Does spyware developed by a secretive, counter intelligence hacker claiming to fight terrorism justify selling the technology to dictators and human rights abusers to target dissidents, including journalists, lawyers and activists?
It’s what NSO Group, an eight-year old, controversial Israeli hacking outfit, believes to be a real world trade-off, one that its founder Shalev Hulio defended on the 60 Minutes television show this past Sunday.
Does NSO make the world safer as Hulio claims or does its cyber surveillance warfare obliterate digital privacy and cultivate political suppression? How far does cybersecurity extend?
Hulio pointed to the arrest of Mexican drug lord El Chapo as a case in point. “In order to catch El Chapo, for example, they had to intercept a journalist, an actress, and a lawyer,” Hulio said. “Now, by themselves, they are not criminals, right? But if they are in touch with a drug lord and in order to catch them, you need to intercept them, that’s a decision an intelligence agency should get.”
NSO quietly made its bones by being able to hack into encrypted iPhones, known mostly among the discreet cybersecurity community. It was an issue that became center-stage when the FBI and Justice Department locked horns with Apple over cracking into the iPhones used in the San Bernardino, California terrorist mass shooting in 2015. The developer licenses its Pegasus mobile spyware to national security and law enforcement agencies worldwide. In the right hands, the spyware enables authorities to track down terrorists by doing what spies do -- reading emails and texts, poring over contacts, listening to and recording conversations, using the phone’s microphones and cameras.
But in the wrong hands, it can, and reportedly is being used for political espionage. Last December, the Washington Post reported that Israel authorized NSO to sell Pegasus to Saudi Arabia, citing two former top U.S. security officials. The Saudis apparently worked through an NSO affiliate based in Luxembourg called Q Cyber Technologies. NSO’s customers, which also include the United Arab Emirates and others with a long record of human rights abuses and silencing dissenters, ties the company to murky surveillance and perhaps to the murder of Saudi critic journalist Jamal Khashoggi and the imprisoning of human rights defender Ahmed Mansoor.
It’s apparently to dispel any notion that NSO is knowingly linked to human rights abuses and political murders that prodded the reticent Hulio to come forward for the 60 Minutes interview.
“Khashoggi murder is horrible. Really horrible. And therefore, when I first heard there are accusations that our technology been used on Jamal Khashoggi or on his relatives, I started an immediate check about it. And I can tell you very clear, we had nothing to do with this horrible murder,” Hulio told 60 Minutes. “I'm not gonna talk about specific customer,” he said. “I only say that we are selling Pegasus in order to prevent crime and terror.” He insists that the Pegasus software has saved “tens of thousands” of lives.
There is no transparency on how and to whom NSO sells its technology. When asked about terrorism, Hulio denied that any of NSO’s customers are terrorists or human rights abusers. “Every customer that we sold has a very clear definition of what terrorism is. And it's basically bad guys doing bad things in order to kill innocent people, in order to change the political agenda. I never met with a customer that told me that oppositions are terrorists. There are more than hundred countries-- hundred countries that we will never sell our technologies to.”
But in a 2017 report, Citizen Lab, a human rights watchdog, said it uncovered roughly two dozen cases in Mexico, let alone dictatorships in the Middle East, where the Pegasus software was aimed at political rivals, reporters, and civil rights lawyers. According to the report, all of the targets have been involved in investigating or working on reports of high-level official corruption, or government involvement in human rights abuses. To that NSO co-president Tami Shachar told 60 Minutes that Pegasus is not “mass surveillance technology. This is really for the Bin Ladens of the world.”
So, once again the question stands, as it did in San Bernardino and in other instances of drug and human trafficking. Does fighting terrorism justify invading privacy, skirting security and suppressing dissidents?
