What To Know About The Spying Scandal Linked To Israeli Tech Firm NSO

Aug 25, 2021
Originally published on August 26, 2021 5:40 am

Updated August 25, 2021 at 8:03 PM ET

JERUSALEM — Israel takes enormous pride in its high-tech industry. But one of its star cybersecurity companies, NSO Group, is at the center of an international spying scandal that has concerned U.S. officials, and the Israeli government plays a role.

The Pegasus Project, a consortium of international media outlets, says a leaked list of some 50,000 phone numbers showed that governments around the world sought NSO's cellphone hacking technology Pegasus to spy on people or mark them as potential targets, whether inside or beyond their own borders.

It says the phone numbers selected by governments for surveillance belong to a staggering array of potential targets, including political dissidents, human rights activists, 180 journalists in nearly two dozen countries, a Dubai princess escaping her father, the fiancée of slain Saudi journalist Jamal Khashoggi, and 14 heads of state, including French President Emmanuel Macron.

NSO, no stranger to controversy over its spyware, denies any connection to the list of phone numbers, and insists it sells its technology solely to governments to combat terrorism and serious crime. But outrage from France, questions from the U.S. and intensified global scrutiny on NSO has put the Israeli company — and the Israeli government, which vets the company's sales — on the defensive.

"Our concerns over this matter have been raised in meetings with senior Israeli officials," a senior U.S. official told NPR, speaking on condition of anonymity to discuss private diplomatic conversations.

Israeli defense officials announced an investigation and visited NSO's headquarters north of Tel Aviv, then briefed the French defense minister on its efforts. The company told NPR it temporarily suspended some governments' access to its software, declining to name the countries, as it looked into potential abuse. Multiple Israeli news outlets questioned NSO executives as the investigative reports were published last month.

"You didn't know about the software's very wide use against dozens of journalists in dozens of countries, to know what they are doing?" said anchor Ilana Dayan on Israeli Army Radio on July 22. "You didn't know that the ruler of Dubai used Pegasus to track his daughter and wife? ... You also didn't know that your software was installed in the phone of the fiancée of Saudi journalist Jamal Khashoggi, who was murdered by representatives of the regime in Riyadh? All that you didn't know?"

Those questions, critics of Israel's cyber-surveillance industry say, have largely elicited a collective shrug in a country whose economy, security and foreign relations lean heavily on the murky world of cyber espionage and arms exports. NSO has framed the reporting as an anti-Israel campaign, and a company employee argued it is the unpleasant reality that all governments spy.

"Intelligence is a f***ing s****y business," the employee told NPR, speaking on condition of anonymity because company policy states that NSO "will no longer be responding to media inquiries on this matter and it will not play along with the vicious and slanderous campaign."

French President Emmanuel Macron speaks on his mobile phone during a meeting at a European Union summit in Brussels in July 2020. French newspaper Le Monde reported last month that the cellphones of Macron and other French officials in 2019 may have been among potential surveillance targets by NSO spyware.
John Thys / Pool photo via AP

"Sacred cows" of the Israeli economy

NSO stands for the initials of its three founders, who quietly set up the company in 2010.

Israeli journalist Shay Aspril, who was the first to report about NSO in 2012 after the company's first sales to Mexico, warned its spyware could be used against journalists. His 2019 award-winning novel in Hebrew, The Judge, explores the dubious ethics of some Israeli high-tech fields, a reality he says many Israelis overlook.

"The defense industry and the high-tech industry are the two sacred cows of the Israeli economy. The Israeli public in general perceives those industries as creative, bold, profitable, qualities which most people in general tend to appreciate," Aspril told NPR.

The same week that the Pegasus Project's investigative reports about NSO were published, Israel hosted an annual cybersecurity conference in Tel Aviv. Prime Minister Naftali Bennett, a keynote speaker, made no mention of the NSO controversy but spoke about Israel's dominance in the global industry, fueled by military intelligence veterans who learn cybersecurity skills in the country's largely mandatory army service.

"Ultimately, they are thrown into the Israeli society at a young age with huge capabilities, and that is why we are seeing the boom, the high-tech boom," Bennett said.

Israeli tech advocates complain NSO has tarnished Israel's otherwise trusted cyber industry, which helps countries defend against threats. Israeli cybersecurity exports in 2020 were valued at $6.85 billion, according to Tel Aviv University. Palestinian advocates say Israel is a laboratory for spy technology, where young recruits in the military's most secretive intelligence units monitor Palestinians and others in the Middle East, then export their know-how to the private sector.

Whom to blame for the spying?

NSO says it has no control over who is spied upon, but that in recent years the company has tightened its protocols, choosing its clients more carefully and blocking governments from access to the spyware on five occasions. The company won't identify its clients, but The Washington Post reports the company stripped access from Saudi Arabia and Dubai in the United Arab Emirates in the past year.

