'The Battle for the World’s Most Powerful Cyberweapon' diff viewer (1/2)

This article is from the source 'nytimes' and was first published or seen on January 28, 2022 10:24 (UTC). It last changed over 40 days ago and won't be checked again for changes.

You can find the current article at its original source at https://www.nytimes.com/2022/01/28/magazine/nso-group-israel-spyware.html

The article has changed 4 times. There is an RSS feed of changes available.

Previous version 1 2 3 Next version

Previous version 1 2 3 Next version

Version 1	Version 2
The Battle for the World’s Most Powerful Cyberweapon	The Battle for the World’s Most Powerful Cyberweapon
2022-01-28 18:50:17 UTC	2022-01-29 05:24:19 UTC (about 11 hours later)
	To hear more audio stories from publications like The New York Times, download Audm for iPhone or Android.
In June 2019, three Israeli computer engineers arrived at a New Jersey building used by the F.B.I. They unpacked dozens of computer servers, arranging them on tall racks in an isolated room. As they set up the equipment, the engineers made a series of calls to their bosses in Herzliya, a Tel Aviv suburb, at the headquarters for NSO Group, the world’s most notorious maker of spyware. Then, with their equipment in place, they began testing.	In June 2019, three Israeli computer engineers arrived at a New Jersey building used by the F.B.I. They unpacked dozens of computer servers, arranging them on tall racks in an isolated room. As they set up the equipment, the engineers made a series of calls to their bosses in Herzliya, a Tel Aviv suburb, at the headquarters for NSO Group, the world’s most notorious maker of spyware. Then, with their equipment in place, they began testing.
The F.B.I. had bought a version of Pegasus, NSO’s premier spying tool. For nearly a decade, the Israeli firm had been selling its surveillance software on a subscription basis to law-enforcement and intelligence agencies around the world, promising that it could do what no one else — not a private company, not even a state intelligence service — could do: consistently and reliably crack the encrypted communications of any iPhone or Android smartphone.	The F.B.I. had bought a version of Pegasus, NSO’s premier spying tool. For nearly a decade, the Israeli firm had been selling its surveillance software on a subscription basis to law-enforcement and intelligence agencies around the world, promising that it could do what no one else — not a private company, not even a state intelligence service — could do: consistently and reliably crack the encrypted communications of any iPhone or Android smartphone.
Since NSO had introduced Pegasus to the global market in 2011, it had helped Mexican authorities capture Joaquín Guzmán Loera, the drug lord known as El Chapo. European investigators have quietly used Pegasus to thwart terrorist plots, fight organized crime and, in one case, take down a global child-abuse ring, identifying dozens of suspects in more than 40 countries. In a broader sense, NSO’s products seemed to solve one of the biggest problems facing law-enforcement and intelligence agencies in the 21st century: that criminals and terrorists had better technology for encrypting their communications than investigators had to decrypt them. The criminal world had gone dark even as it was increasingly going global.	Since NSO had introduced Pegasus to the global market in 2011, it had helped Mexican authorities capture Joaquín Guzmán Loera, the drug lord known as El Chapo. European investigators have quietly used Pegasus to thwart terrorist plots, fight organized crime and, in one case, take down a global child-abuse ring, identifying dozens of suspects in more than 40 countries. In a broader sense, NSO’s products seemed to solve one of the biggest problems facing law-enforcement and intelligence agencies in the 21st century: that criminals and terrorists had better technology for encrypting their communications than investigators had to decrypt them. The criminal world had gone dark even as it was increasingly going global.
But by the time the company’s engineers walked through the door of the New Jersey facility in 2019, the many abuses of Pegasus had also been well documented. Mexico deployed the software not just against gangsters but also against journalists and political dissidents. The United Arab Emirates used the software to hack the phone of a civil rights activist whom the government threw in jail. Saudi Arabia used it against women’s rights activists and, according to a lawsuit filed by a Saudi dissident, to spy on communications with Jamal Khashoggi, a columnist for The Washington Post, whom Saudi operatives killed and dismembered in Istanbul in 2018.	But by the time the company’s engineers walked through the door of the New Jersey facility in 2019, the many abuses of Pegasus had also been well documented. Mexico deployed the software not just against gangsters but also against journalists and political dissidents. The United Arab Emirates used the software to hack the phone of a civil rights activist whom the government threw in jail. Saudi Arabia used it against women’s rights activists and, according to a lawsuit filed by a Saudi dissident, to spy on communications with Jamal Khashoggi, a columnist for The Washington Post, whom Saudi operatives killed and dismembered in Istanbul in 2018.
None of this prevented new customers from approaching NSO, including the United States. The details of the F.B.I.’s purchase and testing of Pegasus have never before been made public. Additionally, the same year that Khashoggi was killed, the Central Intelligence Agency arranged and paid for the government of Djibouti to acquire Pegasus to assist the American ally in combating terrorism, despite longstanding concerns about human rights abuses there, including the persecution of journalists and the torture of government opponents. The D.E.A., the Secret Service and the U.S. military’s Africa Command had all held discussions with NSO. The F.B.I. was now taking the next step.	None of this prevented new customers from approaching NSO, including the United States. The details of the F.B.I.’s purchase and testing of Pegasus have never before been made public. Additionally, the same year that Khashoggi was killed, the Central Intelligence Agency arranged and paid for the government of Djibouti to acquire Pegasus to assist the American ally in combating terrorism, despite longstanding concerns about human rights abuses there, including the persecution of journalists and the torture of government opponents. The D.E.A., the Secret Service and the U.S. military’s Africa Command had all held discussions with NSO. The F.B.I. was now taking the next step.
