Latest: Middle East Eye published my new piece on the failure of Israel’s cyber-sabotage campaign against Iran. Please give it a read.
Frontline Defenders published a major report that six Palestinian human rights staff members working for NGOs designated by the Israeli defense ministry as terror groups, were hacked by NSO Group’s Pegasus spyware. Apparently, the hack was part of this campaign to criminalize the advocacy efforts of the Palestinian NGOs. It sought compromising information which would buttress the government’s claim that they are affiliates of the banned Popular Front for the Liberation of Palestine (PFLP), and funnel donations to fund its terror activities.
Recent reports published by The Intercept and 972 Magazine indicated that a dossier compiled by Israeli intelligence and circulated to the Biden administration in an attempt to justify the terror designation, did not contain any specific evidence to support these charges. Apparently knowing this, the Israelis sought to uncover further information from the hacked staff members telephone communications, which might compromise them and their employers. The effort seems to have failed as none of the material in the reports appears to come from the compromised phones.
Ronen Bergman just published a Ynet report on the incident which reveals critical hitherto unknown details about both the Pegasus hack and Israel’s response to the US blacklisting of NSO. Commerce Department decision is part of a campaign by the Biden administration to signal its overall disapproval of Israeli government policy toward the Palestinians. The US intended this to be a shot across Israel’s bow.
Until now, media reports did not specify which NSO client targeted the Palestinian human rights workers. But Bergman offers strong evidence that it was the Shin Bet:
The Frontline Defenders report includes a detailed timeline [regarding the hacks] that not only offers overwhelming evidence that the Shin Bet is using Pegasus to penetrate the phones of human rights activists, but [attests to] a much broader conspiracy.
Though he did not refer to “Palestinian” human rights activists, he might just as well have. In a watered-down version of his report published by the NY Times, Bergman implicitly ties the attack to the Shin Bet, noting that while foreign clients of NSO may not target Israeli or Palestinian phone numbers, Israeli government agencies (such as the Shin Bet) may do so.
Even if the Palestinian NGOs, the three digital rights groups that uncovered the Pegasus outbreak, and the journalists who reported it cannot directly point to the culprit – it is clear to everyone that it is Israel, that is, the Shin Bet.
…The stipulations of the arms export license granted by the Ministry of Defense to NSO state that only the Israeli security services are allowed to monitor telephones with Israeli numbers, and the Israeli telephone prefix (as well as the Palestinian prefix) is blocked from all other corporate clients. In other words, no other country in the world other than Israel, is permitted to spy on…Al-Haq [and the other Palestinian NGOs]…
NSO and Shin Bet Hack US Citizen
AP reports that one of the six Palestinian staff members is a US citizen:
Ubai Aboudi, a 37-year-old economist and U.S. citizen….runs the seven-person Bisan Center for Research and Development in Ramallah…one of the six groups Gantz slapped with terrorist designations on Oct. 22.
NSO and the Shin Bet, in utilizing Pegasus to violate the privacy of a US citizen, has offered the Biden administration red flag evidence to bolster the Commerce Department’s claim that the company not only violated human rights protections, but conflicted with US national security interests.
Bergman describes an Israeli national security apparatus which was shocked by the Commerce Department announcement. He describes the response as “What the fuck?!” Though Israel was thrown back on its heels by this, it has decided to mount a vigorous campaign against the Biden administration (Bergman uses the term “war”), intending to remove NSO from the blacklist. It will soon convene an all-hands-on-deck meeting of officials from the defense, foreign affairs, justice ministries, and prime minister’s office to plot a strategy to address the damage caused and repair it.
It’s critical to note, as I have here in the past, that Israeli cyber-security companies like NSO, Candiru, Circles, Cellebrite and Anyvision, are not just discreet commercial entities divorced from the State. They comprise a network of willing accessories who advance Israeli security interests globally, in addition to their own corporate profits. So when the State calls upon them, they offer their services. When these cyber-warefare companies face obstacles like the US blacklist, the state comes to their aid.
Bergman confirms this symbiotic relationship:
…The company’s biggest backer, the government of Israel, considers the software a crucial element of its foreign policy and is lobbying Washington to remove the company from the blacklist, two senior Israeli officials said Monday.