"The ultimate responsibility is on the one who actually conducts the abuse," NSO general counsel Shmuel Sunray told NPR. "If there is a serious abuse of the human rights, a targeting of a journalist ... just for him per se being a journalist, we would just shut down the system."

The Israeli government passed a law in 2007 regulating the export of cyber technology. "Policy decisions take into account national security and strategic considerations," the Israeli Defense Ministry said in a statement. "In cases where exported items are used in violation of export licenses or end use certificates, appropriate measures are taken. Israel does not have access to the information gathered by NSO's clients."

The Pegasus Project reports NSO has sold its spyware to authoritarian governments and states with limited freedoms, including Hungary, Saudi Arabia and the United Arab Emirates, countries Israel has courted for closer ties, echoing Israel's decades-long history of selling arms to dictatorships to boost its foreign relations.

"NSO commercial interests and Israel's security and international interests were kind of blurred together," says Tehilla Shwartz Altshuler, a researcher at the independent Israel Democracy Institute. "What's bothering me is the fact that all this has been done very far from the public eye of the Israeli public."

In addition to the Defense Ministry investigation, a parliamentary committee said it would consider tighter export controls. Those reviews are taking place behind closed doors.

"Extraordinary audacity and contempt for human rights"

This month, a group of United Nations human rights experts called for a global moratorium on sales of surveillance technology, and demanded answers from NSO and Israel.

"Given the extraordinary audacity and contempt for human rights that such widespread surveillance shows, if the denial of collusion by the NSO Group is to have any credibility at all, the company must disclose whether or not it ever conducted any meaningful human rights due diligence," the experts said. "We also urge Israel, as the NSO Group's home country, to disclose fully what measures it took to review NSO export transactions in light of its own human rights obligations."

Cyberspying isn't just an Israeli phenomenon, and democracies should lay out global rules for regulating it, said David Kaye, former U.N. special rapporteur on freedom of opinion and expression. "It's possible that Israel could be part of the solution to the global problem of the spread of spyware," Kaye told NPR. "But because of its integration into government already, it may make it harder for Israel to move forward on this."

Tech companies against NSO

The most visible pressure against NSO is coming from the tech world. Amazon Web Services told Amnesty International, a partner of the Pegasus Project, it shut down NSO accounts. Before the latest revelations, Facebook-owned messaging app WhatsApp sued NSO for allegedly exploiting the app to infiltrate cellphones, with Google and Microsoft supporting the lawsuit.

Even some Israeli techies are speaking out. From the main stage at the cybersecurity conference in Tel Aviv, Israeli cybersecurity veteran Iftach Ian Amit — formerly hired by companies to hack into their systems, now dedicated to defending them — called on tech companies not to hire former employees of companies like NSO. Though that's been his own practice for years, it was the first time he made it a public call.

"Have a statement that says, 'I'm not going to work with anyone who ever operated in those shady industries.' It's going to cause a very simple supply chain effect. People wouldn't want to work there because they would know this is their last job in the industry," Amit said in a closing keynote address to the audience on July 21, the same day the Israeli prime minister addressed the conference.

In an interview with NPR, Amit said only a few tech leaders in Israel have joined his pledge. "There's an attempt to harp on the patriotic side of things," he said. "It's us versus them. So, you know, if you're not supporting us, you're against, you're anti-Israeli, which is preposterous, of course."

His own tipping point came 10 years ago when a Latin American government agency approached his former company. It revealed a real-world application of NSO's technology spying on a government official's phone, and asked him to develop a similar product. He quit the company soon after, but he believes many other Israeli spyware businesses, not just NSO, supply questionable regimes.

"I am 100% certain that they do have legitimate customers, that they do have work that ends up with putting the right people behind bars and finding them," Amit said. "But I think that there's been a tipping point where greed kind of took over and it was just unscrupulous. You're doing more harm, I think, than good."

Amit knows some former employees of NSO. They'll go out for drinks together. But he says they know he'll never agree to do business with them.

Copyright 2021 NPR. To see more, visit https://www.npr.org.

MARY LOUISE KELLY, HOST:

Israel takes enormous pride in its high-tech industry. But one of its star cybersecurity companies, NSO Group, is the focus of an international scandal. Investigative reports have found NSO software is sought by governments around the world to spy on human rights activists, journalists, even heads of state. NPR's Daniel Estrin reports from Jerusalem on how Israelis are grappling with the revelations and the question of who's responsible.

(SOUNDBITE OF RADIO SHOW, "ARMY RADIO")

SHALEV HULIO: (Speaking Hebrew).

ILANA DAYAN: (Speaking Hebrew).

DANIEL ESTRIN, BYLINE: On Israeli Army radio, an investigative journalist grilled the head of NSO Group about Pegasus, the company's cellphone-hacking software. It gains access to phones without the owner even knowing.

