Whose phone is still immune to the software of the Israeli company NSO? That question is justified after it emerged this week that even the phones of French President Emmanuel Macron, Moroccan King Mohammed VI, former Belgian Prime Minister Charles Michel, the presidents of South Africa and Iraq and other prominent figures may have been tapped and emptied with NSO’s Pegasus software. Like many other administrators, politicians, civil rights activists and journalists, a collaboration of seventeen media outlets, including The world, The Guardian in The Washington Post.
Much to NSO’s dismay, the whole world is now watching the company and Israel. Although it has been known for some time that NSO provides telephone spyware that can even enable remote microphones and cameras undetected. But new was the scale on which.
The media collective dug up a list of 50,000 numbers of possible targets, although it is not certain that all their phones have been hacked. However, Amnesty International specialists found traces of Pegasus on 37 of 67 phones examined.
The issue raises fundamental questions about the relationship between spyware use and privacy, about where government and intelligence crime fighting turns into human rights violations. But also how to prevent governments from unwittingly extracting sensitive information from any individual of their choice with impunity.
NSO itself acts as if nothing is wrong. It only sells its technology to customers, who use the software to fight crime and terrorism, spokespersons say. The company speaks of “innuendo and slander” and a “complete disregard for the facts”. When someone causes a car accident, the car manufacturer is not blamed, a spokesman told the BBC. NSO said it knew nothing about the list of 50,000 names. According to the NSO website, the revelations are “a well-orchestrated campaign.”
The Israeli government is also in trouble. Since 2007, the Ministry of Defense has always had to grant permission for the export of such technology.
An official investigation has been announced, but Eitay Mack, the Israeli lawyer who unsuccessfully tried to get a court to ban the export of such technology, has little faith in it. “The NSO’s technology is an important tool for Israeli diplomacy,” he says by telephone. “Israel uses it to establish ties with countries, including dictatorships. It’s a great way to gain the trust of the military establishment in such a country.”
The country made good use of it to improve relations with Gulf countries such as the United Arab Emirates and Bahrain. Intelligence cooperation preceded Israel’s recognition by both states last year, a diplomatic triumph for Israel.
“Israel is proud to be so good at spyware,” says Erella Grassiani (University of Amsterdam), who has done extensive research on Israel’s security industry. The government is helping the sector as much as possible. In 2019, it accelerated the procedure for this type of export. Not long before that, Prime Minister Benjamin Netanyahu said: “I think we have to take the risk, and it is a significant risk, of regulating less so that growth can increase.”
NSO is considered the showpiece. Founded over ten years ago by friends Shalev Hulio and Omri Lavie, it grew rapidly. They focused on hacker software for governments. According to Hulio, out of idealism, as an aid to crime fighting. “We built this company to save lives,” he told The Washington Post. According to unconfirmed reports – NSO does not say anything about customers – Mexican drug lord El Chapo would also have been caught like this.
Meanwhile, reports of abuse of the software by authoritarian regimes to track and even kill dissidents surfaced. For example, Saudi Arabia is said to have followed critical journalist Jamal Khashoggi, who was murdered in the Saudi consulate in Istanbul in 2018, and people from his environment. NSO then discontinued its cooperation with Saudi Arabia for some time, but it was resumed in 2019.
The private and public sectors are completely mixed up in Israel when it comes to security
The ties between NSO and the Israeli government are close. Many of the 850 employees worked for Israel’s military intelligence services, most notably the well-known Unit 8200. “The private and public sectors are intermingled in the field of security, also because the government always knows what is being produced and exported,” says Grassiani. “Everyone knows each other at cyber conferences.”
Read alsoPegasus gives itself access to everything on your mobile
NSO customers sign that they only use the Pegasus software for the fight against crime and terrorism. But how do you define that? A critical journalist or civil rights activist in a country like Saudi Arabia is quickly branded as a criminal or terrorist. “NSO’s customers are governments,” Mack says. “Neither NSO nor Israel then asks what exactly they have done with the software. That can be interpreted as interference in internal affairs and such countries do not appreciate it. And NSO and the Ministry of Defense do not really care what they do with it.”
Dual use technology
Although not a party to it, Israel has pledged to respect the 1995 arrangement that controls the export of so-called dual use technology (with civil and military applications). However, it is not binding even for signatories and there is no supervision. The only restriction Israel imposes is no export to countries that are subject to UN sanctions. And those are rare.
“Unlike armored cars or machine guns, which you can physically see if they’ve been delivered illegally, this software is much more difficult to control,” Mack says. “It is easy for NSO and the government to deny that something is wrong.”
The chance of more supervision seems small. In Israel, this is not seen as urgent. The Supreme Court recently refused to hear new petitions against arms sales to dubious regimes. Neither that statement nor the latest uproar about Pegasus stirred much excitement in Israel.
‘Still, the risks of this technology are too great,’ says Grassiani. ‘It is of course nice that El Chapo is being arrested, but is it worth it if people who oppose dictatorships become the victims? That price is too high.”
A version of this article also appeared in NRC Handelsblad on 24 July 2021
A version of this article also appeared in NRC in the morning of July 24, 2021