His anonymous Israeli source feigns shock that the US could contemplate that Israel could condone such behavior:
If the United States is accusing NSO of acting against its interests, the officials said, then it is implicitly accusing Israel, which licenses the software, of doing the same.
Doubtless, these officials would have us share in their shock at such an outrageous possibility. But that is indeed what Israel and NSO have done. They’ve sabotaged US telecommunications companies like Whatsapp. As an aside, the US 9th Circuit today dismissed NSO’s attempt to throw out the lawsuit the US company filed against it. The former argued that because it was an instrument of foreign governments (i.e.. its clients), and they are immune under the Sovereign Immunities Act, that therefore NSO enjoyed the same immunity.
In further jeopardizing American interests, it enabled spying on a senior US diplomat. It played a key role in the murder of Jamal Khashoggi, who was a Washington Post columnist. And now they’ve hacked a Palestinian-American US citizen.
The Israeli defense ministry office which regulates and licenses the export of cyber-security products, has never denied an export permit to any of these businesses. The ministry is not in the business of overseeing the companies and determining that they adhere to ethical standards. Rather, it is in the business of promoting the products and facilitating their distribution globally. In one case, it even acted as a middleman between the security services of a Gulf state and NSO.
Bergman ominously concludes his Ynet report:
This is not just a mobilization for a [single Israeli] commercial company, but a war concerning a number of key, secret and highly sensitive issues that concern senior Israeli security officials and the security of the State.
IDF Maintains Massive “Blue Wolf” Facial Recognition Database of Palestinians
The Washington Post reported yesterday that the IDF has compiled a massive database of scores, if not hundreds of thousands of Palestinian faces in a database used for security purposes. It determines which individuals to arrest and who will be permitted entry to Israel. There are several versions of the program called variously White or Blue Wolf. This is the online promotional content the army offers the troops to encourage them to participate:
Doing all we can to prevent the next terror attack!
Serving in Judea and Samaria? A new unit will turn you into a Blue Wolf!
Israel has also mounted thousands of security cameras and sensors throughout the West Bank to monitor the movement of Palestinians. Israeli soldiers involved in the program claim that the surveillance equipment can also view the interiors of Palestinian homes. In many cases, IDF units were tasked with taking the photographs of individual Palestinians as they patrolled the streets. These photos were downloaded via cell phone app to a Blue Wolf database. Some units took as many as 1,000 photos in a single week. Their commanders turned the process into a competition and offered winners special prizes.
The images are part of a larger database which links them to extensive personal dossiers on each individual. That in turn allows Israeli authorities to give each person their own grade or category, which govern decisions like making arrests of suspects or approving them for entry into Israel.
Blue Wolf is reminiscent of the mass surveillance programs instituted by Chinese law enforcement, which installed millions of cameras throughout the country and registered almost all citizens in such databases. The authorities even give individuals social-credit scores concerning their standing:
China’s social-credit scoring is best understood not as a single system but as an overarching ideology: encompassing punishments and rewards, to improve governance and stamp out disorder and fraud. Commercial schemes mostly handle the perks, state schemes the punishments. Both work in concert to encourage socially responsible behavior.
But they are undeniably intrusive. Government agencies compile and share data on judgments against individuals or companies. Fail to pay a fine or court-ordered compensation, or default on your debts, and you will be put on the “List of Untrustworthy Persons.” Blacklisted individuals cannot make “luxury purchases,” such as high-speed rail and air tickets or hotel rooms. Five million people have been barred from high-speed trains and 17 million from flights under the scheme, according to the official website. “The ripple effect on every part of your life becomes a multiplier on punishments,” says professor Frank Pasquale, a Big Data expert at the University of Maryland.
The technology is used even more intrusively to monitor millions of Uighurs in the restive Xinjiang province. It is a critical element in the massive experiment in social control, including concentration camps which imprison and “re-educate” detainees to rid them of any Muslim separatist or political aspirations.
