"It steals all the information on your phone, it intercepts all calls, it intercepts all texts, it steals all emails, contacts, FaceTime calls. It also hijacks all the communication mechanisms you have on your phone. It steals all the information from the Gmail application, all the Facebook messages, all the Facebook information, your Facebook contacts, everything on Skype, WhatsApp, Viber, WeChat, Telegram, etc." August 2016, Lookout's vice president of research Mike Murray and Citizen Lab, a digital rights watchdog at the University of Toronto's Munk School of Global Affairs, blew the lid on the biggest cyber espionage case in history.
At the helm is the Israeli company NSO Group, which was founded in 2010 and discreetly set up shop in Luxembourg via a host of companies four years later. A worldwide outcry against a backdrop of revelations about the spying on journalists and activists in various countries: some have been killed, others tortured and others spied on constantly.
State technology or not state technology?
Eight years on, the irony has changed: while the affair has forced the NSO Group to reinvent itself in a different set of companies, still in Israel, still in Luxembourg and still in the United States, at the end of October the tech giant Apple once again asked the American courts to drop . It was too afraid that a trial would expose the security flaws in the technology company, which has long marketed the inviolability of its technologies. Yet it was through flaws that Apple's engineers themselves were unaware of that the Israeli stars were able to spy on them.
Ironically, the NSO Group's American lawyers initially tried to use the defence that their company was linked to the Israeli state and that Apple could not therefore act against it, which the American courts rejected, before the Israeli state decided this year to confiscate all the relevant documents from NSO.
The end of NSO's legal troubles is not in sight: At the end of September, four men resident in the UK (Yusuf al-Jamri, a Bahraini activist tortured by the Bahraini government; Anas Altikriti, founder and CEO of the UK-based Cordoba Foundation; Azzam Tamimi, a British-Palestinian academic and activist; and Mohammed Kozbar, president of the Finsbury Park Mosque in London) filed a complaint with the British courts, prepared by Leanna Burnard, a lawyer with the UK-based Global Legal Action Network, and supported by Monika Sobiecki, a partner at the London-based law firm Bindmans. According to some media reports, the targets are NSO Group (Israel); its parent company, Q Cyber Technologies (Luxembourg); and Novalpina Capital (a London-based private equity firm which bought NSO in 2019). In all, some thirty complaints of this type are awaiting legal action in Israel, Spain, the United States and Colombia.
This week, in the context of the bloody operations carried out in the Gaza Strip in response to the attack on Israel by Hamas just over a year ago, the Committee for a Just Peace in the Middle East, in association with Action Solidaire Tiers Monde and Amnesty International, demanded that the Luxembourg government take legal action against the bodies involved in human rights violations to prevent NSO Group from continuing to serve its customers.
Discussions on ownership
According to the Public Prosecutor's Office and public data in the Commercial Register, Novalpina is still in voluntary liquidation in Luxembourg after paying a final dividend of nearly €18 million to its shareholders in January 2021.
But one of the founders, Omri Lavie, has regained control of the company, via its creditors and his new Luxembourg holding company, Dufresne Holding, according to Israeli media outlet Calcist and documents filed with the Register of Beneficial Owners.
Omri Lavie has regained control of the three key entities of NSO Group, via his new holding company, Dufresne Holding. Photo: Maison Moderne
Neither the NSO Group nor the Americans at Treo Asset Management replied to our requests for comment.
Having a direct foothold in the United States would enable the group to get off the US blacklist by becoming American-owned. This would give US agencies risk-free access to its technologies. An investigation by the New York Times revealed that the FBI, CIA and NSA had set up structures to buy Pegasus and engage in targeted listening without their names being officially revealed in the event of a problem.
Second transparency report in three years
In 2023, as promised in 2020, NSO published its transparency report on its activities for the second time. Signed by its new CEO, Yaron Shohat, the report gives just a few figures:
- it has 56 customers in 31 countries;
- 46% of these customers are justice-related bodies, 45% are intelligence agencies and the remainder are military structures;
- from 2021 to the end of 2023, 10% of new opportunities had to be turned down on human rights grounds, amounting to $80m a year for three-year contracts;
- in its risk analysis, 58 countries cannot access its technologies because they are unwilling or unable to comply with human rights;
- from 2021 to 2023, NSO opened 19 investigations into inappropriate use of its products.
Its products--because if we're talking about Pegasus, the group is said to have launched two other products, just as 'effective’. At the same time as the group's debacle has accelerated the growth of rival companies, often also set up by former Israeli intelligence officers. Boaz Goldman and Tal Dilian created Circles in 2011, registered in Cyprus and operating from Bulgaria, which was integrated into the NSO Group by the former majority shareholders, Francisco Partners, who had acquired it for $130m. Dilian is also behind Intellexa, which has also been much in the news, Cytrox, whose Predator has also been in the media spotlight, and WiSpear (renamed Passitora), two companies he runs from Cyprus.Or Ireland's Thalestris, .
Boaz Goldman, for his part, has 'disappeared' from Luxembourg since 2019 - he was a director of Triangle Holdings, another branch that owned some of the companies in the NSO group. All these structures are now in the hands of the .
In Luxembourg, where the former prime minister and current foreign minister, (DP), had to backtrack on the use of Pegasus by Luxembourg intelligence, with the Ministry of State is referring to a parliamentary response.
Questioned by his former colleague in government, (LSAP), now a MP but then minister for the economy, who believes that Luxembourg does use Pegasus, the current PM, (CSV), pointed out that only the police and the intelligence service can use this type of technology.
The police in the context of suspected crimes and offences against state security or acts of terrorism and terrorist financing, on the orders of an investigating magistrate.
Intelligence in the context of espionage and interference; violent extremism; terrorism; proliferation of weapons of mass destruction or defence-related products and technologies; or organised crime and cyber-threats insofar as they are linked to one of the aforementioned threats, here with the approval of a ministerial committee (made up of members of the government and the minister responsible for intelligence) after receiving the opinion of a special committee of magistrates (the president of the Superior Court of Justice, the president of the Administrative Court and the president of the District Court of Luxembourg) and for a period of three months.
Read the original French-language version of this news report