As part of their training, F.B.I. employees bought new smartphones at local stores and set them up with dummy accounts, using SIM cards from other countries — Pegasus was designed to be unable to hack into American numbers. Then the Pegasus engineers, as they had in previous demonstrations around the world, opened their interface, entered the number of the phone and began an attack.	As part of their training, F.B.I. employees bought new smartphones at local stores and set them up with dummy accounts, using SIM cards from other countries — Pegasus was designed to be unable to hack into American numbers. Then the Pegasus engineers, as they had in previous demonstrations around the world, opened their interface, entered the number of the phone and began an attack.
This version of Pegasus was “zero click” — unlike more common hacking software, it did not require users to click on a malicious attachment or link — so the Americans monitoring the phones could see no evidence of an ongoing breach. They couldn’t see the Pegasus computers connecting to a network of servers around the world, hacking the phone, then connecting back to the equipment at the New Jersey facility. What they could see, minutes later, was every piece of data stored on the phone as it unspooled onto the large monitors of the Pegasus computers: every email, every photo, every text thread, every personal contact. They could also see the phone’s location and even take control of its camera and microphone. F.B.I. agents using Pegasus could, in theory, almost instantly transform phones around the world into powerful surveillance tools — everywhere except in the United States.	This version of Pegasus was “zero click” — unlike more common hacking software, it did not require users to click on a malicious attachment or link — so the Americans monitoring the phones could see no evidence of an ongoing breach. They couldn’t see the Pegasus computers connecting to a network of servers around the world, hacking the phone, then connecting back to the equipment at the New Jersey facility. What they could see, minutes later, was every piece of data stored on the phone as it unspooled onto the large monitors of the Pegasus computers: every email, every photo, every text thread, every personal contact. They could also see the phone’s location and even take control of its camera and microphone. F.B.I. agents using Pegasus could, in theory, almost instantly transform phones around the world into powerful surveillance tools — everywhere except in the United States.
Ever since the 2013 revelations by Edward Snowden, a former National Security Agency contractor, about U.S. government surveillance of American citizens, few debates in this country have been more fraught than those over the proper scope of domestic spying. Questions about the balance between privacy and security took on new urgency with the parallel development of smartphones and spyware that could be used to scoop up the terabytes of information those phones generate every day. Israel, wary of angering Americans by abetting the efforts of other countries to spy on the United States, had required NSO to program Pegasus so it was incapable of targeting U.S. numbers. This prevented its foreign clients from spying on Americans. But it also prevented Americans from spying on Americans.	Ever since the 2013 revelations by Edward Snowden, a former National Security Agency contractor, about U.S. government surveillance of American citizens, few debates in this country have been more fraught than those over the proper scope of domestic spying. Questions about the balance between privacy and security took on new urgency with the parallel development of smartphones and spyware that could be used to scoop up the terabytes of information those phones generate every day. Israel, wary of angering Americans by abetting the efforts of other countries to spy on the United States, had required NSO to program Pegasus so it was incapable of targeting U.S. numbers. This prevented its foreign clients from spying on Americans. But it also prevented Americans from spying on Americans.
NSO had recently offered the F.B.I. a workaround. During a presentation to officials in Washington, the company demonstrated a new system, called Phantom, that could hack any number in the United States that the F.B.I. decided to target. Israel had granted a special license to NSO, one that permitted its Phantom system to attack U.S. numbers. The license allowed for only one type of client: U.S. government agencies. A slick brochure put together for potential customers by NSO’s U.S. subsidiary, first published by Vice, says that Phantom allows American law enforcement and spy agencies to get intelligence “by extracting and monitoring crucial data from mobile devices.” It is an “independent solution” that requires no cooperation from AT&T, Verizon, Apple or Google. The system, it says, will “turn your target’s smartphone into an intelligence gold mine.”	NSO had recently offered the F.B.I. a workaround. During a presentation to officials in Washington, the company demonstrated a new system, called Phantom, that could hack any number in the United States that the F.B.I. decided to target. Israel had granted a special license to NSO, one that permitted its Phantom system to attack U.S. numbers. The license allowed for only one type of client: U.S. government agencies. A slick brochure put together for potential customers by NSO’s U.S. subsidiary, first published by Vice, says that Phantom allows American law enforcement and spy agencies to get intelligence “by extracting and monitoring crucial data from mobile devices.” It is an “independent solution” that requires no cooperation from AT&T, Verizon, Apple or Google. The system, it says, will “turn your target’s smartphone into an intelligence gold mine.”
