


The White House was embarrassed last week when it came out that a high-tech snafu had been made two years ago and may still not be rectified.
Back in November 2021, NSO Group Technologies, the Israel-based maker of powerful spyware, was placed on the Commerce Department’s “blacklist” — meaning US companies should not work with NSO.
Advertisement
The Israeli-based hacking firm is, and was then, infamous for products that had been used, depending on which side you were on, for both good and nefarious.
Pegasus —NSO’s covert spyware launched in 2016 — was used by Mexico to nab cartel boss Joaquin “El Chapo” Guzmán and, in Europe, to stop acts of terrorism.
But Mexico and the United Arab Emirates had also used Pegasus to keep tabs on dissidents and civil-rights activists, while Saudi Arabia allegedly spied on Jamal Khashoggi, as well as his wife, son and friends. The Washington Post journalist was killed by Saudi officials in 2018.
Just five days after NSO was blacklisted, according to the New York Times, a deal was allegedly struck between representatives for the US government and the tech firm which gave the US access to the company’s geolocation tool — which can invisibly track any cell phone, anywhere in the world.
Advertisement
On the US side, the agreement was apparently made by a straw purchaser using a fake name.
Two weeks ago, via an executive order from President Biden, commercial hacking software was banned for use by government agencies.
It specifically singled out products that could be employed against America by foreign governments — including NSO’s Pegasus, which reportedly can surreptitiously suck emails, photos, videos and texts out of phones, with the hacked party being completely unaware — as a national security threat.
Advertisement
The White House, according to the Times, pleaded ignorance about whether or not the geolocation tool is in use.
“It’s been acquired by a US based party, but we don’t have enough evidence to confirm whether it is a government contractor or a government agency,” Jason Blessing, the Jeane Kirkpatrick visiting research fellow at the American Enterprise Institute, told The Post. “Either way this is damning for the administration.”

Ron Diebert, director of Citizen Lab in University of Toronto, an independent research group focused on digital security issues, believes that NSO’s software has no place in the United States and beyond.
Advertisement
“They are a mercenary spyware firm that has been connected to widespread human rights abuse uncovered by my group over recent years,” Diebert told The Post. “The market is unregulated and governments have been using the technology to hack into the phones of journalists, human rights defenders, lawyers, and friends and family members of targets.”
NSO did not respond to an interview request from The Post.
The firm has inauspicious beginnings, having started in a converted chicken coop on an Israeli kibbutz, around 2010. Its name borrows the first initials of the company’s founders: Niv Karmi, Shalev Hulio and Omrie Lavie.

Pals Hulio and Lavie first found success in the early 2000s tech boom with MediaAnd, a product placement start-up. But when the bubble burst and the 2008 recession hit, they saw a chance to reinvent themselves; it was also the year Apple’s iPhone launched
According to the Guardian, Hulio had served in the Israeli Defense Force, where he developed a technological savvy, including the ability to hack into phones. A European intelligence agent is said to have called him to inquire why he was not using his skills “to collect intelligence.”
That apparently inspired an idea.
The duo’s next project was CommuniTake, software that allowed cellphone IT workers to access and control a customer’s device — albeit with permission.
Advertisement

This eventually led to a tool that would let users do the same covertly, which, with the help of Karmi — a former Mossad operative — they marketed to intelligence agencies.
Their product, able to crack Apple and WhatsApp, was a game changer. It also resulted in litigation from those two companies.
“NSO Group licenses its products only to government intelligence and law enforcement agencies for the sole purpose of preventing and investigating terror and serious crime,” the company says on the governance page of its its website.
Advertisement
But Amnesty International has said it linked compromised smartphones to NSO, a report that was independently validated by Citizen Lab.

There are plenty of spyware firms around the world but, according to Blessing, “NSO sets itself apart. Pegasus has the ability to compromise mobile devices without user interaction. Somebody does not have to click on a link for it to be activated. They have cracked mainstream apps.”
“People don’t understand how intelligence works,” Hulio told MIT Technology Review. “It’s not easy. It’s not pleasant. Intelligence is a sh–y business full of ethical dilemmas.”
Advertisement
Speaking with “60 Minutes,” Shalev Hulio said of the Khashoggi controversy: “I can tell you very clearly, we had nothing to do with this horrible murder.”
Told by Leslie Stahl that the product was supposedly sold to the Saudis for $55 million, he smiled and said, “Don’t believe newspapers.”

Hulio then insisted, “We are only selling Pegasus in order to prevent crime and terror.”
Advertisement
On “60 Minutes,” in 2019, company co-president Tommy Shahar said, “I think people that are not part of criminal or terrorist activities have nothing to worry about [in regard to NSO’s offerings].”
Nevertheless, it has allegedly been used against American interests.
In July 2021, a Washington Post investigation found evidence of Pegasus on 23 phones belonging to journalists, human rights activists and politicians.

Advertisement
Months later, nine State Department employees, involved with affairs in Uganda, had their iPhones hacked by an unidentified rogue operator.
Reuters’s sources alleged that NSO software was used in the attack. NSO said, “If our investigation shall show these actions indeed happened with NSO’s tools, such customers will be terminated permanently and legal action will be taken.”
Last August, Hulio stepped down as CEO as part of a company restructuring.
Blessing remains concerned by the company’s products: “The technology is phenomenal. But it should worry us all in terms of our privacy and democracy around the world.”