Israel’s most notorious spyware company gets a US makeover
Surveillance tech used to target dissidents and reporters abroad may see a resurgence in immigration enforcement.
Hey y’all, hope everyone had a restful and contemplative Thanksgiving reprieve.
Jumping back into the fold today, I want to discuss a relatively little-discussed development from last month that could have major ripple effects on police and government surveillance tactics. NSO Group, an Israeli software manufacturer I’ve been covering for the better part of five years and best known for creating the advanced spyware used to monitor countless dissidents and journalists worldwide, is now under new U.S. ownership. To put that in starker terms: A company whose “Pegasus” tool was allegedly linked to the dismemberment of a Saudi journalist is now taking direction from a Hollywood producer and a former Trump bankruptcy lawyer.
The move gives NSO (whose co-developer was reportedly linked to Israeli intelligence) a chance to lobby President Trump directly to remove its name from a Commerce Department trade blacklist that has hobbled its business. In return, a politically favored NSO could provide law enforcement agencies and a new cohort of ICE-aligned so-called “bounty hunters” with access to arguably the world’s most powerful commercial spyware tool. Maybe more importantly, it would allow law enforcement the freedom to operate with even greater autonomy from other, more publicly accountable government agencies.
“The last thing America needs is a spyware epidemic,” Citizen Lab researcher and long-time NSO investigator John Scott-Railton wrote earlier this month. “Bringing NSO Group out of the cold right now would also fatally defang US efforts to curb spyware proliferation.”
But first, a quick refresher on why this company is such notably figure in mercenary digital espionage.
Pegasus: a surveillance super weapon
NSO was founded in 2010 by engineers Niv Karmi, Shalev Hulio, and Omri Lavie. Their signature product, named after an all-seeing, winged horse from Greek mythology, transformed the cat-and-mouse game of online privacy almost overnight. While tools to intercept cell phone communications have existed for decades, the introduction of accessible, everyday end-to-end encryption, as seen in WhatsApp and iMessage, fundamentally readjusted that dynamic. For the first time, a large portion of the world’s population could reliably send sensitive information with some confidence that a snooper couldn’t intercept and read it before it reached its intended recipient.
For the typical person trying to conceal their identity, that might simply mean more peace of mind when sending a late-night nude or messaging their dealer. But for others, like persecuted politicians, dissidents, migrants, and high-profile activists, that added anonymity could mean the difference between freedom and a life confined to shackles. Repressive governments and their proxies targeting those individuals needed a solution: Pegasus was the answer.
In short, Pegasus works by taking over a target’s phone and granting full remote access. Once infected, attackers deploying the spyware can view a target’s texts, listen in on calls, and scroll through their photos. It can even remotely activate a device’s microphone and camera without the owner knowing, essentially turning the device into a surveillance bug. Crucially, because Pegasus compromises the device itself, it can access content both before encryption is applied and after it is decrypted on the phone.
Most people never know they have been compromised. While earlier versions of the malware infected devices by sending targets a socially engineered text message containing a malicious link, the company eventually developed what security researchers call “zero-click” attacks. As the name suggests, these shadowy attacks can infect a target’s device without the user ever having to click a link or download a corrupted file. This elusiveness makes Pegasus virtually impossible for the average person to defend against. It also makes it an ideal tool for spies to gather intelligence covertly over long periods of time.
It is difficult to determine the full extent of Pegasus’s reach, but some estimates place the number of phone numbers targeted at over 50,000. Citizen Lab, the leading digital forensics team tracking NSO Group, reports it has been used in at least 45 countries. Law enforcement and intelligence agencies have argued Pegasus is necessary to target criminals and terrorists, but numerous investigations by human rights organizations suggest that this is far from the full story. A 2021 report from Amnesty International, for instance, found that hundreds of reporters, activists, lawyers, politicians, and other members of civil society had been targeted by Pegasus. Hot spots include Mexico, Jordan, Bahrain, and El Salvador, each of which has grappled with well-documented and widespread human rights abuses.