The Phantom presentation triggered a discussion among government lawyers at the Justice Department and the F.B.I. that lasted two years, across two presidential administrations, centering on a basic question: Could deploying Phantom inside the United States run afoul of long-established wiretapping laws? As the lawyers debated, the F.B.I. renewed the contract for the Pegasus system and ran up fees to NSO of approximately $5 million. During this time, NSO engineers were in frequent contact with F.B.I. employees, asking about the various technological details that could change the legal implications of an attack.	The Phantom presentation triggered a discussion among government lawyers at the Justice Department and the F.B.I. that lasted two years, across two presidential administrations, centering on a basic question: Could deploying Phantom inside the United States run afoul of long-established wiretapping laws? As the lawyers debated, the F.B.I. renewed the contract for the Pegasus system and ran up fees to NSO of approximately $5 million. During this time, NSO engineers were in frequent contact with F.B.I. employees, asking about the various technological details that could change the legal implications of an attack.
The discussions at the Justice Department and the F.B.I. continued until last summer, when the F.B.I. finally decided not to deploy the NSO weapons. It was around this time that a consortium of news organizations called Forbidden Stories brought forward new revelations about NSO cyberweapons and their use against journalists and political dissidents. The Pegasus system currently lies dormant at the facility in New Jersey.	The discussions at the Justice Department and the F.B.I. continued until last summer, when the F.B.I. finally decided not to deploy the NSO weapons. It was around this time that a consortium of news organizations called Forbidden Stories brought forward new revelations about NSO cyberweapons and their use against journalists and political dissidents. The Pegasus system currently lies dormant at the facility in New Jersey.
An F.B.I. spokeswoman said that the bureau examines new technologies “not just to explore a potential legal use but also to combat crime and to protect both the American people and our civil liberties. That means we routinely identify, evaluate and test technical solutions and services for a variety of reasons, including possible operational and security concerns they might pose in the wrong hands.” The C.I.A., the D.E.A., the Secret Service and Africa Command declined to comment. A spokesman for the government of Djibouti said the country had never acquired or used Pegasus.	An F.B.I. spokeswoman said that the bureau examines new technologies “not just to explore a potential legal use but also to combat crime and to protect both the American people and our civil liberties. That means we routinely identify, evaluate and test technical solutions and services for a variety of reasons, including possible operational and security concerns they might pose in the wrong hands.” The C.I.A., the D.E.A., the Secret Service and Africa Command declined to comment. A spokesman for the government of Djibouti said the country had never acquired or used Pegasus.
In November, the United States announced what appeared — at least to those who knew about its previous dealings — to be a complete about-face on NSO. The Commerce Department was adding the Israeli firm to its “entity list” for activities “contrary to the national security or foreign policy interests of the United States.” The list, originally designed to prevent U.S. companies from selling to nations or other entities that might be in the business of manufacturing weapons of mass destruction, had in recent years come to include several cyberweapons companies. NSO could no longer buy critical supplies from American firms.	In November, the United States announced what appeared — at least to those who knew about its previous dealings — to be a complete about-face on NSO. The Commerce Department was adding the Israeli firm to its “entity list” for activities “contrary to the national security or foreign policy interests of the United States.” The list, originally designed to prevent U.S. companies from selling to nations or other entities that might be in the business of manufacturing weapons of mass destruction, had in recent years come to include several cyberweapons companies. NSO could no longer buy critical supplies from American firms.
It was a very public rebuke of a company that had in many ways become the crown jewel of the Israeli defense industry. Now, without access to the American technology it needed to run its operations — including Dell computers and Amazon cloud servers — it risked being unable to function. The United States delivered the news to Israel’s Ministry of Defense less than an hour before it was made public. Israeli officials were furious. Many of the headlines focused on the specter of an out-of-control private company, one based in Israel but largely funded offshore. But authorities in Israel reacted as if the ban were an attack on the state itself. “The people aiming their arrows against NSO,” said Yigal Unna, director general of the Israel National Cyber Directorate until Jan. 5, “are actually aiming at the blue and white flag hanging behind it.”	It was a very public rebuke of a company that had in many ways become the crown jewel of the Israeli defense industry. Now, without access to the American technology it needed to run its operations — including Dell computers and Amazon cloud servers — it risked being unable to function. The United States delivered the news to Israel’s Ministry of Defense less than an hour before it was made public. Israeli officials were furious. Many of the headlines focused on the specter of an out-of-control private company, one based in Israel but largely funded offshore. But authorities in Israel reacted as if the ban were an attack on the state itself. “The people aiming their arrows against NSO,” said Yigal Unna, director general of the Israel National Cyber Directorate until Jan. 5, “are actually aiming at the blue and white flag hanging behind it.”
The Israelis’ anger was, in part, about U.S. hypocrisy: The American ban came after years of secretly testing NSO’s products at home and putting them in the hands of at least one country, Djibouti, with a record of human rights abuses. But Israel also had its own interests to protect. To an extent not previously understood, Israel, through its internal export-licensing process, has ultimate say over who NSO can sell its spyware to. This has allowed Israel to make NSO a central component of its national-security strategy for years, using it and similar firms to advance the country’s interests around the world.	The Israelis’ anger was, in part, about U.S. hypocrisy: The American ban came after years of secretly testing NSO’s products at home and putting them in the hands of at least one country, Djibouti, with a record of human rights abuses. But Israel also had its own interests to protect. To an extent not previously understood, Israel, through its internal export-licensing process, has ultimate say over who NSO can sell its spyware to. This has allowed Israel to make NSO a central component of its national-security strategy for years, using it and similar firms to advance the country’s interests around the world.
