Israeli Cyber Firm Negotiated Advanced Attack Capabilities Sale With Saudis

An Israeli company that specializes in cyber espionage tools reportedly negotiated a multi-million-dollar deal with Saudi Arabia to sell a technology that allows governments to hack their citizens’ cellphones, and to listen to calls as well as conversations that take place near the phones.

Representatives from the Herzliya-based NSO Group held meetings with Saudi officials in Vienna and, apparently, also in a Gulf State to negotiate a $55 million sale of their Pegasus 3 software, the Haaretz daily reported on Sunday.

The outcome of those talks is now the subject of a lawsuit by a European businessman not named in the report, who claims he helped set up the initial contact between Israeli dealers and Saudi buyers, but was allegedly frozen out of receiving any commission on the deal.

The NSO Group has been the subject of much controversy in recent years, with Canadian internet watchdog Citizen Lab claiming that the Pegasus software marketed by the company is being used by a number of countries “with dubious human rights records and histories of abusive behavior by state security services.”

In 2017, Israeli cyber spying companies met several times with Saudi figures at European locations to talk about the sale of various technologies, the report said.

In one meeting, Israeli representatives refused a Saudi request to identify the user behind an anti-regime Twitter account as a way of showing the ability of their technology, the report said. At another meeting, NSO Group demonstrated how it could take control of a brand-new iPhone given it was provided the phone’s number.

According to the report, at one point Saudi officials wanted to bring to Riyadh an Israeli businessman dealing in defense-related technologies who operates through Cyprus and was involved in the NSO negotiations. While Israel’s Defense Ministry, which oversees the sale of security technologies abroad, refused to approve the trip, the businessman reportedly chartered a plane and flew NSO founder Shalev Hulio to a location in the Gulf for three days of meetings in June 2017.

It was during those meetings that an agreement was hammered out to sell the Pegasus 3 system to the Saudis. The report did not say if a deal was eventually closed.

The kingdom’s powerful Crown Prince Mohammed bin Salman has drawn harsh criticism from rights groups over the targeting of human rights activists and political dissidents across the spectrum since his appointment in June 2017.

Saudi Arabia’s legislation on cyber crime has sparked concern among international rights groups in the past.

Dozens of Saudi citizens have been convicted on charges linked to dissent under a previous sweeping law, particularly linked to posts on Twitter.

The NSO Group has insisted in the past that it sells its software to clients on the condition that it be used only against crime and terrorism, and has shirked responsibility in cases where it was allegedly used for civil rights abuses.

Earlier this month, fugitive NSA leaker Edward Snowden slammed Israel’s burgeoning cyber-surveillance industry, singling out the NSO Group for his harshest criticism.

Speaking to a group of Israeli journalists via videolink from Moscow, Snowden suggested a link between the murder last month of Saudi journalist Jamal Khashoggi in Saudi Arabia’s consulate in Istanbul, Turkey, and Saudi use of NSO Group’s Pegasus software

“How did they know what his intentions were? How did they decide he was someone they needed to act against — that he was worth the risk?” Snowden asked.

In August The New York Times reported that two lawsuits brought against NSO have uncovered documents showing that the company and its affiliates have actively engaged in illegal activities for clients.

The two lawsuits, filed in Israel and Cyprus, call for company accountability for what they claim is an active role in illegal intelligence gathering. The lawsuits were filed by a Qatari individual who claims to have been targeted by the UAE, as well as by Mexican human rights activists who say the government spied on them using Pegasus.

To sell Pegasus to the UAE, the NY Times noted, the company would have had to receive the express permission of the Defense Ministry, as such software is considered a weapon.

In 2016, the Yedioth Ahronoth daily first reported that the Defense Ministry had given the NSO Group permission to sell the software to an Arab company, which went on to target a prominent UAE rights activist. But the scope of the government’s involvement had not been known.

Israeli companies have been criticized in the past for selling software to monitor internet and phone communication to regimes with poor human rights records, including in Uzbekistan and Kazakhstan, as well as Colombia, Trinidad and Tobago, Uganda, Panama and Mexico, according to the NGO Privacy International.