Perhaps the best-known Pegasus case thought occurred in Saudi Arabia, with the alleged targeting of Washington Post columnist Jamal Khashoggi. Several phone numbers linked to Khashoggi’s family members were reportedly included on surveillance lists maintained by multiple NSO clients. Omar Abdulaziz, a close associate of Khashoggi and fellow critic of the Saudi government, claimed in a lawsuit that surveillance enabled by Pegasus was instrumental in the government’s decision to abduct and kill him after he entered a consulate building in Istanbul. The city’s top prosecutor detailed the events of the day, alleging Khashoggi was choked to death and dismembered with a bone saw. NSO, it’s worth noting, has repeatedly denied those reports
And while NSO long claimed it could not control how its customers deploy their products, the appeal of its technology is clear. Larger, resource-rich countries like the United States and China already maintain highly resourced espionage operations with tools equivalent to Pegasus. European Union member states, meanwhile, have stronger privacy laws that place firmer guardrails on how their intelligence agencies and law enforcement can deploy spyware (though a handful have reportedly considered using Pegasus in the past). This largely leaves a third group: authoritarian-leaning countries that wish to surveil dissidents but lack the technical capacity to do so themselves.
In other words, NSO might not actually be the one physically sifting through journalists intercepted text messages, but they surely must have known they were creating the conditions for that surveillance to occur.
NSO’s fall from grace
It took some time, but ongoing reports of murdered journalists and secretly monitored government officials eventually caught up to NSO. In November 2021, the U.S. Commerce Department formally added NSO to its banned “Entity List” after the agency determined that its tools were credibly being used for authoritarian-style surveillance. That designation immediately prevented nearly all U.S. firms and individuals from working with or supplying NSO with components without prior government approval. Worse still for NSO, the Entity List designation also meant that its clients in numerous other countries, many of which rely on U.S. technology and internet services, were similarly restricted from using its products. At the time, I wrote for Gizmodo that the shakeup could cripple NSO’s business, and it nearly did.
But, like so many other figures with morally muddy recent histories, NSO saw an opportunity in President Trump, a leader comfortable letting past transgressions slide in the name of political expediency.
Which brings us to the topic of NSO’s unlikely new owners. Following months of speculation, a company spokesperson confirmed that NSO had received tens of millions of dollars (and gained controlling ownership) from an American investment group led by Robert Simonds, a film producer and financier perhaps best known for his work on 1990s-era Adam Sandler comedies. An unusual choice, to be sure, but what is even more interesting is who the new U.S. owners appointed to steer NSO’s ship.
Almost immediately, the company appointed close Trump ally David Friedman as its new Executive Chairman. Friedman was nominated by the president during his first administration to serve as the US ambassador to Israel and oversaw the diplomatic recognition of Jerusalem as the country’s capital. (He’s also a noted proponent of Israeli settlement expansion, for what it’s worth). Prior to that, Friedman worked as Trump’s personal bankruptcy attorney, reportedly playing a key role in helping the then-civilian Trump navigate bankruptcy proceedings for several casinos scattered around Atlantic City. Needless to say, the two go way back.
That close proximity to the president gives NSO a far greater chance of achieving a paramount business goal: having its name removed from the trade blacklist. President Trump could basically make that happen at any time with the stroke of a pen. But, if the past ten months are any guide, the president isn’t likely to handover his signature without receiving a weighty gift in return. Friedman, for his part, has stated that he believes NSO’s spy technology can help “achieve a better world.”
“If the administration, as I expect they’ll be, is receptive to considering any opportunity that might keep Americans safer, it will consider us,” he said in a recent interview with The Wall Street Journal.
How Pegasus could surveil ‘the enemy within’
NSO’s technology stack, and Pegasus in particular, is a near-perfect tool for the current administration to deploy in its ongoing and expanding domestic surveillance operations. Surreptitious access to the phones of migrants (and the lawyers or reporters who regularly communicate with them) could grant ICE and Customs and Border Protection unprecedented insight into where groups are organizing and hiding. The fear of undetectable monitoring could also pressure activists and critics of current immigration enforcement policies to self-censor or avoid entering the political fray altogether.