A yearlong Times investigation, including dozens of interviews with government officials, leaders of intelligence and law-enforcement agencies, cyberweapons experts, business executives and privacy activists in a dozen countries, shows how Israel’s ability to approve or deny access to NSO’s cyberweapons has become entangled with its diplomacy. Countries like Mexico and Panama have shifted their positions toward Israel in key votes at the United Nations after winning access to Pegasus. Times reporting also reveals how sales of Pegasus played an unseen but critical role in securing the support of Arab nations in Israel’s campaign against Iran and even in negotiating the Abraham Accords, the 2020 diplomatic agreements that normalized relations between Israel and some of its longtime Arab adversaries.	A yearlong Times investigation, including dozens of interviews with government officials, leaders of intelligence and law-enforcement agencies, cyberweapons experts, business executives and privacy activists in a dozen countries, shows how Israel’s ability to approve or deny access to NSO’s cyberweapons has become entangled with its diplomacy. Countries like Mexico and Panama have shifted their positions toward Israel in key votes at the United Nations after winning access to Pegasus. Times reporting also reveals how sales of Pegasus played an unseen but critical role in securing the support of Arab nations in Israel’s campaign against Iran and even in negotiating the Abraham Accords, the 2020 diplomatic agreements that normalized relations between Israel and some of its longtime Arab adversaries.
The combination of Israel’s search for influence and NSO’s drive for profits has also led to the powerful spying tool’s ending up in the hands of a new generation of nationalist leaders worldwide. Though the Israeli government’s oversight was meant to prevent the powerful spyware from being used in repressive ways, Pegasus has been sold to Poland, Hungary and India, despite those countries’ questionable records on human rights.	The combination of Israel’s search for influence and NSO’s drive for profits has also led to the powerful spying tool’s ending up in the hands of a new generation of nationalist leaders worldwide. Though the Israeli government’s oversight was meant to prevent the powerful spyware from being used in repressive ways, Pegasus has been sold to Poland, Hungary and India, despite those countries’ questionable records on human rights.
The United States has made a series of calculations in response to these developments — secretly acquiring, testing and deploying the company’s technology, even as it has denounced the company in public and sought to limit its access to vital American suppliers. The current showdown between the United States and Israel over NSO demonstrates how governments increasingly view powerful cyberweapons the same way they have long viewed military hardware like fighter jets and centrifuges: not only as pivotal to national defense but also as a currency with which to buy influence around the world.	The United States has made a series of calculations in response to these developments — secretly acquiring, testing and deploying the company’s technology, even as it has denounced the company in public and sought to limit its access to vital American suppliers. The current showdown between the United States and Israel over NSO demonstrates how governments increasingly view powerful cyberweapons the same way they have long viewed military hardware like fighter jets and centrifuges: not only as pivotal to national defense but also as a currency with which to buy influence around the world.
Selling weapons for diplomatic ends has long been a tool of statecraft. Foreign-service officers posted in American Embassies abroad have served for years as pitchmen for defense firms hoping to sell arms to their client states, as the thousands of diplomatic cables released by WikiLeaks in 2010 showed; when American defense secretaries meet with their counterparts in allied capitals, the end result is often the announcement of an arms deal that pads the profits of Lockheed Martin or Raytheon.	Selling weapons for diplomatic ends has long been a tool of statecraft. Foreign-service officers posted in American Embassies abroad have served for years as pitchmen for defense firms hoping to sell arms to their client states, as the thousands of diplomatic cables released by WikiLeaks in 2010 showed; when American defense secretaries meet with their counterparts in allied capitals, the end result is often the announcement of an arms deal that pads the profits of Lockheed Martin or Raytheon.
Cyberweapons have changed international relations more profoundly than any advance since the advent of the atomic bomb. In some ways, they are even more profoundly destabilizing — they are comparatively cheap, easily distributed and can be deployed without consequences to the attacker. Dealing with their proliferation is radically changing the nature of state relations, as Israel long ago discovered and the rest of the world is now also beginning to understand.	Cyberweapons have changed international relations more profoundly than any advance since the advent of the atomic bomb. In some ways, they are even more profoundly destabilizing — they are comparatively cheap, easily distributed and can be deployed without consequences to the attacker. Dealing with their proliferation is radically changing the nature of state relations, as Israel long ago discovered and the rest of the world is now also beginning to understand.
For Israel, the weapons trade has always been central to the country’s sense of national survival. It was a major driver of economic growth, which in turn funded further military research and development. But it also played an important role in forging new alliances in a dangerous world. In the 1950s, when the nation was still young and essentially powerless, its first prime minister, David Ben-Gurion, established covert links with countries and organizations that lay just outside the ring of hostile Arab states that surround Israel. He called this approach “the periphery doctrine,” and his foreign intelligence agency, the Mossad, began weaving a network of secret contacts inside countries throughout the Middle East, Asia and Africa, including many that publicly sided with Arabs. Offering advanced weapons was a key to making those connections.	For Israel, the weapons trade has always been central to the country’s sense of national survival. It was a major driver of economic growth, which in turn funded further military research and development. But it also played an important role in forging new alliances in a dangerous world. In the 1950s, when the nation was still young and essentially powerless, its first prime minister, David Ben-Gurion, established covert links with countries and organizations that lay just outside the ring of hostile Arab states that surround Israel. He called this approach “the periphery doctrine,” and his foreign intelligence agency, the Mossad, began weaving a network of secret contacts inside countries throughout the Middle East, Asia and Africa, including many that publicly sided with Arabs. Offering advanced weapons was a key to making those connections.
