After Buying Major Stake in Israeli Cyber-Attack Firm, NSO Group, Global Witness Director Quits Board

Israel’s NSO Group is a world leader in development of malware and other methods of cyber-attack on cellular phones. Earlier this week, its founders announced they were “buying back” their company from its current owners, Francisco Partners.  Their new partner, who would have a minority interest, was Novalpina, a UK private equity firm founded by Stephen Peel, a former Goldman Sachs partner.  But there was a problem…Peel sat on the board of Global Witness, the leading anti-corruption NGO.  It would appear quite unseemly for such an organization to have a sitting director who had bought a major stake in one of the world’s most dangerous and intrusive cyber-warfare companies.

So earlier today, Peel either resigned or was forced off the board.  Global Witness sent me this strange statement it released today about his departure:

Stephen Peel has stepped down as a member of the Global Witness Board.

Typically selfless, Mr Peel made his decision after his private equity firm announced it is supporting the acquisition of the technology company, NSO Group…

In response to the announcement, Global Witness’s board Chair, Mark Stephens said: “Given this technology [NSO Group’s cyber-war malware] exists I would prefer it is run by someone, such as Mr Peel, who is committed to the UN Guiding Principles on Business and Human Rights.”

“As an organisation we have concerns about the potential for the abuse of surveillance technology. The misuse of this kind of technology can have a damaging effect on the work of NGOs and individuals and in the hands of repressive regimes, it can be used to deadly effect.

“Global Witness is committed to doing everything it can to preserve a space for human rights, whistle-blowers, free expression and privacy.”

Stephen Peel said…”Looking forward, I am committed to ensuring NSO adheres to the highest governance practices.”

In this statement, GW’s board chair offers the tepid reply of the temporizer.  For example, I’ve often heard Israeli officials say: if someone has to have nuclear weapons, better it should be a rational, reasonable state like Israel rather than a tyranny like Iran.  Not terribly convincing.  So we in the activist, non-profit world under attack by NSO’s clients should feel safe and reassured that a good guy like Stephen Peel is running the show.  Somehow, he will make NSO shape up and behave decently. Pardon me if I’m skeptical.

Note also, there is no reference to Peel’s actually changing the culture at NSO Group (he can’t as he’s a minority stakeholder).  It appears Peel may be a new fig leaf designed to cover the worst excesses of the company’s technology.

When I saw the phrase claiming that Peel’s stepping down was a “selfless act,” I thought, that has to have been written by Peel himself, or his lawyer.  When you buy a dirty company and step down from a charity board a day later, you’re not performing a selfless act.  You’re either jumping ship to avoid bad PR or being pushed.

Access Now has organized a letter with six other international human rights NGOs protesting Novalpina’s purchase of the NSO stake.

NSO Corporate History

Returning to NSO itself, from a small startup, the two Israeli co-founders, who met in the IDF, have developed the most powerful malware tool, Pegasus.  Once downloaded, it will monitor all functions of the phone.  It intercepts and reads email and text messages, records audio and video, and accesses contact lists.  According to Israel’s business publication, Calcalist, it also “monitors changes in patterns of conversations and correspondence and draws attention to that as well.”

One of the most important financial developments in the company’s history was the $120-million investment by Francisco Partners in 2014, which netted it a 70% share in NSO, making the value of the company then $180-million.  Shortly after that, NSO became embroiled in a repeated series of scandals in which its products were used by intelligence agencies and industries to spy on their enemies.  In Mexico, police surreptitiously monitored the activities of bereaved parents whose children had been the victims of mass murder, journalists also covering this story, and lawyers representing the parents.  Companies criticized by activists because of their damaging products also monitored their enemies.

In Bahrain, the ruling minority Sunni dynasty used Pegasus to break into a leader Shia human rights activist’s phone.  They used the text messages they purloined in a trial against him that resulted in a prison sentence.  Thus NSO facilitated the imprisonment of a human being who did nothing more than peacefully demand his rights as a citizen.  NSO’s response? We follow the highest ethical standards and only permit our products to be used according to the laws of the countries in which our clients work.  When further prodded, they may add that there’s no possible way in which it can monitor the uses of Pegasus after its clients install it.

This, of course is yet another lie, since every software maker accepts responsibility for monitoring and maintaining its products, including upgrading them.  It would be quite easy to form an enforcement division within NSO which, as in a bank risk management unit, would monitor clients and how they used the product to ensure they didn’t violate any laws or ethical protocols.  In fact, NSO refuses to contemplate these provisions because it would limit the efficacy of the product.  You can’t produce the most potent cyber-attack malware in the world and then tell clients their use is limited to prescribed purposes.  That would decrease the value of the product and its pricing.

