Black Cube Targets Cyber-Security NGO at Behest of Leading Israeli Malware Maker

The Israeli TV news magazine, Uvdah and the NY Times have collaborated on, and amplified a major story originally published by AP. It documents an elaborate, and ultimately unsuccessful sting operation on the Canadian cyber-security NGO, Citizen Lab (CL).  The latter is the key organization which has exposed a series of malware attacks by various hacking outfits whose government, police, and intelligence clients, use the surveillance products to spy on citizen activists.  Citizen Lab has documented the use of the Israeli dirty ops company, NSO Group’s Pegasus malware by Mexican and Gulf (and many other) government agents to spy on, and even kill dissidents who seek to expose official corruption and who seek the reform their political systems.

Until recently, NSO satisfied itself merely with issuing template statements denying responsibility for any “misuse” of its products, claiming they were only intended to help solve crimes and deter terror attacks.  Any use that did not conform to those protocols, the company claimed, was outside its scope and not its fault.  Such denial rang hollow considering that it would be easy for NSO to write into its contracts much more specific language governing use of Pegasus; along with monitoring of such use to ensure it was done properly.  Naturally, it prefers not to limit such use as it would make the product less desirable for the nefarious purposes it is currently utilized.  Interestingly, the company has never provided a list of any real crimes or terror attacks Pegasus has thwarted.  Naturally, one has to ask whether the malware isn’t really designed primarily to spy on citizens pursuing their legitimate rights to protest wrongs committed by their governments.

However, more recently NSO felt compelled to escalate its response to such attacks against its hacking activities.  That’s because Saudi intelligence agents used Pegasus to track the communications between two dissidents working against the regime abroad.  One of them, the Washington Post journalist, Jamal Khashoggi, was later murdered by Saudi assassins dispatched by the Crown Prince, Mohammed ibn Salman, and his underlings.  It is exceedingly possible that Pegasus had infected either sets of cell phones used by both activists and permitted the killers to track the victim up to the very moment he set foot in the Saudi embassy, where he was ultimately murdered.  This unexpected (one assumes) development has forced the Israeli dirty ops outfit to up the ante.  Instead of issuing pro forma statements, it determined it had to go on the counter-attack and seek out damaging information it could use against its enemies.  Hence this ill-fated sting operation.

• Save

In this case, two operatives identified by Uvdah as working on behalf of another Israeli commercial investigations company, Black Cube, approached Citizen Lab staff posing as business clients interested in donating to the NGO’s work (in one case); and in exploring potential commercial uses of the doctoral research of another CL staff member (in the second).  The first approach raised the suspicions of the targeted staff member, who warned his colleagues.  When the second Black Cube agent approached, they were prepared and embedded AP reporters in the restaurant where the meeting occurred between the spy and the CL staff member.

This second agent has been identified as a retired Israeli defense ministry official, Aharon Almog Aloussin.  It’s worth keeping in mind that Israeli intelligence agencies, especially the Mossad, are known to favor recruiting western olim because of their usefulness in penetrating western societies using their native origin as a cover story.  In this case however, Aloussin’s spycraft was of such feeble-quality it’s doubtful any self-respecting spy outfit would recruit or hire him.  But you just never know.

It’s incontrovertible that Aloussin was working on behalf of Black Cube.  The articles linked above note that he played the same role in an earlier attempted sting against a company involved in litigation with a rival.  Aloussin was definitively identified as the operative who met with company officials in a failed attempt to elicit damaging information that would harm its legal case.  Numerous news articles have documented that this and similar stings were perpetrated by Black Cube in its investigatory activities for clients.

During these meetings with Citizen Lab, conversation revolved around a few subjects: why did the NGO “selectively” target the Israeli company? Did it do so because of a special animus toward Israel?  Does CL harbor any specific anti-Israel or anti-Semitic agenda in its work?  The first staff member targeted, who is a Syrian refugee, was also asked about his Muslim religious beliefs and whether he harbored anti-Israel hostility.

While these approaches have been widely ridiculed for their clownishness, it’s rather shocking that Black Cube, which boasts of its roster of former Israeli Shabak and Mossad agents on its payroll, would display such amateurishness in its operations.  Given its supposed ability to recruit the cream of the crop of intelligence agents, why does it recruit a retired defense ministry clerk who can’t even keep straight the questions he’s supposed to ask his target?  This also raises the question, why does any commercial client hire such an outfit to pursue its interests?  But apparently sleazebags like NSO Group, Harvey Weinstein, and apparently even the Trump campaign, are compelled to seek out such dirt on their enemies and rivals.  As long as there are sleazy clients there will be sleazy operatives greedy for the cash they offer for these assignments.

If you examine the goals of NSO Group in hiring Black Cube and the information they were seeking to elicit from Citizen Lab, it represents a classic expression of Israeli paranoia and victimhood.  Rather than confront the ethical disaster that their business model represents, they prefer to deflect censure onto red-herring issues like anti-Israelism or anti-Semitism.  In truth, it wouldn’t matter whether Pegasus was a Russian, Chinese or Iranian product. Citizen Lab would pursue and expose its use regardless of the national or religious identity of those who produced it.   The sort of hoax perpetrated by these two Israeli companies perfectly illustrates the fraud on which their business models (and much of Israeli policy toward the Palestinians) is based.  Just as they all operate in the ethical shadows, utilizing methods and tactics which cross the line into crime and murder, they manufacture a smokescreen of lies and deception designed to avoid blame.

It’s also worth remembering that though both Israeli companies are privately held, their operations easily bleed into official intelligence operations of the Israeli state.  Their personnel largely derive from the military-intelligence apparatus, the products and services they offer derive from state-sponsored operations.  And in some cases these products and services may even be utilized by the state in pursuit of these interests.  Though such official connections would be concealed by all parties to the extent possible.  As I’ve written before, such companies are extensions of state power and objectives.  That is, the state sees benefit for itself in their operations, while the companies themselves understand that their private interests sometimes, perhaps often, overlap with those of the state.

Finally, for the sake of full disclosure, both NSO Group and Black Cube deny involvement in this scheme.  That’s not surprising. But it’s also worth noting that Black Cube in particular denied it spied on behalf of Harvey Weinstein, despite the fact that his attorney, David Boies, admitted he hired the company at the recommendation of Ehud Barak.  So, you can see how much such denials are worth.  Also, there is no direct evidence so far that NSO hired Black Cube for this operation. But given how closely the questions of the spies tracked the Israeli hacking outfit, it seems almost certain that someone working directly or indirectly on NSO’s behalf orchestrated this bit of opera bouffe.