By the mid-1980s, Israel had firmly established itself as one of the world’s top arms exporters, with an estimated one in 10 of the nation’s workers employed by the industry in some way. All of this bought good will for Israel from select foreign leaders, who saw the military aid as essential to preserving their own power. In turn, those countries often voted in Israel’s favor at the United Nations General Assembly, the Security Council and other international forums. They also allowed the Mossad and the Israel Defense Forces to use their countries as bases to launch operations against Arab nations.	By the mid-1980s, Israel had firmly established itself as one of the world’s top arms exporters, with an estimated one in 10 of the nation’s workers employed by the industry in some way. All of this bought good will for Israel from select foreign leaders, who saw the military aid as essential to preserving their own power. In turn, those countries often voted in Israel’s favor at the United Nations General Assembly, the Security Council and other international forums. They also allowed the Mossad and the Israel Defense Forces to use their countries as bases to launch operations against Arab nations.
As cyberweapons began to eclipse fighter jets in the schemes of military planners, a different kind of weapons industry emerged in Israel. Veterans of Unit 8200 — Israel’s equivalent of the National Security Agency — poured into secretive start-ups in the private sector, giving rise to a multibillion-dollar cybersecurity industry. As with purveyors of conventional weapons, cyberweapons makers are required to obtain export licenses from Israel’s Ministry of Defense to sell their tools abroad, providing a crucial lever for the government to influence the firms and, in some cases, the countries that buy from them.	As cyberweapons began to eclipse fighter jets in the schemes of military planners, a different kind of weapons industry emerged in Israel. Veterans of Unit 8200 — Israel’s equivalent of the National Security Agency — poured into secretive start-ups in the private sector, giving rise to a multibillion-dollar cybersecurity industry. As with purveyors of conventional weapons, cyberweapons makers are required to obtain export licenses from Israel’s Ministry of Defense to sell their tools abroad, providing a crucial lever for the government to influence the firms and, in some cases, the countries that buy from them.
None of these firms have been as wildly successful, or as strategically useful to the Israeli government, as NSO. The firm has its roots in a former chicken coop in Bnai Zion, an agricultural cooperative just outside Tel Aviv. In the mid 2000s, the building’s owner, realizing that coders might deliver a better profit than chickens, gave the space a light makeover and began renting it to technology start-ups looking for cheap office space. Among the start-up founders there, Shalev Hulio stood out from the veteran programmers around him: He was charismatic and easy to spend time with, but he also gave the impression — at least initially — of being somewhat naïve. He and his partner, Omri Lavie, an old friend from school, had each done their mandatory military service in combat units, rather than intelligence or technology, and for years they struggled to find a product that would connect. They developed a video marketing product, which briefly took off but then crashed with the 2008 global recession. They then started another company, called CommuniTake, that offered cellphone tech-support workers the ability to take control of their customers’ devices — with permission.	None of these firms have been as wildly successful, or as strategically useful to the Israeli government, as NSO. The firm has its roots in a former chicken coop in Bnai Zion, an agricultural cooperative just outside Tel Aviv. In the mid 2000s, the building’s owner, realizing that coders might deliver a better profit than chickens, gave the space a light makeover and began renting it to technology start-ups looking for cheap office space. Among the start-up founders there, Shalev Hulio stood out from the veteran programmers around him: He was charismatic and easy to spend time with, but he also gave the impression — at least initially — of being somewhat naïve. He and his partner, Omri Lavie, an old friend from school, had each done their mandatory military service in combat units, rather than intelligence or technology, and for years they struggled to find a product that would connect. They developed a video marketing product, which briefly took off but then crashed with the 2008 global recession. They then started another company, called CommuniTake, that offered cellphone tech-support workers the ability to take control of their customers’ devices — with permission.
That idea met with little enthusiasm, so the two friends pivoted to a very different kind of customer. “A European intelligence agency found out about our innovation and contacted me,” Hulio recalled in an interview. What quickly emerged was that their product could solve a much bigger problem than customer service.	That idea met with little enthusiasm, so the two friends pivoted to a very different kind of customer. “A European intelligence agency found out about our innovation and contacted me,” Hulio recalled in an interview. What quickly emerged was that their product could solve a much bigger problem than customer service.
For years, law-enforcement and intelligence agencies had been able to intercept and understand communications in transit, but as powerful encryption became widely available, that was no longer the case. They could intercept a communication, but they could no longer understand what it said. If they could control the device itself, though, they could collect the data before it was encrypted. CommuniTake had already figured out how to control the devices. All the partners needed was a way to do so without permission.	For years, law-enforcement and intelligence agencies had been able to intercept and understand communications in transit, but as powerful encryption became widely available, that was no longer the case. They could intercept a communication, but they could no longer understand what it said. If they could control the device itself, though, they could collect the data before it was encrypted. CommuniTake had already figured out how to control the devices. All the partners needed was a way to do so without permission.
