In July, accusations emerged that spyware from NSO Group had targeted French president Emmanuel Macron, causing a major controversy. The company denied the claims—part of a string of allegations about use of the Israeli hacking group’s Pegasus software. Israel’s military officials, meanwhile, rushed to end a diplomatic crisis by meeting with their French counterparts and promising to investigate the charges.
At the exact same time, MIT Technology Review has learned, French government officials were in the final stages of contract negotiations to purchase Pegasus hacking tools from NSO. The French were on the verge of buying the tool—in the type of deal that is typically worth millions of dollars—despite years of allegations that it was regularly being used to surveil and harass dissidents, journalists, and human rights activists worldwide.
But sources familiar with the deal say that the process fell apart after the accusations that French politicians potentially were among those targeted, and negotiations were broken off just a few days before the sale was set to take place. (France’s Ministry of Foreign Affairs did not respond to our request for comment.)
Another important relationship fell apart earlier this month, when the United States sanctioned NSO Group by adding it to its entity list, thereby imposing rigorous rules and restrictions on Americans buying from or selling to the Israeli company.
The US made the move because it said NSO was building and selling “spyware to foreign governments” that used it for malicious purposes. The action, the Commerce Department declared in its announcement, “is a part of the Biden-Harris Administration’s efforts to put human rights at the center of US foreign policy, including by working to stem the proliferation of digital tools used for repression.”
While Israel has since managed to calm the situation with France, the attempts to mend relations with the US have been far more difficult.
Despite repeated and lengthy attempts to communicate with Washington, the company has failed to make meaningful contact with US officials, according to people familiar with the effort. NSO is attempting to get the sanctions reversed, a process that involves filing a written appeal to the Commerce Department.
The company’s executives sent a letter to Israeli government officials pleading for help to change Washington’s decision, but they were told that the US isn’t talking about this with them, either. In Jerusalem and Tel Aviv, Israeli officials feel stuck guessing why they were left in the dark about the decision to sanction NSO until the last second. Israel’s Ministry of Foreign Affairs did not respond to a request for comment, while the US Commerce Department explained the appeals process and timeline but declined to comment on the specifics of NSO’s case.
Employees at the company, who spoke on the condition of anonymity, say the sanctions and scandals have left NSO facing an existential crisis. NSO had not yet responded to a request for comment by the time this story published.
Low morale, severe doubts
NSO Group’s primary product is Pegasus, a spying tool that’s been the subject of both global criticism and global demand for a decade. The program enables the owner to break into a target’s phone to eavesdrop on the victim and gain access to everything on the device, including messages, contacts, and photos. Many democratic nations have purchased the product, including Germany, Spain, and Mexico: Officials in those countries say law enforcement and intelligence agencies need tools like Pegasus to surveil legitimate targets, such as members of organized criminal groups or terrorist networks. But critics say the tool gives carte blanche for spying without enough oversight and accountability—leading to regular abuse.
NSO has also sold Pegasus to multiple authoritarian nations, particularly across the Middle East and North Africa, and there are dozens of well-documented allegations of abusive behavior by its customers.
For the most part, NSO has defended itself by saying that it merely builds tools and does not control what foreign governments choose to do with Pegasus, and it has continued to operate its business as normal.
The sequence of revelations in 2021, however, has hit it differently.
The “NSO Affair,” as this year’s onslaught of scandals is being called in Israel, has cost the company millions of dollars in lost sales. Reports earlier this year of widespread abuse made headlines around the world, but the company says the allegations are based on mischaracterizing a standard database of phone numbers as NSO Group spying targets.
The US sanctions have had an immediate and much greater effect on the company than previous scandals. Bloomberg reported that Wall Street is shunning NSO and treating it as a distressed asset; meanwhile, the company’s newly appointed CEO quit just a week after being appointed.
The sanctions create practical restrictions on how the company can operate. For example, it cannot legally purchase many of the tools it uses to develop exploits, such as laptops with a Windows operating system or iPhones, without explicit approval from the government of the United States. The US has said its default decision on sales to NSO Group will be negative.
The US decision is having a deeper impact on the company, too. Morale is low and employees are devastated and confused, according to several who spoke to MIT Technology Review on condition of anonymity. There is real and severe doubt at the highest levels about NSO’s future if it cannot get off the US entity list.
Strategic problems
NSO’s links to Israeli leadership have also complicated the situation. Like many weapons manufacturers, NSO Group has a very close relationship with its government and has proved to be a crucial political and diplomatic tool for Israel over the last decade. When NSO Group began selling hacking tools to the United Arab Emirates government, for example, Benjamin Netanyahu, then the Israeli prime minister, specifically urged on the deal, according to people with knowledge of the sale.
In fact, Israel’s strategic plan to develop closer relations with its neighbors—neighbors who historically did not legally recognize Israel’s existence—was buoyed by NSO’s hacking technology, which was highly coveted by countries around the region. Pegasus has been used as a deal sweetener to strengthen Israel’s ties with countries including the United Arab Emirates, Morocco, and Bahrain.
All of these countries have also been credibly accused repeatedly of abusing Pegasus to spy on and jail dissidents—and have suffered few, if any, public consequences. After six years of alleged abuse, UAE’s access to Pegasus was shut off by NSO only in 2021 after it was revealed that Dubai’s ruler hacked his ex-wife’s phone using the tool.
NSO Group insists that the company is strongly regulated and that it independently investigates all credible allegations of abuse, and senior officials have said the company has canceled over $300 million in contracts due to abuse.
The NSO employees say the company’s intimate and complicated relationship with the Israeli government made the US decision to impose sanctions feel like an unexpected shot across the bow to some Israeli officials. For the experts and activists who have been accusing NSO Group of enabling authoritarian abuse for years, it’s a victory that is long overdue.
