US defence contractor L3Harris, in talks to take over NSO Group’s hacking technology

The US defence contractor L3Harris is in talks to take over NSO Group’s surveillance technology, in a possible deal that would give an American company control over one of the world’s most sophisticated and controversial hacking tools.

Multiple sources confirmed that discussions were centred on a sale of the Israeli company’s core technology – or code – as well as a possible transfer of NSO personnel to L3Harris. But any agreement still faces significant hurdles, including requiring the blessing of the US and Israeli governments, which have not yet given the green light to a deal.

In a statement, a senior White House official said: “Such a transaction, if it were to take place, raises serious counterintelligence and security concerns for the US government.”

This story was jointly reported by the Guardian, the Washington Post and Haaretz.

If agreed, the deal would mark an astounding turnaround for NSO, less than a year after the Biden administration placed the company on a US blacklist and accused it of acting “contrary to the foreign policy and national security interests of the US”.

NSO’s government clients are known to have used the surveillance technology to target journalists, human rights activists, senior government officials in US-allied countries, and lawyers around the world.

The media outlets have also detailed how NSO’s surveillance technology, Pegasus, has been used by the company’s government clients to target American citizens, including Carine Kanimba, daughter of the Rwandan dissident Paul Rusesabagina, as well as journalists, activists and US state department officials working abroad.

Asked to comment on the talks, an L3Harris spokesperson said: “We are aware of the capability and we are constantly evaluating our customers’ national security needs. At this point, anything beyond that is speculation.”

The talks between L3 and NSO were first reported by Intelligence Online.

The White House said that it had not been involved in “any way in this reported potential transaction”.

The senior White House official also said the US government “opposes efforts by foreign companies to circumvent US export control measures or sanctions, including placement on the US Department of Commerce’s Entity List for malicious cyber activity”.

The official said that any US company – particularly a cleared US defence contractor – should be aware that a transaction with a blacklisted company would “not automatically remove a designated entity from the Entity List, and would spur intensive review to examine whether the transaction poses a counterintelligence threat to the US Government and its systems and information, whether other US equities with the defense contractor may be at risk, to what extent a foreign entity or government retains a degree of access or control, and the broader human rights implications”.

One person familiar with the talks said that if a deal were agreed, it would probably involve selling NSO’s capabilities to a drastically curtailed customer base that would include the US government, the UK, Australia, New Zealand and Canada – which comprise the “five eyes” intelligence alliance – as well as some Nato allies.

The person also said that the deal faced several unresolved issues, including whether the technology would be housed in Israel or the US and whether Israel would be allowed to continue to use the technology as a customer.

The person said it was also too soon to confirm the price of any possible deal. The transaction would require US government approval since NSO is on the commerce department’s so-called entity list. Experts said that any such transaction would probably require the creation of a new entity in order to get US approval.

Any deal would also face hurdles in Israel. One assumption in the Israeli cyber industry is that it would have to keep oversight of the Israeli-made technology in Israel, and keep all development of Pegasus and personnel in Israel.

NSO is regulated by the Israeli ministry of defence, which has had ultimate say over the company’s government clients. Israel has faced intense criticism in the past for agreeing to sell the surveillance technology to countries with poor human rights records, including Saudi Arabia and the United Arab Emirates.

NSO, which is being sued by Apple and WhatsApp in US courts, has in the past said it takes all allegations of abuse of its tools seriously, and that it investigates such claims.

The Israeli ministry of defence and NSO declined to comment.

Any takeover of NSO’s hacking technology would add to L3Harris’s current suite of surveillance tools, which are already sold to US government and law enforcement clients. The company, which is based in Florida and reports about $18bn in annual sales, includes the FBI and Nato as clients.

Any potential deal faces stiff opposition from digital rights advocates and human rights groups.