DONATE: If you value my reporting stories you often cannot read either in Israeli or US media outlets based on my Israeli national security sources, please support this valuable work. I have a Facebook fundraiser which enables you to make a tax-deductible donation to my fiscal sponsor (Independent Arts & Media), which funds my unique brand of journalism. You may also donate via Paypal.
NSO Group, the world’s premier cyber-surveillance company, is beginning to look more and more like a corporate corpse with each new shovel full of dirt piled onto its casket. The latest news reported by Reuters says the iPhones of eight US State Department officials were hacked by its Pegasus malware. These officials serving in the US embassy in Uganda, had maintained contacts with the Ugandan opposition during a contested national election. The news was conveyed to the US government and the victims by Apple, which tracked the infections and presence of the malware on the phones.
Though none of the media reports named the party responsible for the attack, this appears to follow a common scenario in which the intelligence services of repressive regimes (Uganda has been ruled by dictators for decades–the current one has been in power for 35 years) purchase the malware for millions or tens of millions and employ it to target human rights activists or political dissidents engaged in legitimate civic activities. Clearly, Ugandan authorities wanted to know which political opponents were meeting with the Americans either to keep an eye on them, or compile dossiers that could be used to imprison them or attack them. Indeed, the leader of the main opposition party tweeted that Apple had notified him that his iPhone had been attacked:
When you wake up to a threat notification from @Apple that your iPhone is being targeted then you know that cyber terrorism from state sponsored cyber terrorists is real. pic.twitter.com/1uZ9eIf1FR
— Norbert Mao (@norbertmao) November 24, 2021
Haaretz declares that the most likely clients who mounted this operation are Uganda or Rwanda. The latter is a known client previously reported as a customer of NSO. But there are no known instances in which one country purchased Pegasus and permitted another country to use it. Indeed, that would be a violation of the company’s terms of service and grounds for termination of the contract. Which leaves only Uganda the most likely suspect.
The report follows Apple filing a lawsuit against NSO for the thousands of attacks against its devices by the company’s malware. It faces a similar lawsuit filed by Whatsapp’s parent, Facebook after Pegasus exploited the text messaging feature to infect 1,400 human rights activists, mainly in Gulf states. Numerous such victims of NSO’s technology have been imprisoned, tortured, and even murdered with the help of these cyber-predatory tools.
The response of the company and the Israeli government was decidedly different in this incident compared to past attacks exposed by the media. Instead of denying outright that its products were used in the hacks, NSO said that “it was not aware” that Pegasus had been used and that it was immediately canceling the contracts of those clients who used it in this case. The Israeli embassy in the US released a statement full of feigned outrage:
“Cyber products like the one mentioned are supervised and licensed to be exported to governments only for purposes related to counter-terrorism and severe crimes,” an embassy spokesperson said. “The licensing provisions are very clear and if these claims are true, it is a severe violation of these provisions.”
This is ironic considering that the Israeli defense ministry has for years routinely approved such export licenses to over 45 countries without engaging in any serious review process. The only thing that has changed now is that the world is in an uproar over the severe violations of human rights, and Israel realizes that this will also tarnish its own image as well as the company’s.
This news, added to the blacklist imposed by the US Commerce Department on NSO dumps a few more shovel-fulls of dirt on the company’s casket. Now, its IPO, which had been planned for around this time, has been delayed, its recently installed CEO has resigned, $300-million in loans is coming due for repayment, and recruitment of new hires has come to a standstill according to founder Shalev Hulio. Though the Israeli government announced a full-court press to get the blacklisting revoked, this appears increasingly unlikely.
80 global human rights NGOs released a statement demanding the European Union invoke sanctions on the Israeli company, after the Israeli Shin Bet employed Pegasus to attack the phones of six Palestinian rights organizations which the government planned to designate as terror groups:
We are writing following credible revelations that Israeli NSO Group’s Pegasus Spyware was used to hack the devices of six Palestinian human rights activists – the latest in a growing series of reports about human rights abuses linked to the use of NSO technology – to urge that the EU takes serious and effective measures against NSO Group, including the designation of the entity under the EU’s global human rights sanctions regime.
…The EU’s global human rights sanctions regime allows the EU to adopt targeted sanctions against entities deemed responsible for violations or abuses that are “of serious concern as regards the objectives of the common foreign and security policy”, including violations or abuses of freedom of peaceful assembly and of association, or of freedom of opinion and expression…these rights have been repeatedly violated using NSO technology…The use of spyware by abusive governments can also facilitate extrajudicial, summary or arbitrary executions and killings, or enforced disappearance of persons…
The EU should follow suit and urgently put NSO on its global sanction list and take all appropriate action to prohibit the sale, transfer, export, import and use of NSO Group technologies, as well as the provision of services that support NSO Group’s products, until adequate human rights safeguards are in place.
Those clods of dirt thud ever louder on the casket in the grave NSO has dug for itself.
