Follow us on social

Screen-shot-2021-11-18-at-11.33.55-am

Israel lobbies hard to get controversial spy firm off US blacklist

The NSO Group is starting to face consequences for malicious cyber activity tied to its military-grade software, Pegasus.

Analysis | Middle East

The Commerce Department’s Bureau of Industry and Security recently added the NSO Group  — an Israeli cyber intelligence and security firm — to its Entity List, a trade restriction list comprised of companies or items deemed to threaten American national security or foreign policy interests. The decision has put significant strain on the traditionally tight relationship between the United States and Israel, as the Israeli Defense Ministry has stated it would press the Biden administration to remove the firm from the list despite new allegations of foreign governments using software developed by the NSO Group to target journalists, dissidents, and activists.

The NSO Group develops technology for government agencies, and their premiere military-grade spyware is called Pegasus. The NSO Group has fiercely defended its product, claiming it was intended to prevent and investigate crime that has traditionally been invisible to law enforcement due to end-to-end encryption. Yet mounting evidence shows that the company supplied the Pegasus spyware to foreign governments who then used it to conduct what the Commerce Department deemed “transnational repression.”

Government surveillance evokes scenes of old-fashioned bugging and wiretaps, but Pegasus is “extremely sophisticated spying.” When an agency identifies a target, the target will receive a text message with an accompanying link. Once the target clicks on the link, Pegasus software infects their phone and the government agency can access and extract data, contacts, messages, and phone records as well as switch on the microphone and camera to clandestinely record the target.

In late 2020, a Paris-based journalism nonprofit called Forbidden Stories partnered with Amnesty International to release a target list of 50,000 phone numbers. These phone numbers were concentrated in countries that are clients of the NSO Group with a record of citizen surveillance. The Pegasus Project, an investigation released in July 2021 by 17 media outlets in 10 countries coordinated by Forbidden Stories and Amnesty International, connected 37 phone numbers to attempted or successful hacks of journalists, activists, and dissidents and those close to them.

For example, the project found that the spyware had targeted individuals close to Jamal Khashoggi, the Saudi Arabian journalist and Washington Post columnist who was brutally murdered by agents of the Saudi government while at their consulate in Istanbul. Targets included Khashoggi’s son, friends, and the Turkish prosecutor in charge of his murder investigation. Khashoggi’s fiancée was also targeted in the days after his murder.

More recently, the Associated Press reported that Front Line Defenders, an Ireland-based human rights group, found Pegasus spyware on cell phones that belong to six Palestinian activists. Three of those activists are affiliated with groups that the Israeli defense minister controversially designated as terrorist organizations with little evidence. While it is not clear who infected the activists’ phones, the group is certain the spyware belongs to the NSO Group.

This is not the first time the NSO Group has faced scrutiny over its spyware. In 2016 and 2017, Carmen Aristegui, a prominent investigative journalist in Mexico and one of the earliest targets of the Pegasus malware, received dozens of highly personalized messages from numbers pretending to be the U.S. Embassy, colleagues, and her bank and phone company.

In January 2020, the United Nations released a report that concluded Saudi Crown Prince Mohammed bin Salman most likely used Pegasus malware to hack Jeff Bezos’s phone in 2018 “in an effort to influence, if not silence, The Washington Post's reporting on Saudi Arabia.” Last week, the 9th U.S. Circuit Court of Appeals also denied foreign sovereign immunity to the NSO Group, which means WhatsApp, which is owned by Meta, the parent company of Facebook, can sue the company for Pegasus’s alleged role in targeting 1,400 devices belonging to journalists and dissidents through an exploit in the messaging app.

A few weeks before the United Nations released its explosive report, the Q Cyber Technologies, the company name the NSO Group uses in Israel, contracted Mercury Public Affairs, a global strategy firm in Washington, DC to clean up its image. For a mere $120,000 per month, Mercury Public Affairs would consult on the firm’s public, media, and government relations. Mercury Public Affairs also meticulously logged statements attributed to NSO Group spokespeople into the Foreign Agents Registration Act website, a Department of Justice database that tracks the political activities of foreign principals, and their contents are revealing.

