Spyware firm NSO Group cannot be blacklisted in Luxembourg

The NSO Group, the company behind the controversial Pegasus spyware, cannot be blacklisted in Luxembourg - as it is in the United States - because the Grand Duchy's legislation “does not provide” for a similar procedure, the government said on Wednesday.

No such mechanism exists in Luxembourg, where the company has multiple entities, according to a joint response by three government ministers to a parliamentary question submitted by Pirate Party deputy Marc Goergen.

Goergen tabled his question on 4 November, a day after the US Department of Commerce blacklisted the firm for "engaging in activities that are contrary to the national security or foreign policy interests of the United States".

On the day of the US announcement, the Luxembourg Times asked the State Ministry, which oversees the country's intelligence services, whether the Grand Duchy was considering a similar step. The ministry referred the request for comment to the Economy Ministry, which did not respond.

“Luxembourg legislation does not provide for a procedure similar to that of the United States Ministry of Commerce,” read the response on Wednesday from Prime Minister Xavier Bettel, Foreign Minister Jean Asselborn and Economy Minister Franz Fayot.

Asked whether the US government clampdown would have any consequences for the Grand Duchy, the ministers replied: “Luxembourg is not targeted by this decision”.

The United States said it had moved against NSO, headquartered in Israel, based on evidence that it "developed and supplied spyware to foreign governments that used these tools to maliciously target government officials, journalists, businesspeople, activists, academics, and embassy workers".

The decision by the US came just a week after Luxembourg's Prime Minister Xavier Bettel said the country had used the software in a Luxembourg Times interview, in which he mentioned Pegasus by name.

That interview prompted a parliamentary question, in response to which Bettel said he had been talking about spyware generically, adding that "for security reasons and in order to protect investigations, it is not possible to publish details of technical equipment."

The Pegasus spyware, produced by the NSO Group, was used by governments around the world to target numerous activists, journalists, lawyers and dissidents, a consortium of international media outlets revealed in July, which followed earlier reports that the spyware had been used to snoop on murdered Saudi Arabian journalist Jamal Khashoggi and other dissidents.

In the wake of the July press reports, Foreign Minister Jean Asselborn acknowledged nine NSO entities were based in Luxembourg, after initially saying there were only two. Asselborn said he sent letters to the nine NSO entities reminding them of their human rights duties.

The NSO Group said in a confidential letter that they only export their spyware from Israel with the consent of the Israeli government, Asselborn said in October, although he had no means to verify that claim. Asselborn said previously Luxembourg had not granted the company an export licence.