I have not been able to determine whether Blue Wolf was developed by the IDF itself or by an Israeli facial recognition company. It’s worth noting that the Post article does point to AnyVision, an Israeli cyber-security/facial recognition company, which is involved in this field:
In 2019, Microsoft invested in an Israeli facial recognition start-up called AnyVision [which] work[ed] with the army to build a network of smart security cameras using face-scanning technology throughout the West Bank. (Microsoft said it pulled out of its investment in AnyVision during fighting in May between Israel and the Hamas militant group in Gaza.)
Also in 2019, the Israeli military announced the introduction of a public facial-recognition program, powered by AnyVision, at major checkpoints where Palestinians cross into Israel from the West Bank. The program uses kiosks to scan IDs and faces, similar to airport kiosks used at airports to screen travelers entering the United States. The Israeli system is used to check whether a Palestinian has a permit to enter Israel, for example to work or to visit relatives, and to keep track of who is entering the country, according to news reports. This check is obligatory for Palestinians…
Balance the above with claims made by AnyVision’s chief marketing officer, Dean Nicholls, e-mailed me:
Former U.S. Attorney General Eric Holder and his team at Covington & Burling have completed their audit of AnyVision. The available evidence demonstrated that AnyVision’s technology has not previously and does not currently power a mass surveillance program in the West Bank that has been alleged in media reports
Either Nicholls is entirely ignorant of the activities of his own company in the West Bank, or he’s lying. I suppose the operative phrase in the above statement is “available evidence.” Everyone knows that when a law firm is paid hundreds of thousands of dollars by a company to undertake such an “audit,” the former is extremely careful to limit the scope of the investigation to exclude evidence that might force a finding unpalatable to the client. AnyVision wanted a clean bill of health and Holder dutifully provided it. That is by no means a conclusive finding that any reasonable person might accept.
Though the IDF has its own capability through its AMAN military intelligence division or through its SIGINT Unit 8200 to develop Blue Wolf, it’s possible it would partner with a private company as well.
Palestinian Guinea Pigs Exploited to Field Test Tools of Israeli Repression
I’ve written extensively here about the “selling” of the Israeli surveillance state. NSO’s Pegasus spyware was developed directly via the expertise of Unit 8200 cyber-hackers schooled in the tools which spy on Palestinians, and invade every aspect of their daily lives. The Israeli state uses Palestinians as guinea pigs to field test not only weapons used in conventional warfare, but cyber-weapons used in the digital realm, an increasingly dominant new form of warfare. The tools of the surveillance state impose control over the captive Palestinian population and suppress its political aspirations. They serve to maintain the illegal Occupation, crush resistance, and defer any solution to the Israeli-Palestinian conflict.
NSO Group and projects like Blue Wolf also serve as templates for other states around the world who see Israel as a pioneer in the field of militarizing social control. These countries (NSO has at least 50 different nation-state clients) not only buy and use these spy tools, but they import all of the Israeli values which undergird them.
Israel has lost any claim to be a democracy like western nations with which it likes to compare itself. Democratic principles like freedom of the press, religion and speech have virtually disappeared. The right to privacy has also been fatally compromised by the needs of the national security state. Any state which imports Israeli surveillance technology is also importing the warped ideology that inspired it.
Nor are Palestinians the only victims. All Israeli citizens, including Jews, are subject to this massively intrusive regime. Calcalist recently published They See Everything You Do, noting:
Israel is becoming a surveillance state: countless cameras and surveillance devices record our every step, our internet traffic and every online purchase. They store this information in huge databases most of which are unsecured – and some of which have already been misused….The public space has become the realm of Big Brother.
Major American cities like Boston and San Francisco have already banned the use of facial recognition technology. Others are considering similar legislation. However, Anyvision has many US clients. According to Reuters, they include:
Los Angeles hospital Cedars-Sinai, oil giant BP, Macy’s, home improvement chain Menards, Mercedes-Benz, facilities of the Houston Texans and Golden State Warriors sports teams, casino operators MGM Resorts International and Cherokee Nation Entertainment.
If we want to see where this sort of intrusive technology can take us, we have only to look at the degraded status of Palestinians.
My warning above also relates to the Biden administration blacklisting of NSO Group, which a cyber-rights group called one of the world’s leading “digital-predators.” NSO and all companies like it (many of the Israeli ones listed above) must be driven out of business. There should no room for mass surveillance on a captive civilian populace in a democratic society.