US defence contractor in talks to take over NSO Group’s hacking technology Stephanie Kirchgaessner https://www.theguardian.com/world/2022/jun/14/nso-group-pegasus-us-l3harris
The US defence contractor L3Harris is in talks to take over NSO Group’s surveillance technology, in a possible deal that would give an American company control over one of the world’s most sophisticated and controversial hacking tools. Multiple sources confirmed that discussions were centred on a sale of the Israeli company’s core technology – or code – as well as a possible transfer of NSO personnel to L3Harris. But any agreement still faces significant hurdles, including requiring the blessing of the US and Israeli governments, which have not yet given the green light to a deal. This story was jointly reported by the Guardian, the Washington Post and Haaretz. If agreed, the deal would mark an astounding turnaround for NSO, less than a year after the Biden administration placed the company on a US blacklist and accused it of acting “contrary to the foreign policy and national security interests of the US”. NSO’s government clients are known to have used the surveillance technology to target journalists, human rights activists, senior government officials in US-allied countries, and lawyers around the world. The Guardian and other media outlets have also detailed how NSO’s surveillance technology, Pegasus, has been used by the company’s government clients to target American citizens, including Carine Kanimba, daughter of the Rwandan dissident Paul Rusesabagina, as well as journalists, activists and US state department officials working abroad. Asked to comment on the talks, an L3Harris spokesperson said: “We are aware of the capability and we are constantly evaluating our customers’ national security needs. At this point, anything beyond that is speculation.” The talks between L3 and NSO were first reported by Intelligence Online. The White House said that it had not been involved in “any way in this reported potential transaction”. In a statement, a senior White House official said: “Such a transaction, if it were to take place, raises serious counterintelligence and security concerns for the US government.” The official also said the US government “opposes efforts by foreign companies to circumvent US export control measures or sanctions, including placement on the US Department of Commerce’s Entity List for malicious cyber activity”. The official said that any US company – particularly a cleared US defence contractor – should be aware that a transaction with a blacklisted company would “not automatically remove a designated entity from the Entity List, and would spur intensive review to examine whether the transaction poses a counterintelligence threat to the US Government and its systems and information, whether other US equities with the defense contractor may be at risk, to what extent a foreign entity or government retains a degree of access or control, and the broader human rights implications”. One person familiar with the talks said that if a deal were agreed, it would probably involve selling NSO’s capabilities to a drastically curtailed customer base that would include the US government, the UK, Australia, New Zealand and Canada – which comprise the “five eyes” intelligence alliance – as well as some Nato allies. The person also said that the deal faced several unresolved issues, including whether the technology would be housed in Israel or the US and whether Israel would be allowed to continue to use the technology as a customer. The person said it was also too soon to confirm the price of any possible deal. The transaction would require US government approval since NSO is on the commerce department’s so-called entity list. Experts said that any such transaction would probably require the creation of a new entity in order to get US approval. Any deal would also face hurdles in Israel. One assumption in the Israeli cyber industry is that it would have to keep oversight of the Israeli-made technology in Israel, and keep all development of Pegasus and personnel in Israel. NSO is regulated by the Israeli ministry of defence, which has had ultimate say over the company’s government clients. Israel has faced intense criticism in the past for agreeing to sell the surveillance technology to countries with poor human rights records, including Saudi Arabia and the United Arab Emirates. NSO, which is being sued by Apple and WhatsApp in US courts, has in the past said it takes all allegations of abuse of its tools seriously, and that it investigates such claims. The Israeli ministry of defence and NSO declined to comment. Any takeover of NSO’s hacking technology would add to L3Harris’s current suite of surveillance tools, which are already sold to US government and law enforcement clients. The company, which is based in Florida and reports about $18bn in annual sales, includes the FBI and Nato as clients. Any potential deal faces stiff opposition from digital rights advocates and human rights groups. John Scott-Railton, a senior researcher at Citizen Lab at the Munk School at the University of Toronto, said he was doubtful that US agencies, and the agencies of the US’s closest allies, would trust NSO technology for their most sensitive operations, and it would therefore more likely be sold to local authorities. “So where would the big market be? I fear the logical consumers would be US police departments. This would be an unprecedented threat to our civil liberties,” he said. The deal would also raise serious questions about the Biden administration’s commitment to holding “bad actors” accountable, Scott-Railton said. “All eyes are on NSO right now. If the White House doesn’t stop this deal, many will conclude that the administration is weak on enforcement, or that they’re cynical and helped a US company pick up NSO at fire-sale prices because it was sanctioned,” he said, adding that any such deal would show that US sanctions did not have teeth and would encourage more investment in the “mercenary hacking space”. Additional reporting by Omer Benjakob from Haaretz, Gur Megiddo from TheMarker, and Ellen Nakashima and Craig Timberg from the Washington Post -- Iw mailing list [email protected] http://sticklist.org/mailman/listinfo/iw_sticklist.org