(SOUNDBITE OF RADIO SHOW, "ARMY RADIO")

HULIO: (Speaking Hebrew).

DAYAN: (Speaking Hebrew).

ESTRIN: Journalist Ilana Dayan asks, "you didn't know about the software's very wide use against dozens of journalists and dozens of countries? You didn't know that your software was installed on the phone of the fiancee of Saudi journalist Jamal Khashoggi?"

(SOUNDBITE OF RADIO SHOW, "ARMY RADIO")

DAYAN: (Speaking Hebrew).

ESTRIN: "All that you didn't know?"

(SOUNDBITE OF RADIO SHOW, "ARMY RADIO")

HULIO: (Speaking Hebrew).

ESTRIN: NSO head Shalev Hulio says the software saves lives and that the company only sells to governments to catch terrorists and criminals. He called the allegations a campaign to tarnish the entire Israeli cyber industry and the state of Israel itself. NSO has faced global controversy before, but now it's on the defensive at home.

(SOUNDBITE OF ARCHIVED BROADCAST)

YIGAL UNNA: I'm proud to introduce to you the prime minister of Israel, Naftali Bennett.

ESTRIN: At a cybersecurity conference in Tel Aviv last month, Bennett made no mention of the controversy.

(SOUNDBITE OF ARCHIVED BROADCAST)

PRIME MINISTER NAFTALI BENNETT: (Speaking Hebrew), and good morning.

ESTRIN: Instead, he explained why his tiny nation stands out in the global cybersecurity industry.

(SOUNDBITE OF ARCHIVED BROADCAST)

BENNETT: What we've got in Israel is a bunch of really smart people who at a very young age enter the military, could be in combat units or cyber units. But ultimately, they're thrown into the Israeli society with huge capabilities. And that's why we're seeing the high-tech boom.

ESTRIN: NSO, the initials of its three founders, was created in the shadows in 2010. Israeli journalist Shay Aspril was the first to report about them in 2012. He recently published an award-winning novel in Hebrew about the dubious ethics of some Israeli high-tech, which he says Israelis don't talk about much.

SHAY ASPRIL: One has to understand that the defense industry and the high-tech industry are the two sacred cows of the Israeli economy. The Israeli public perceives those industries as bold, creative, profitable - qualities which most people in general tend to appreciate.

ESTRIN: But Israelis are taking note of global outrage. France, for example, is furious because President Emmanuel Macron's cellphone number reportedly appears on a list of people Morocco sought to target with NSO's spyware. The company told NPR it's now suspended some governments' access to its products. The question is whom to blame for the spying. NSO lawyer Shmuel Sunray spoke with NPR.

SHMUEL SUNRAY: The ultimate responsibility is on the one who actually conducts the abuse.

ESTRIN: He says the company has no control over how the software is used, but in recent years has chosen its customers more carefully and looked into alleged wrongdoing.

SUNRAY: If there is a serious abuse of human rights, a targeting of a journalist for - just for him per se being a journalist, we would just shut down the system. And we have done so five times in the past.

ESTRIN: The Israeli government plays a central role here. It vets NSO's exports because they're considered cyberweapons. Israel reportedly approved NSO sales to authoritarian governments like Hungary, Saudi Arabia and the United Arab Emirates, which Israel was courting for closer ties. Tehilla Shwartz Altshuler of the Israel Democracy Institute.

TEHILLA SHWARTZ ALTSHULER: NSO commercial interests and Israel's security and international interests were kind of blurred together. What's bothering me is the fact that all this has been done very far from the public eye of the Israeli public.

ESTRIN: Cyberspying isn't just an Israeli phenomenon. David Kaye, former U.N. Special Rapporteur on freedom of expression, says democracies need to help lay out global rules for regulating cyber surveillance.

DAVID KAYE: It's possible that Israel could be part of the solution to the global problem of the spread of spyware, but because of its integration into government already, it may make it harder for Israel to move forward on this.

ESTRIN: But the tech industry is acting. Amazon Web Services says it's shut down NSO accounts. WhatsApp is suing the company for allegedly using the messaging app to infiltrate cell phones. Israeli cybersecurity veteran Iftach Ian Amit has called on tech companies not to hire former employees of companies like NSO.

IFTACH IAN AMIT: I am 100% certain that they do have legitimate customers, that they do have work that ends up with putting the right people behind bars and finding them. But I think that there's been a tipping point where greed kind of took over, and it was just unscrupulous. You're doing more harm, I think, than good.

ESTRIN: Israeli defense officials say they're investigating NSO exports. A parliamentary committee says it's considering tighter export controls. These reviews are all happening behind closed doors, even as the global spread of Israeli spy technology is no longer so secret.

Daniel Estrin, NPR News, Jerusalem. Transcript provided by NPR, Copyright NPR.