And so NSO was born. Hulio and Lavie, lacking the contacts they would need to scale their product, brought in a third partner, Niv Karmi, who had served both in military intelligence and in the Mossad. They took the company name from their first initials (Niv, Shalev and Omri) — that it sounded a little like “N.S.A.” was a happy coincidence — and began hiring. Recruitment was the essential ingredient of their business plan. The company would eventually employ more than 700 people in offices around the world and a sprawling headquarters in Herzliya, where individual labs for Apple and Android operating systems are filled with racks of smartphones undergoing constant testing by the firm’s hackers as they seek and exploit new vulnerabilities.	And so NSO was born. Hulio and Lavie, lacking the contacts they would need to scale their product, brought in a third partner, Niv Karmi, who had served both in military intelligence and in the Mossad. They took the company name from their first initials (Niv, Shalev and Omri) — that it sounded a little like “N.S.A.” was a happy coincidence — and began hiring. Recruitment was the essential ingredient of their business plan. The company would eventually employ more than 700 people in offices around the world and a sprawling headquarters in Herzliya, where individual labs for Apple and Android operating systems are filled with racks of smartphones undergoing constant testing by the firm’s hackers as they seek and exploit new vulnerabilities.
Nearly every member of NSO’s research team is a veteran of the intelligence services; most of them served with AMAN, the Israeli Military Intelligence Directorate, the largest agency in the Israeli espionage community — and many of them in AMAN’s Unit 8200. The company’s most valuable employees are all graduates of elite training courses, including a secretive and prestigious Unit 8200 program called ARAM that accepts only a handful of the most brilliant recruits and trains them in the most advanced methods of cyberweapons programming. There are very few people with this kind of training anywhere in the world, and soon enough, few places would have a higher concentration of them than NSO’s headquarters in Herzliya — where there were not just a few top specialists but hundreds. This would provide NSO with an incredible competitive advantage: All of those engineers would work daily to find “zero days,” i.e., new vulnerabilities in phone software that could be exploited to install Pegasus. Unlike rival firms, which generally struggled to find even a single zero day and therefore could be shut down if it were made public, NSO would be able to discover and bank multitudes of them. If someone locked one back door, the company could quickly open another.	Nearly every member of NSO’s research team is a veteran of the intelligence services; most of them served with AMAN, the Israeli Military Intelligence Directorate, the largest agency in the Israeli espionage community — and many of them in AMAN’s Unit 8200. The company’s most valuable employees are all graduates of elite training courses, including a secretive and prestigious Unit 8200 program called ARAM that accepts only a handful of the most brilliant recruits and trains them in the most advanced methods of cyberweapons programming. There are very few people with this kind of training anywhere in the world, and soon enough, few places would have a higher concentration of them than NSO’s headquarters in Herzliya — where there were not just a few top specialists but hundreds. This would provide NSO with an incredible competitive advantage: All of those engineers would work daily to find “zero days,” i.e., new vulnerabilities in phone software that could be exploited to install Pegasus. Unlike rival firms, which generally struggled to find even a single zero day and therefore could be shut down if it were made public, NSO would be able to discover and bank multitudes of them. If someone locked one back door, the company could quickly open another.
In 2011, NSO engineers finished coding the first iteration of Pegasus. With its powerful new tool, NSO hoped to quickly build a stable of clients in the West. But many countries, especially those in Europe, were initially wary of buying foreign intelligence products. There was a particular concern about Israeli companies that were staffed by former top intelligence officials; potential customers feared that their spyware might be contaminated with even deeper spyware, allowing the Mossad access to their internal systems.	In 2011, NSO engineers finished coding the first iteration of Pegasus. With its powerful new tool, NSO hoped to quickly build a stable of clients in the West. But many countries, especially those in Europe, were initially wary of buying foreign intelligence products. There was a particular concern about Israeli companies that were staffed by former top intelligence officials; potential customers feared that their spyware might be contaminated with even deeper spyware, allowing the Mossad access to their internal systems.
Reputation mattered, both for sales and for holding onto the well-trained coders who had made Pegasus a reality. Hulio appointed Maj. Gen. Avigdor Ben-Gal, a Holocaust survivor and a highly respected combat officer, as NSO’s chairman, and established what he said would be the company’s four main pillars: NSO would not operate the system itself. It would sell only to governments, not to individuals or companies. It would be selective about which governments it allowed to use the software. And it would cooperate with Israel’s Defense Export Controls Agency, or DECA, to license every sale.	Reputation mattered, both for sales and for holding onto the well-trained coders who had made Pegasus a reality. Hulio appointed Maj. Gen. Avigdor Ben-Gal, a Holocaust survivor and a highly respected combat officer, as NSO’s chairman, and established what he said would be the company’s four main pillars: NSO would not operate the system itself. It would sell only to governments, not to individuals or companies. It would be selective about which governments it allowed to use the software. And it would cooperate with Israel’s Defense Export Controls Agency, or DECA, to license every sale.