From January 2020 through earlier this month when Mercury Public Affairs cut ties with Q Cyber Technologies, the FARA website lists 99 pieces of informational material the firm disseminated on behalf of the NSO Group and its business practices. In July alone, when the Pegasus Project launched, Mercury Public Affairs filed 14 statements attributed to the NSO Group.

The tone of these comments ranged from shocked outrage over the alleged abuses to venomous contempt for the Project, often making a sales pitch in the same breath as its defense. “If and when NSO will receive a credible proof of misuse of its technologies, it will conduct a thorough investigation, as it always had and always will,” one statement from July 2021 insisted, adding, “NSO products are saving lives and helping governments fight crime and terror.” Repeatedly, the informational materials available on the FARA website exhibited this deny-sell-justify pattern: essentially, national security interests trump human rights concerns.

This pattern jumped off the page into reality again last week. The same day the Associated Press revealed that FLD found Pegasus spyware on activists’ phones, the Israeli Defense Ministry announced its campaign to convince the Biden administration that Pegasus is a vital tool for national security. Israel wants the Commerce Department to remove the NSO Group from the Entity List and stated that the Defense Ministry, which oversees the licensing of the software, would tighten supervision on what government agencies have access to Pegasus. The Defense Ministry said it did not know who used Pegasus to target Palestinian phones, however, and the NSO Group refused to confirm who used the software and insisted they cannot access information on alleged targets.

National security has been used to justify bad behavior in our post-9/11 world, but it is in the true interest of security writ large to stop the proliferation of dangerously invasive spyware to governments with a record of human rights abuses and citizen surveillance. The Commerce Department took a bold, necessary step in adding the NSO Group to its Entity List, and the Biden administration needs to back it up.


Analysis | Middle East
Kim Jong Un
Top photo credit: North Korean leader Kim Jong Un visits the construction site of the Ragwon County Offshore Farm, North Korea July 13, 2025. KCNA via REUTERS

Kim Jong Un is nuking up and playing hard to get

Asia-Pacific

President Donald Trump’s second term has so far been a series of “shock and awe” campaigns both at home and abroad. But so far has left North Korea untouched even as it arms for the future.

The president dramatically broke with precedent during his first term, holding two summits as well as a brief meeting at the Demilitarized Zone with the North’s Supreme Leader Kim Jong-un. Unfortunately, engagement crashed and burned in Hanoi. The DPRK then pulled back, essentially severing contact with both the U.S. and South Korea.

keep readingShow less
Why new CENTCOM chief Brad Cooper is as wrong as the old one
Top photo credit: U.S. Navy Vice Admiral Brad Cooper speaks to guests at the IISS Manama Dialogue in Manama, Bahrain, November 17, 2023. REUTERS/Hamad I Mohammed

Why new CENTCOM chief Brad Cooper is as wrong as the old one

Middle East

If accounts of President Donald Trump’s decision to strike Iranian nuclear facilities this past month are to be believed, the president’s initial impulse to stay out of the Israel-Iran conflict failed to survive the prodding of hawkish advisers, chiefly U.S. Central Command (CENTCOM) chief Michael Kurilla.

With Kurilla, an Iran hawk and staunch ally of both the Israeli government and erstwhile national security adviser Mike Waltz, set to leave office this summer, advocates of a more restrained foreign policy may understandably feel like they are out of the woods.

keep readingShow less
Putin Trump
Top photo credit: Vladimir Putin (Office of the President of the Russian Federation) and Donald Trump (US Southern Command photo)

How Trump's 50-day deadline threat against Putin will backfire

Europe

In the first six months of his second term, President Donald Trump has demonstrated his love for three things: deals, tariffs, and ultimatums.

He got to combine these passions during his Oval Office meeting with NATO Secretary General Mark Rutte on Monday. Only moments after the two leaders announced a new plan to get military aid to Ukraine, Trump issued an ominous 50-day deadline for Russian President Vladimir Putin to agree to a ceasefire. “We're going to be doing secondary tariffs if we don't have a deal within 50 days,” Trump told the assembled reporters.

keep readingShow less

LATEST

QIOSK

Newsletter

Subscribe now to our weekly round-up and don't miss a beat with your favorite RS contributors and reporters, as well as staff analysis, opinion, and news promoting a positive, non-partisan vision of U.S. foreign policy.