and that has been the subject of recent reporting.
What is the NSO group?
NSO Group is a cyber-surveillance company based near Tel Aviv notorious for selling its services to authoritarian governments. It caters exclusively to government agencies, according to its website. While the firm has made headlines for years for its dealings with undemocratic governments, it became a lead story around the world Monday after the Washington Post and a consortium of international media outlets reported that NSO’s spyware had targeted journalists and activists around the world.
NSO has 750 employees and revenue of more than $240 million, according to Moody’s. The Washington Post reported that in addition to Israel, it has offices in Bulgaria and Cyprus.
The focus of recent reporting has been Pegasus, NSO Group’s signature spyware that allows the surveillance of smartphones, but the company also produces other software like Eclipse, which can take control of drones. NSO Group has denied any wrongdoing.
Who are its leaders?
NSO Group’s board is made up of eight men, mostly a mix of the company’s Israeli founders — Shalev Hulio and Omrie Lavie — and investors from Novalpina Capital, a European investment firm based in London, which bought NSO Group in 2019. The company is advised by Daniel Reisner, former head of the Israel Defense Forces’ international law department, and Buky Carmeli, who previously led the Israeli National Cyber Security Authority.
Israel, as the so-called “start-up nation,” has developed technologies that impact almost every part of life — from dating to medicine. Is it considered a leader when it comes to surveillance technology?
Israel has seen massive growth in its cybersecurity sector over the last several years, with investments in the industry reaching $1 billion last year, second only to the United States, according to the Wall Street Journal. Many of the Israelis running cyber firms were trained in the IDF’s intelligence units. While some have used their expertise as hackers to offer defensive products for corporations and foreign governments, others have built military-grade offensive software for foreign export.
In addition to NSO Group, the Israeli company Candiru came under scrutiny last week for reportedly selling spy tools to governments in the Middle East and Asia.
Who is supposedly using Israeli spyware and what are they doing with it?
The Washington Post, in collaboration with the nonprofit Forbidden Stories, reported Monday that it had identified 50,000 phone numbers that had been targeted by NSO Group clients. The targets included more than 1,000 government officials, as well as journalists, business leaders and activists. Citizen Lab, a cybersecurity publication, has identified the use of Pegasus spyware in 45 countries and regions around the globe, although the company does not release a list of clients. The Israeli government must approve of NSO Group sales, and told the Post that it “approves the export of cyber products exclusively to governmental entities, for lawful use, and only for the purposes of preventing and investigating crime and counterterrorism.”
NSO Founder Shalev Hulio told the Post that governments have used his company’s software to help stop terrorist plots and to thwart sex-trafficking rings.
Meanwhile, Candiru stands accused of licensing its sophisticated spyware — capable of stealing passwords, files and messages from devices — to be used in Saudi Arabia, the United Arab Emirates, Hungary, among other countries. The company’s surveillance software was allegedly embedded in fake websites made to look like they represented Amnesty International and Black Lives Matter to lure in potential targets.
Has any criticism of NSO turned antisemitic?
Aside from the typical spate of anonymous online comments from small accounts, there does not appear to be a widespread antisemitic backlash to the revelation that NSO Group is helping governments — and perhaps other entities — hack into the personal cellphones of individuals around the globe. However, several critics have accused the Post and other outlets of unfairly framing NSO Group as an “Israeli company” or emphasizing its location, given that it is not directly affiliated with the Israeli government and that a majority-stake in the company has been held by foreign investors since 2014.
Can someone please explain to me why every story about Pegasus describes NSO as an “Israeli tech firm”? Don’t see a whole lot of “Twitter, an American company” or “Kaspersky Labs, a Russian company”
— Akiva Cohen (@AkivaMCohen) July 19, 2021
Others argue that the reporting hasn’t looked closely enough at NSO Group’s roots in the Israeli military, and the way that the IDF’s Unit 8200 tests highly invasive online surveillance practices on Palestinians living in the West Bank and Gaza.
