NSO Group on shaky footing worldwide

Tamara Nassar Power Suits 15 February 2022

Israeli spyware firm NSO Group is embroiled in a national scandal alleging its technology was used to spy on Israelis. Omar MarquesZUMA Press

Following a particularly bad year, Israeli spyware firm NSO Group is stepping into 2022 on even shakier footing.

After it was almost driven to ruin by lawsuits and blacklists during 2021, the notorious spy company is embroiled in a national scandal alleging its technology was used to spy on Israeli citizens.

The Israeli police used Pegasus, the company’s signature product, to spy on senior government officials, journalists, public figures and protest leaders, Israeli business publication Calcalist recently revealed.

Mayors of several Israeli cities, staff of a major Israeli newspaper, and officials from multiple ministries were among those hacked by the malware.

Former Israeli Prime Minister Benjamin Netanyahu’s inner circle was also targeted, including two of his advisers and his son Avner Netanyahu.

Emi Palmor, the former director-general of the justice ministry, was also hacked by the spyware. Notably, Palmor spent years at Israel’s justice ministry enforcing censorship of Palestinians’ speech before she was hired by Facebook’s oversight board.

The Israeli police were essentially phishing “for intelligence even before any investigation had been opened against the targets, and without judicial warrants,” Calcalist reported.

The Pegasus spyware is one of the most sophisticated tools known in the surveillance industry. Upon successfully installing it on a target’s phone, those doing the spying can extract a terrifying amount of data, including pictures, recordings, screenshots, passwords, and email and text messages.

Hackers can also turn on the camera and record audio remotely, controlling the device at will. Infection can be difficult or impossible to detect for an average user, and has typically required expert analysis.

“The use of Pegasus wasn’t local or limited to a small number of cases,” Calcalist said. It was “one of the most useful tools” used by the Israeli police.

The newspaper described how the technology was used to obtain private information about the sexual activities of at least one activist in order to gain “leverage.”

This is reminiscent of how members of the Israeli military intelligence branch Unit 8200, from which many workers at NSO Group were recruited, previously admitted to prying into the most intimate private data of Palestinians, including financial and sexual information, in order to blackmail them.

Widespread public outcry broke out in Israel and the minister of internal security Omer Barlev reportedly moved to establish a commission to investigate the matter.

Besides needing “to learn exactly what happened,” Prime Minister Naftali Bennett all but endorsed the Israeli police’s use of NSO Group technology to spy on Palestinian citizens of Israel.

“You want a tool like this when you’re fighting crime families and serious offenses,” Bennett said last week.

“I don’t want to discard the tool itself, rather to regulate its use.”

Bennett said such tools were “very important in the war against terror,” but that it was “not intended for widespread ‘phishing’ of Israeli citizens or public figures in the State of Israel.”

If Israel’s self-investigations into its crimes against Palestinians are any indication, NSO Group will receive a slap on the wrist at best, and the probe would serve as a fig leaf to whitewash other such dealings.

NSO Group has worked hand-in-glove with Israel’s defense ministry since its founding and requires its license for sales. The firm reportedly lends itself to cement Israel’s interests abroad.

On Sunday, Tel Aviv daily Haaretz reported that Israel’s international spying and murder agency Mossad used NSO Group’s Pegasus technology to spy on cellphones “unofficially.”

The newspaper said this occurred under former Mossad chief Yossi Cohen, citing unnamed NSO Group employees.

Mossad officials frequented the Herzliya headquarters of the company, near Tel Aviv, the employees added, sometimes bringing “officials from foreign countries as part of an effort to sell them the software,” Haaretz said.
FBI acquires Pegasus

Meanwhile, NSO Group has also been making headlines in US-based publications for other allegations of misuse.

The New York Times Magazine revealed last month how the FBI had purchased spyware technology from NSO Group.

Pegasus was long marketed as a tool that could hack all but American phones. In this way, Israel assured the US that NSO Group’s foreign clients would not spy on Americans.

“But it also prevented Americans from spying on Americans,” The Times said.

So NSO Group made an exception.

It designed a product, called Phantom, that could be sold exclusively to US government agencies and could be used to hack into US phone numbers.

The FBI bought that product, but claims to have never used it against Americans pending figuring out the laws that would allow it to do so.

It’s unclear whether the FBI used the product or not, but it is notable that even while engaging in discussions that spanned “two presidential administrations,” it renewed its subscription with NSO Group.

The magazine does not seem to question the FBI’s claim to have decided “not to deploy the NSO weapons.”
“Bags of cash”

Meanwhile, a former vice president of a California-based telecom company said NSO Group had offered his firm “bags of cash” in exchange for access to global cellular networks.

Gary Miller, who worked for Mobileum at the time, claims to have been on a 2017 call when the offer was made by Shalev Hulio, co-founder of NSO Group, and another affiliated representative.

As of last June, Miller works for Citizen Lab, a Toronto-based research group that has released numerous reports and exposés about NSO Group technology. Analysts at Citizen Lab examine phones to find traces of Pegasus.

Curiously, Miller is a client of Whistleblower Aid, an organization reportedly led by shady figures with prior close ties to the US State Department and the intelligence apparatus.

One of its most prominent recent clients was Frances Haugen, the former Facebook product manager who leaked internal documents that accused the company of harming girls’ body image, among other things.

Haugen was brought before Congress to provide ammunition for those demanding more censorship and control of public discussion on Facebook under the guise of stopping countries like China and Iran from using the platform for nefarious ends – a repurposing of the same old Russiagate narrative.

She was hailed as a heroic “whistleblower.”

It’s unclear why someone like Miller, who is now working for a group that historically exposed NSO Group, is the client of such an outfit.
Safeguards and credibility

In response to lawsuits and press exposés about how its technology was misused to target journalists, human rights defenders and politicians, NSO Group’s defense has remained consistent.

NSO Group has repeatedly stated that it only sells its products to governments and government agencies, and that it implements rigid safeguards to protect against misuse.

The spyware firm’s recent scandals reveal that misuse was more widespread than previously thought.

An unnamed source told Calcalist that NSO Group is more involved in running the spyware than they claim.

The most important information about spying operations and the information obtained from them is generated and held on cloud infrastructure run by NSO Group, not the client, according to the source.

NSO Group therefore cannot fully claim ignorance or lack of responsibility over the misuse of its products. Its services don’t end after the transaction is complete, but entail an ongoing process where the company constantly provides assistance.

This is not a transaction in which NSO Group sends a “CD ROM” to its clients and washes its hands, as economist and researcher Shir Hever recently told The Electronic Intifada Podcast.

Rather, it’s a subscription-based transaction that ensures there is continuous communication and assistance from the firm.

The same source told Calcalist that clients can disable logs and thus hide certain information about spying targets. This suggests that the NSO Group gives license to its clients to spy on whomever they want in the shadows regardless of whether they follow the general PR claim of pursuing “criminals.”

If the current national scandal of NSO Group can tell us anything, it is simply that technology of this sort is ripe for abuse by both inventor and client. Human rights activists and others are bound to suffer the consequences.

Tamara Nassar's blog