Finally, and worst of all, NSO sold its products of the dreaded Saudi secret police, who hacked the phone of at least one Jamal Khashoggi fellow dissident and thereby monitored both his and the murder victim’s communications.  It seems probable that Pegasus was instrumental in permitting the Saudi killers to know where Khashoggi would be and when he would be there including right up to the moment he stepped foot in the embassy in Istanbul.  That makes NSO an accessory to murder.

All these developments appear to have spooked Francisco, which began trying to unload the company in 2016.  It entertained two separate buy-out offers from Blackstone Partners and Verint, which would’ve valued NSO at the much sought-after unicorn level of $1-billion.  But at least one and possibly both suitors were scared off by the level of scandal and notoriety surrounding NSO’s business.

Novalpina and Peel: the Backstory

The company’s new financial partner is Novalpina, a UK private equity firm founded by former Goldman Sachs and TPG alum, Stephen Peel.  There are disputed figures being thrown around about the company’s current valuation.  English language media claim it is $1-billion.  But Calcalist says the valuation is $800-million (though it is the only media source to offer that figure).  If we go by the $1-billion figure, Francisco received $700-million, a tidy 600% profit for a five-year investment.  The two founders, Shalev Hulio and Omri Lavie invested a total of $100-million in the buyout.  They will assume control of the half of Francisco Partners interest.  Novalpina will take the other half, leaving it with approximately a 35% interest in the company.  NSO’s co-founders and other senior executives already owned 20% of the company.  With their new shares, Hulio and Lavie (and corporate executives) will control 55% of the company, a controlling interest.

Peel is an interesting figure in both the private equity and charitable world.  After attending Oxford, he joined Goldman Sachs.  Later, he became a leading dealmaker for the U.S. private equity firm, TPG.  Along the way, he developed an inclination to fund charitable projects designed to address global economic inequity.  Some bios describe him as a board member of the anti-corruption NGO, Global Witness.  A cached page from the website dated February 8th says Peel is director of GW’s finance and compensation committee.  The current version of the board of directors page seems to have been cleansed of any reference to Peel.

Peel is also a board member of the UK Progressive Policy Institute.  Its mission embraces a wide range of public policy goals including improving the environment, addressing poverty, and promoting good government.  He even devotes himself to social development in Africa, specifically Burundi.  He is a devout Europhile and opponent of Brexit.  Though I don’t know his politics in a UK context, his Twitter feed leans Labour, rather than Social Democrat.

His wife owns the posh Serpentine Gallery in London catering to the world’s wealthiest art-buying clients.  Together they make a dashing, high-flying couple.

Peel Provides Liberal Patina for NSO Worst Excesses

In short, NSO has found the perfect new financial partner, a leading young private equity investor with a liberal patina.  He will be a perfect antidote to all the troublesome human rights activists and lawyers who will be suing the company in legal venues around the world for years to come.  He will be able to tell the world: I’m a true humanist and NSO is a white knight company fighting bad guys wherever they may be.  It’s not the dirty-ops outfit you’ve been reading about.

Part of this clean-up of its image included two articles written by Israel’s leading intelligence correspondent, Ronen Bergman.  The articles, of course, ignored ethical controversies and focussed on the supposed critical role played by NSO in monitoring El Chapo and facilitating his capture.  Bergman hears this straight from the horse’s mouth in a personal interview with the company’s CEO.  However, neither one offers any concrete evidence to support this claim.  Given NSO’s history of lying about the use of its products, believing this new claim seems an iffy proposition.

Novalpina’s statement announcing the purchase contained the typical pablum:

Novalpina Capital partner Stefan Kowski said, “NSO Group has an impressive management team that has developed best-in-class, proprietary technologies sold to approved governments and intelligence agencies to help tackle terrorism and organised crime. We look forward to supporting NSO’s leadership as they continue to grow the business.”

It’s as if Peel and his partners haven’t been reading newspapers for the past eight years, which would’ve easily disproved this clueless statement.  An even more mind-boggling statement came from the exiting company, Francisco:

NSO chairman and Francisco Partners operating partner Eran Gorev said, “We are very proud of the company’s contribution to the global war against terrorism and crime, and the many thousands of lives that have been saved thanks to the company’s technology. Since our investment in NSO Group, the company has…implement[ed] a best-in-class business ethics framework and bringing in independent experts to ensure the company was operating in accordance with the highest ethical standards.

This is worse than moral amnesia.  The key question here is who will assume liability for the future lawsuits.  If there is a payout, it could be in the tens or hundreds of millions depending on which jurisdiction victims use to sue.  That could take a big bite out of profits and make this look like a far less attractive proposition.

Gideon Levy has penned a good column on this general subject, For Israel’s Golden Intel Boys, It Starts With Terror and Ends With Greed.