The Washington Post

U.S. and E.U. officials: Some wary of NSO’S links to Israel.

- BY SHANE HARRIS AND SOUAD MEKHENNET John Hudson and Craig Timberg contribute­d to this report.

The Israeli company NSO Group has earned a reputation among national security experts around the world as a best-inclass manufactur­er of surveillan­ce technology capable of secretly gathering informatio­n from a target’s phone.

But U.S. and European security officials regard the company with a degree of suspicion despite the ability of its technology to help combat terrorists and violent criminals. In interviews, several current and former officials said they presumed that the company, which was founded by former Israeli intelligen­ce officers, provides at least some informatio­n to the government in Jerusalem about who is using its spying products and what informatio­n they’re collecting.

“It’s crazy to think that NSO wouldn’t share sensitive national security informatio­n with the government of Israel,” said one former senior U.S. national security official who has worked closely with the Israeli security services and, like others, spoke on the condition of anonymity to candidly describe intelligen­ce operations. “That doesn’t mean they’re a front for the Israeli security agencies, but government­s around the world assume that NSO is working with Israel.”

Though NSO is a private company, U.S. officials have long suspected that some informatio­n it collects is also viewed by the Israeli government, said a current U.S. official familiar with the matter.

U.S. intelligen­ce agencies don’t use NSO’S products, current and former U.S. officials said.

The informatio­n NSO products can mine is the same, though, that the world’s intelligen­ce agencies gather from their targets.

The company’s Pegasus surveillan­ce tool can penetrate cellphones and steal emails, call records, social media posts, user passwords, contact informatio­n, pictures, videos, sound recordings and browsing histories. All of this can happen without a user even touching her phone or knowing that she has received a mysterious message from an unfamiliar person.

The Israeli Defense Ministry reviews and must approve the license of NSO’S products to foreign government­s. The founders of NSO are former members of Israel’s elite Unit 8200, which conducts electronic surveillan­ce and is analogous to the U.S. National Security Agency.

A spokespers­on for Israel’s Ministry of Defense said that “Israel does not have access to the informatio­n gathered by NSO’S clients.” The company also denies that there is any Israeli government access.

The laws governing surveillan­ce of journalist­s and civil rights activists are far stricter in the United States and many European countries than in the Middle Eastern nations where NSO has licensed its products. The company has publicly acknowledg­ed that in some instances, its clients have used NSO tools to monitor individual­s who fall outside the scope of what the company has deemed appropriat­e use — legal surveillan­ce of criminals, including terrorists.

Forbidden Stories, a Parisbased journalism nonprofit, and Amnesty Internatio­nal, a human rights group, had access to a list of more than 50,000 phone numbers concentrat­ed in countries known to surveil their citizens and also known to have been clients of NSO Group. The list does not identify who put the numbers on it, or why, and it is unknown how many of the phones were targeted or surveilled.

The two nonprofits shared the

informatio­n with The Washington Post and 15 other news organizati­ons worldwide that have worked collaborat­ively to conduct further analysis and reporting over several months. Forbidden Stories oversaw the investigat­ion, called the Pegasus Project, and Amnesty Internatio­nal provided forensic analysis but had no editorial input.

The numbers on the list are unattribut­ed, but reporters were able to identify more than 1,000 people spanning more than 50 countries through research and interviews on four continents: several Arab royal family members, at least 65 business executives, 85 human rights activists, 189 journalist­s, and more than 600 politician­s and government officials — including cabinet ministers, diplomats, and military and security officers, as well as several heads of state and prime ministers.

A senior European intelligen­ce official said that since 2019, his country had confirmed that about 1,400 people in 20 countries had been spied on using NSO software.

The official acknowledg­ed that NSO tools can “be crucial in the fight against organized crime and terrorism,” but he said that incidents of foreign government­s using the software, particular­ly NSO’S Pegasus tool, to monitor journalist­s and human rights ac

tivists had sullied the company’s reputation in his country.

“It is difficult for us to justify the need for such tools if the news about the abuse of using software like Pegasus, for targeting civil society and journalist­s, is increasing,” the official said.

The license of NSO’S products is regulated by government authoritie­s in three countries from which it exports: Bulgaria, Cyprus and Israel, where NSO has its headquarte­rs.

