Calls to 'Stop the Deal' as US Military Contractor Moves to Buy NSO Group

Digital rights advocates sounded the alarm on Tuesday following reports that U.S. military contractor L3Harris Tech plans to acquire NSO Group, a private Israeli firm widely condemned for selling surveillance technology to repressive governments across the globe.

"The spyware peddled by NSO Group is unsafe in any hands."

NSO Group's Pegasus spyware has been used to crack down on dissidents and journalists, worsening "human rights abuses around the world, from Palestine to El Salvador to Poland," advocacy group Access Now said in a statement urging U.S. President Joe Biden's administration to "stop the deal."

"NSO Group should not be rewarded for its facilitation of human rights violations and dangerous business practices with a lucrative offer from a U.S. defense contractor," said Natalia Krapiva, tech-legal counsel at Access Now. "Such a deal is a blatant attack on human rights globally and U.S. national security interests. And, it would send a strong signal to the financial sector that the spyware industry is worth the risk, opening the floodgates to more investor support."

Last July, a collaborative investigative endeavor called the Pegasus Project identified the phone numbers of more than a dozen world leaders on a leaked list of over 50,000 potential targets of NSO Group's hacking tool, which also included reporters, organizers, and government critics. These findings prompted key stakeholders to take a number of actions against the company.

Biden's Commerce Department responded forcefully in early November by adding NSO Group and Candiru, a similar enterprise, to its blocked "Entity List" for undermining U.S. national security interests. This blacklisting, which prohibits U.S. firms from selling technology to the pair of Israeli surveillance companies, was described by The New York Times as "the strongest step an American president has taken to curb abuses in the global market for spyware, which has gone largely unregulated."

The move was "so consequential that it reportedly pushed NSO to the brink of financial collapse, leading the firm to consider shutting down Pegasus and selling the company in its entirety," according to Access Now. "Earlier this year, U.S. venture capital firm Integrity Partners was in its final stage of negotiations to purchase NSO."

A month after the federal ban was announced, Apple, which had just sued NSO Group, notified at least 11 U.S. State Department officials that their iPhones had been infected with Pegasus spyware. A week later, the White House unveiled a proposal for the U.S. and its allies to better regulate the sale of surveillance technology and a group of congressional lawmakers also called for targeted sanctions against NSO Group and other spyware firms.

"If the Biden administration allows this deal to go forward," Access Now argued Tuesday, "not only would it put U.S. national security at risk, it would also directly undermine President Biden's own democracy agenda."

During the so-called Summit for Democracy that he hosted in December, Biden "announced the launch of the Export Controls and Human Rights Initiative--a long-overdue plan for the U.S. and allies to develop human rights-based export controls 'to curb the proliferation of technology that has been misused by governments for repression,'" the group continued. "Also, at this month's RightsCon summit, U.S. Secretary of State Antony Blinken stressed the importance of holding abusive tech companies accountable."

Therefore, Krapiva tweeted, Biden and Blinken "should know better." She implored the duo to "stick to your publicly announced human rights commitments" by preventing L3Harris Tech from buying NSO Group.

David Kaye, a clinical professor of law at the University of California, Irvine, and former United Nations special rapporteur, echoed Access Now, arguing on social media that "an American purchase of NSO Group defies logic--and national security, given what the U.S. government has already said about NSO."

Kaye approvingly cited a Twitter thread compiled by John Scott-Railton, a senior researcher at the University of Toronto's Citizen Lab.

In addition to being "bad for U.S. national security and counterintelligence [and] atrocious for human rights," wrote Scott-Railton, the Biden administration would harm its own "democracy agenda" if it lets the deal proceed.

According to Scott-Railton, bringing NSO Group--which is staffed largely by foreign intelligence service officers and has a track record of infiltrating the U.S. government and major corporations--closer to the U.S. military establishment could put critical information in jeopardy.

It's "doubtful," he continued, that L3Harris Tech or any other military contractor could "exercise meaningful control over NSO."

As for the argument that a U.S.-based firm acquiring NSO could make the country safer, Scott-Railton warned that "NSO is not the only game in town. It would send a blinking signal to the financial sector: The spyware industry is worth the risk. Leading to a growth push from investors. And more national security risk to the U.S."

Peter Micek, general counsel at Access Now, meanwhile, stressed that "the spyware peddled by NSO Group is unsafe in any hands."

"Access Now and our partners reject the proposal for a U.S. firm to buy this sanctioned company," said Micek. "It is as an affront to human rights and the Biden administration's expressed commitments to 'digital democracy.'"

Reports of L3Harris Tech's plan to acquire NSO Group come as Biden prepares to travel to Israel in July and less than a week after Axiosreported that Israeli officials are pressuring his administration to remove the spyware company from the Commerce Department's blacklist.

Kaye said last week that "rolling back strong action against NSO and for digital security would be awful--and completely unjustified."

Scott-Railton, for his part, noted that the Biden administration "earned goodwill and trust from cybersecurity and human rights communities by holding NSO accountable."

It's "hard to imagine they'd squander it and alienate partners in Biden's initiatives on authoritarianism," he added. "But own goals are always possible."

Whistleblower Edward Snowden--who has lived in Russia with asylum protections since leaking classified materials on U.S. government mass surveillance in 2013--responded to the Pegasus Project's initial revelations by advocating for an end to the spyware trade.

Three U.N. special rapporteurs soon joined him in demanding a global moratorium on the sale, transfer, and use of surveillance technology, something that Access Now supports "until international rules are in place to prevent abuse."