Spotlight on spyware firm NSO's ties to Israeli state

New Delhi, July 21 The Pegasus project has turned the spotlight on spyware firm NSO Groups ties to Israeli state, The Guardian reported.

The disclosures about political figures have put Israel under increasing pressure over extent of surveillance, The Guardian said.

But revelations about how repressive states such as Saudi Arabia, the UAE, Azerbaijan and others have used NSO's technology to target human rights lawyers, activists and journalists raise questions for Israel, putting the issue under fresh scrutiny.

The disclosures threaten to put diplomatic pressure on Israel, amid questions over whether it is using the licensing of NSO's spyware for political leverage and allowing the software to be sold to undemocratic countries that are likely to misuse it, the report added.

A recent transparency report released by the NSO Group acknowledged that the company was "closely regulated" by the export control authorities in Israel.

The Defense Export Controls Agency (DECA) within the Israeli Defence Ministry "strictly restricts" the licensing of some surveillance products based on its own analysis of the potential customers from a human rights perspective, the company said, and had rejected NSO requests for export licences "in quite a few cases".

Moreover, NSO was also subject to an "in-depth" regulatory review by Israel on top of its own "robust internal framework".

Within NSO, the process Israel uses to assess whether countries can be sold the technology is considered a "state secret". A person familiar with the process said officials in both Israel's National Security Council and Prime Minister's Office had been known to give their input, The Guardian said.

In the case of Saudi Arabia, sources familiar with the matter said the kingdom was temporarily cut off from using Pegasus in 2018, for several months, following the murder of Jamal Khashoggi, but was allowed to begin using the spyware again in 2019 following the intervention of the Israeli government, the report said.

It is unclear why the Israeli government urged NSO to reconnect the surveillance tool for Riyadh.

"Markets dictate what works, I don't dictate … the only place I have actually intervened … is cybersecurity," Benjamin Netanyahu had said in a press conference in Hungary in 2017, as he stood next to the country's Prime Minister, Viktor Orban, according to the report.

The Guardian said what remains unclear is whether Israel's intelligence agencies might have special privileges with NSO, such as access to surveillance material gathered using its spyware. One person close to the company, who asked to remain anonymous, said it was a frequent topic of speculation. Asked whether Israel could access intelligence gathered by NSO clients, they replied: "The Americans think so."

That view was supported by current and former US intelligence officials, who told the Washington Post, a partner in the Pegasus Project, that there was a presumption that Israel had some access – via a "backdoor" – to intelligence unearthed via such surveillance tools.

John Scott-Railton, a senior researcher at the Citizen Lab at the University of Toronto, said he believed it would be "irresponsible" for a state to allow the large-scale distribution of a powerful surveillance tool such as Pegasus without being able to keep an eye on what was being done with it, the report said.

He said court records had revealed that NSO used servers that were not always located on the premises of the client. "What that means is there's the potential for visibility. And it would be crazy for them [the Israelis] not to have visibility," he said, the report added.

NSO strongly denied that Israel had any access to its customers' systems.

"NSO Group is a private company. It is not a ‘tool of Israeli diplomacy'; it is not a backdoor for Israeli intelligence; and it does not take direction from any government leader," NSO's lawyer said.

In a statement, the Israeli Ministry of Defense said Israel marketed and exported cyber products in accordance with its 2007 Defense Export Control Act and that policy decisions take "national security and strategic considerations" into account, which include adherence to international arrangements, The Guardian said.