History
NSO was founded in 2010 by Niv Karmi, Omri Lavie, and Shalev Hulio.[46][47][48] In 2012, the Federal government of Mexico announced the signing of a $20 million contract with NSO.[46] It was later revealed by a New York Times investigation that NSO's product was used to target journalists and human rights activists in the country.[49]
NSO pitched its spyware to the Drug Enforcement Administration (DEA), which declined to purchase it due to its high cost.[50]
In 2015, the company sold surveillance technology to the government of Panama. The contract later became the subject of a Panamanian anti-corruption investigation following its disclosure in a leak of confidential information from Italian firm Hacking Team.[51]
In August 2016, NSO (through its U.S. subsidiary Westbridge) pitched its U.S. version of Pegasus to the San Diego Police Department (SDPD) In the marketing material, Westbridge emphasized that the company is U.S. based and majority owned by a U.S. parent company. A SDPD Sergeant responded to the sales pitch with "sounds awesome". The SDPD declined to purchase the spyware as it was too expensive.[52]
Around 2016, NSO reportedly sold Pegasus software to Ghana.[53]
In June 2018, an Israeli court indicted a former employee of NSO for allegedly stealing a copy of Pegasus and attempting to sell it online for $50 million worth of cryptocurrency.[54]
In August 2018, the human rights group Amnesty International accused NSO of helping Saudi Arabia spy on a member of the organization's staff.[55]
In April 2019, NSO froze its deals with Saudi Arabia over a scandal alleging NSO software's role in tracking murdered journalist Jamal Khashoggi in the months before his death.[56]
In May 2019, messaging service WhatsApp alleged that a spyware injection exploit targeting its calling feature was developed by NSO.[57][58] WhatsApp stated that the exploit targeted 1,400 users in 20 countries, including "at least 100 human-rights defenders, journalists and other members of civil society".[59][60][61] NSO denied involvement in selecting or targeting victims, but did not explicitly deny creating the exploit.[58] In response to the alleged cyberattack, WhatsApp sued NSO.[62]
In June 2019, NSO began setting up a test facility in New Jersey for the FBI which had procured NSO's services, and began testing a version of Pegasus developed for U.S. government agencies to be used on U.S. phones. After two years of deliberations in the FBI and Department of Justice, the FBI decided not to deploy the tools for domestic use in the summer of 2021, with the New Jersey facility laying dormant as of early 2022. The DEA, Secret Service, and United States Africa Command had also held discussions with NSO which however did not proceed beyond that stage.[21]
In April 2020, Motherboard reported about an incident that occurred several years prior in which an NSO employee used a client's Pegasus tool to spy on a love interest (a female personal acquaintance) during a work trip to the UAE. The employee broke into the client's office outside of office hours to use the tool, prompted an alert and an investigation by the client. The employee was detained by authorities, and fired by NSO, Motherboard's sources said. Sources also told Motherboard that NSO leadership held a meeting to prevent similar incidents in the future, and subsequently adopted more rigorous screening of employees that interact with clients.
In July 2020, Motherboard reported that the US branch of NSO was pitching its brand of Pegasus to the US Secret Service during 2018.[63]
In November 2021, the United States added the NSO Group to its Entity List, for acting "contrary to the foreign policy and national security interests of the US" and it effectively bans the sale of hardware and software to the company.[64] The listing deprived NSO of U.S. technology on which NSO relies, crippling its operations.[21][31] Israeli officials subsequently unsuccessfully attempted to get the blacklisting overturned,[18] and NSO reportedly tried and failed multiple times to meet with the U.S. Bureau of Industry and Security to attempt to obtain export waivers.[31]
In December 2021, 86 human rights organisations sent a joint letter calling on the EU to impose global sanctions against NSO Group and seek to "prohibit the sale, transfer, export and import of the Israeli company's surveillance technology" due to the risks NSO's technology poses for human rights globally.[65]
In January 2022, Calcalist published an investigatory piece detailing the widespread unlawful use of Pegasus by the Israeli Police.[66] Although the Israeli Police formally denied this, some senior police officials have hinted that the claims were true.[67] On February 1, the police admitted that there was, in fact, misuse of the software.[68] On February 7, a second Calcalist report revealed that the warrantless surveillance was very widespread, including that of politicians and government officials, heads of corporations, journalists, activists, and Avner Netanyahu, the son of then-Prime Minister, Benjamin Netanyahu.[69] After outcry and calls for a state commission of inquiry, including from the current police commissioner himself, the Minister of Public Security (the minister responsible for the police), Omer Bar-Lev, announced that he will be forming a commission of inquiry, to be chaired by a retired judge, and whose powers will basically be indistinguishable from a state commission.[70]
In September 2023, the Citizen Lab attributed with high confidence that an exploit of iOS 16.6 was being used to install Pegasus spyware on Apple devices without user interaction. Apple said that devices in Lockdown Mode was able to block the loophole and issued an update to fix the vulnerability.[71]
