NSO Group, the Israeli company behind Pegasus spy software, offered by US spies

NSO Group, developer of the most successful and notorious spy software, may be bought by a US military sub-contractor called L3Harris, developer of the famous Stingray kit for spying on mobile phone networks.

There is one “small” problem, however. NSO Group has been blacklisted by the US Department of Commerce as a threat to US national security. Theoretically, that should block any American company from having business ties to NSO Group, let alone something as involved as a move to acquire/take over the Israeli company.

Except that when arguments involving state-level politics and negotiation come into play, anything can happen. A first clue would be the good relations between the US and Israel. By no means are the two countries formal or declared adversaries. Conditions in which the existence of a company willing to do business with any state actor, friend or foe, cannot be ignored for long. Especially if the assistance offered by that company may tilt certain events in an undesirable direction.

Developer of the Pegasus kit, a zero-click hacking suite that allows undetectable infiltration of any common device (e.g. Android or iOS phone), the NSO Group company has already been instrumental in compromising political leaders, human rights activists and inconvenient journalists. In other words, the Israeli company has built a reputation as a mercenary, delivering ultra-sophisticated tools to anyone willing to pay the asking price.

Negotiated in great secrecy, the NSO Group’s move into the US “arsenal” for cyberwarfare would neutralize in one shot the biggest threat to main-stream technology companies like Google, Microsoft, Meta and Apple, pacifying the adversary that has discovered and actively exploited the most severe software vulnerabilities. Or at the very least, it will ensure that the tools created by this very powerful player end up being used only “by the right people”.

The problem is that the arrangement was supposed to be completely secret, with the NSO Group being recruited by the US government without potential adversaries knowing about it, and the highly sophisticated software tools continuing to be sold and used as before, but under the discreet monitoring of US intelligence agencies.

Once the plan has been uncovered, it would not be out of the question for the deal to stall for good, eventually with the NSO Group gradually exiting the public eye as the company’s assets and specialists quietly pass under a new administrator.

L3 Harris representatives reportedly told the Israelis that US intelligence agencies supported the acquisition as long as certain conditions were met. One of the conditions would have been the surrender of the NSO’s “arsenal” of exploits (vulnerabilities that allow Pegasus software to hack mobile phones) to US partners as part of an older arrangement for intelligence sharing between partner countries’ intelligence agencies, called Five Eyes. Apart from the US, the other partners are the UK, Canada, Australia and New Zealand.