In Israel, the Defense Ministry, which runs the Defense Export Controls Agency, can restrict the licensing of the company’s surveillan­ce tools and conducts its own review of the human rights records of countries that NSO wants to turn into customers, according to Israeli government records as well as interviews with people knowledgea­ble of the process. In that respect, NSO’S surveillan­ce technology is regulated like a weapon under Israeli law.

The company says it reviews potential customers according to its human rights policy, which it wrote to align with United Nations guidance to businesses on how to protect human rights.

“We license our product only to vetted and legitimate government agencies for the sole and exclusive use in preventing and investigat­ing serious crime, including terrorism,” the company’s policy states.

In response to questions from The Post about officials’ belief that NSO shares informatio­n with Israel, the company said in a written statement: “We vehemently deny the suggestion­s that the Israeli Government monitors the use of our customers’ systems, which is the type of conspiracy theory that our critics peddle. Such claims are part of the salacious narrative about NSO Group that has been strategica­lly concocted by several closely aligned special interest groups, among them your ‘anonymous officials’ who say they ‘assume’ something is taking place.”

In an interview following publicatio­n of some of the Pegasus Project’s findings, NSO’S cofounder and CEO, Shalev Hulio, disputed that the more than 50,000 phone records were connected to the company or its products.

Hulio said he was “very concerned” about what he read in the news articles produced by the Pegasus Project. “Every allegation about misuse of the system is concerning me. It violates the trust that we’re giving the customer. . . . We are investigat­ing everything.” Hulio added that NSO has terminated contracts with two of its customers in the last 12 months because of concerns about human rights abuses.

The spokespers­on for Israel’s Ministry of Defense said the country regulates the exports of products like NSO’S in accordance with Israeli law, adding: “In cases where exported items are used in violation of export licenses or end use certificat­es, appropriat­e measures are taken. Israel does not have access to the informatio­n gathered by NSO’S clients.”

In NSO’S first-ever Transparen­cy and Responsibi­lity Report, published in late June, the company said it had refused to do business with certain countries that “have inadequate countrylev­el protection­s in place to confidentl­y prevent product misuse, or where the rule of law creates an unduly high risk of misuse.”

Without identifyin­g the countries it has turned down, NSO said that from May 2020 through April 2021, it rejected about 15 percent of potential new opportunit­ies to license its Pegasus surveillan­ce tool over “human rights concerns that could not be resolved.” To date, NSO has turned down more than $300 million in sales opportunit­ies as a result of its internal review processes, the company said, which are separate from the Israeli government’s review.

But once a country has gotten a license for or obtained NSO’S products, the onus is largely on that government to ensure the software is used in accordance with the country’s own laws governing surveillan­ce, which vary widely.

Current and former U.S. officials said that since Israel reviews and grants export permission for NSO’S products, the Israeli government knows who NSO’S clients are. The relationsh­ip between NSO, as well as other Israeli technology firms, and the country’s military and security services is much tighter and arguably more symbiotic than parallel private sector-government connection­s in the United States, current and former officials said.

A former member of Israel’s security services said young Israelis who perform their compulsory military service in the intelligen­ce branches see their training the way Americans view college. The government is developing their technologi­cal skills with the expectatio­n that they will go to work in the private sector or start companies — but there is also an understand­ing they will maintain close relationsh­ips with the military and the security services, the former official said.

The Pegasus Project is a collaborat­ive investigat­ion that involves more than 80 journalist­s from 17 news organizati­ons coordinate­d by Forbidden Stories with the technical support of Amnesty Internatio­nal’s Security Lab.

 ?? JACK GUEZ/AGENCE-FRANCE PRESSE/GETTY IMAGES ?? An NSO sign appears on a building near Tel Aviv in 2016. The Israeli Defense Ministry reviews and must approve the license of NSO’S products to foreign government­s.
JACK GUEZ/AGENCE-FRANCE PRESSE/GETTY IMAGES An NSO sign appears on a building near Tel Aviv in 2016. The Israeli Defense Ministry reviews and must approve the license of NSO’S products to foreign government­s.

Newspapers in English

Newspapers from United States