The decisions NSO made early on about its relationship with regulators ensured that it would function as a close ally, if not an arm, of Israeli foreign policy. Ben-Gal saw that this oversight was crucial to NSO’s growth — it might restrict which countries the company could sell to, but it would also protect the company from public blowback about what its clients did. When he informed the Defense Ministry that NSO would voluntarily be subject to oversight, the authorities also seemed happy with this plan. One former military aide to Benjamin Netanyahu, at the time Israel’s prime minister, explained the advantages quite clearly. “With our Defense Ministry sitting at the controls of how these systems move around,” he said, “we will be able to exploit them and reap diplomatic profits.”	The decisions NSO made early on about its relationship with regulators ensured that it would function as a close ally, if not an arm, of Israeli foreign policy. Ben-Gal saw that this oversight was crucial to NSO’s growth — it might restrict which countries the company could sell to, but it would also protect the company from public blowback about what its clients did. When he informed the Defense Ministry that NSO would voluntarily be subject to oversight, the authorities also seemed happy with this plan. One former military aide to Benjamin Netanyahu, at the time Israel’s prime minister, explained the advantages quite clearly. “With our Defense Ministry sitting at the controls of how these systems move around,” he said, “we will be able to exploit them and reap diplomatic profits.”
The company quickly got its first major break. Mexico, in its ongoing battle against drug cartels, was looking for ways to hack the encrypted BlackBerry messaging service favored by cartel operatives. The N.S.A. had found a way in, but the American agency offered Mexico only sporadic access. Hulio and Ben-Gal arranged a meeting with Mexico’s president, Felipe Calderón, and arrived with an aggressive sales pitch. Pegasus could do what the N.S.A. could do, and it could do so entirely at the command of Mexican authorities. Calderón was interested.	The company quickly got its first major break. Mexico, in its ongoing battle against drug cartels, was looking for ways to hack the encrypted BlackBerry messaging service favored by cartel operatives. The N.S.A. had found a way in, but the American agency offered Mexico only sporadic access. Hulio and Ben-Gal arranged a meeting with Mexico’s president, Felipe Calderón, and arrived with an aggressive sales pitch. Pegasus could do what the N.S.A. could do, and it could do so entirely at the command of Mexican authorities. Calderón was interested.
Israel’s Ministry of Defense informed NSO that there was no issue with selling Pegasus to Mexico, and a deal was finalized. Soon after, investigators at an office of the Center for Investigation and National Security, or CISEN — now called the Center for National Investigation — went to work with one of the Pegasus machines. They fed the mobile phone number of a person connected to Joaquín Guzmán’s Sinaloa cartel into the system, and the BlackBerry was successfully attacked. Investigators could see the content of the messages, as well as the locations of different BlackBerry devices. “Suddenly we started to see and hear anew,” says a former CISEN leader. “It was like magic.” In his view, the new system had revitalized their entire operation — “Everyone felt like maybe for the first time we could win.” It was also a win for Israel. Mexico is a dominant power in Latin America, a region where Israel for years has waged a kind of diplomatic trench warfare against anti-Israeli groups supported by the country’s adversaries in the Middle East. There is no direct evidence that Mexico’s contracts with NSO brought about a change in the country’s foreign policy toward Israel, but there is at least a recognizable pattern of correlation. After a long tradition of voting against Israel at United Nations conferences, Mexico slowly began to shift “no” votes to abstentions. Then, in 2016, Enrique Peña Nieto, who succeeded Calderón in 2012, went to Israel, which had not seen an official visit from a Mexican president since 2000. Netanyahu visited Mexico City the following year, the first visit ever by an Israeli prime minister. Shortly after, Mexico announced that it would abstain from voting on several pro-Palestinian resolutions that were being considered by the United Nations.	Israel’s Ministry of Defense informed NSO that there was no issue with selling Pegasus to Mexico, and a deal was finalized. Soon after, investigators at an office of the Center for Investigation and National Security, or CISEN — now called the Center for National Investigation — went to work with one of the Pegasus machines. They fed the mobile phone number of a person connected to Joaquín Guzmán’s Sinaloa cartel into the system, and the BlackBerry was successfully attacked. Investigators could see the content of the messages, as well as the locations of different BlackBerry devices. “Suddenly we started to see and hear anew,” says a former CISEN leader. “It was like magic.” In his view, the new system had revitalized their entire operation — “Everyone felt like maybe for the first time we could win.” It was also a win for Israel. Mexico is a dominant power in Latin America, a region where Israel for years has waged a kind of diplomatic trench warfare against anti-Israeli groups supported by the country’s adversaries in the Middle East. There is no direct evidence that Mexico’s contracts with NSO brought about a change in the country’s foreign policy toward Israel, but there is at least a recognizable pattern of correlation. After a long tradition of voting against Israel at United Nations conferences, Mexico slowly began to shift “no” votes to abstentions. Then, in 2016, Enrique Peña Nieto, who succeeded Calderón in 2012, went to Israel, which had not seen an official visit from a Mexican president since 2000. Netanyahu visited Mexico City the following year, the first visit ever by an Israeli prime minister. Shortly after, Mexico announced that it would abstain from voting on several pro-Palestinian resolutions that were being considered by the United Nations.
In a statement, Netanyahu’s spokesman said that the former prime minister never sought a quid pro quo when other countries wanted to buy Pegasus. “The claim that Prime Minister Netanyahu spoke to foreign leaders and offered them such systems in exchange for political or other measures is a complete and utter lie. All sales of this system or similar products of Israeli companies to foreign countries are conducted with the approval and supervision of the Ministry of Defense, as outlined in Israeli law.”	In a statement, Netanyahu’s spokesman said that the former prime minister never sought a quid pro quo when other countries wanted to buy Pegasus. “The claim that Prime Minister Netanyahu spoke to foreign leaders and offered them such systems in exchange for political or other measures is a complete and utter lie. All sales of this system or similar products of Israeli companies to foreign countries are conducted with the approval and supervision of the Ministry of Defense, as outlined in Israeli law.”
The Mexico example revealed both the promise and the perils of working with NSO. In 2017, researchers at Citizen Lab, a watchdog group based at the University of Toronto, reported that authorities in Mexico had used Pegasus to hack the accounts of advocates for a soda tax, as part of a broader campaign aimed at human rights activists, political opposition movements and journalists. More disturbing, it appeared that someone in the government had used Pegasus to spy on lawyers working to untangle the massacre of 43 students in Iguala in 2014. Tomás Zerón de Lucio, the chief of the Mexican equivalent to the F.B.I., was a main author of the federal government’s version of the event, which concluded that the students were killed by a local gang. But in 2016 he became the subject of an investigation himself, on suspicion that he had covered up federal involvement in the events there. Now it appeared that he might have used Pegasus in that effort — one of his official duties was to sign off on the procurement of cyberweapons and other equipment. In March 2019, soon after Andrés Manuel López Obrador replaced Peña Nieto after a landslide election, investigators charged that Zerón had engaged in torture, abduction and tampering with evidence in relation to the Iguala massacre. Zerón fled to Canada and then to Israel, where he entered the country as a tourist, and where — despite an extradition request from Mexico, which is now seeking him on additional charges of embezzlement — he remains today.	The Mexico example revealed both the promise and the perils of working with NSO. In 2017, researchers at Citizen Lab, a watchdog group based at the University of Toronto, reported that authorities in Mexico had used Pegasus to hack the accounts of advocates for a soda tax, as part of a broader campaign aimed at human rights activists, political opposition movements and journalists. More disturbing, it appeared that someone in the government had used Pegasus to spy on lawyers working to untangle the massacre of 43 students in Iguala in 2014. Tomás Zerón de Lucio, the chief of the Mexican equivalent to the F.B.I., was a main author of the federal government’s version of the event, which concluded that the students were killed by a local gang. But in 2016 he became the subject of an investigation himself, on suspicion that he had covered up federal involvement in the events there. Now it appeared that he might have used Pegasus in that effort — one of his official duties was to sign off on the procurement of cyberweapons and other equipment. In March 2019, soon after Andrés Manuel López Obrador replaced Peña Nieto after a landslide election, investigators charged that Zerón had engaged in torture, abduction and tampering with evidence in relation to the Iguala massacre. Zerón fled to Canada and then to Israel, where he entered the country as a tourist, and where — despite an extradition request from Mexico, which is now seeking him on additional charges of embezzlement — he remains today.
The American reluctance to share intelligence was creating other opportunities for NSO, and for Israel. In August 2009, Panama’s new president, Ricardo Martinelli, fresh off a presidential campaign grounded on promises of “eliminating political corruption,” tried to persuade U.S. diplomats in the country to give him surveillance equipment to spy on “security threats as well as political opponents,” according to a State Department cable published by WikiLeaks. The United States “will not be party to any effort to expand wiretaps to domestic political targets,” the deputy chief of mission replied.	The American reluctance to share intelligence was creating other opportunities for NSO, and for Israel. In August 2009, Panama’s new president, Ricardo Martinelli, fresh off a presidential campaign grounded on promises of “eliminating political corruption,” tried to persuade U.S. diplomats in the country to give him surveillance equipment to spy on “security threats as well as political opponents,” according to a State Department cable published by WikiLeaks. The United States “will not be party to any effort to expand wiretaps to domestic political targets,” the deputy chief of mission replied.
Martinelli tried a different approach. In early 2010, Panama was one of only six countries at the U.N. General Assembly to back Israel against a resolution to keep the Goldstone Commission report on war crimes committed during the 2008-9 Israeli assault on Gaza on the international agenda. A week after the vote, Martinelli landed in Tel Aviv on one of his first trips outside Latin America. Panama will always stand with Israel, he told the Israeli president, Shimon Peres, in appreciation of “its guardianship of the capital of the world — Jerusalem.” He said he and his entourage of ministers, businesspeople and Jewish community leaders had come to Israel to learn. “We came a great distance, but we are very close because of the Jewish heart of Panama,” he said.	Martinelli tried a different approach. In early 2010, Panama was one of only six countries at the U.N. General Assembly to back Israel against a resolution to keep the Goldstone Commission report on war crimes committed during the 2008-9 Israeli assault on Gaza on the international agenda. A week after the vote, Martinelli landed in Tel Aviv on one of his first trips outside Latin America. Panama will always stand with Israel, he told the Israeli president, Shimon Peres, in appreciation of “its guardianship of the capital of the world — Jerusalem.” He said he and his entourage of ministers, businesspeople and Jewish community leaders had come to Israel to learn. “We came a great distance, but we are very close because of the Jewish heart of Panama,” he said.