Pegasus could also add an additional, even more intensive layer to the administration’s ongoing social media surveillance program. The administration has stated that it monitors social media posts for content that “bear hostile attitudes” toward the country and may use that information as a basis for revoking visas. It’s not difficult to imagine a social media user flagged by one of the administration’s speech monitors then being targeted by Pegasus for more intensive surveillance. The targets for that surveillance aren’t limited to noncitizens, either, as the Brennan Center For Justice’s Faiza Patel and Matthew Ruppert explained in a recent blog post.
“Labeled as ‘domestic terrorists’ by the administration, these targets include anti-ICE protesters and anyone who allegedly funds them—all of them part of a supposed left-wing conspiracy to violently oppose the president’s agenda,” Patel and Ruppert write.
Any of those actions, should in theory require a search warrant. But there’s decent reason to believe the administration could easily find loopholes to sidestep that roadblock. Recent reports in Wired and 404 Media have detailed efforts by the administration to outsource more of its immigration investigation and enforcement effort to private contractors, which some lawmakers have critically referred to as “bounty hunters.” So far, these groups have reportedly received close to a third of a billion dollars.
These private firms, operating at arm’s length from federal government oversight, could easily purchase Pegasus and use it to conduct the kinds of quick, surreptitious surveillance for which ICE or local police forces may require court orders. (The legal precedents governing how “private investigators” can conduct digital surveillance are complex and vary from state to state). And since these contractors aren’t always operating under the scope of the Freedom of Information Act, it will be much more difficult for reporters and activists to petition for records.
In short, removing NSO from the entity list and permitting its use to spy on the domestic “enemy from within“ risks moving the US into that third category of country mentioned above. One where unaccountable private police monitor political dissent with a thin veneer of plausible deniability.
None of that is to say that current surveillance will simply cease to exist without NSO’s involvement. ICE and CBP have a plethora of tools currently at their disposal, as does the FBI and local law enforcement, which often share data and methods. Still, adding another, even-less publicly accountable layer to that structure, one fueled by a company linked to well documented abuses in numerous authoritarian regimes around the world, certainly wouldn’t be a move in the right direction.
In other news…
More on ICE’s efforts to outsource immigration tracking to private firms (Dell Cameron / Wired)
A recent proposal includes sending $180 million to a company that would be charged with remote spying.
Reports suggest that these companies—which include the notorious Blackwater military group, are being offered an “incentive-based pricing structure” tied to performance.
“The filings outline a performance-based structure with bounty-like incentives: Firms will be paid a fixed price per case, plus bonuses for speed and accuracy, with vendors expected to propose their own incentive rates,” Wired writes.
Afghan man charged with federal crimes for making a TikTok post (Associated Press)
Still developing, but one of the more extreme reactions so far to the recent National Guard shootings in D.C.
India’s telecom ministry is forcing smartphone owners to install a controversial state-run security app (Chiara Castro / TechRadar)
Critics warn that the “Sanchar Saathi” app, intended as a citizen crime-tracking tool, could be used as a surveillance Trojan horse.
A growing number of US towns are turning their backs on Flock license plate readers (Faith Wardwell / Politico)
These systems have been installed in more than 6,000 municipalities across the United States in recent years.
But backlash over overly broad records requests tied to immigration-enforcement actions is causing residents in these areas to have second thoughts.
Pornhub is asking Apple and Google to verify age on device (AJ Dellinger / Gizmodo)
Pornhub’s owners said that “site-based age-assurance approaches are fundamentally flawed and counterproductive.”
The world’s most used porn site is currently blocked in 23 states.
Something to watch in 2025: momentum around age verification is shifting toward placing greater pressure on leading smartphone makers.
The ‘The “Algorithm Accountability Act”’ is just online censorship by another name (Mike Masnick / TechDirt)
Lawmakers, always eager to repeal Section 230 online speech protections, are now using Charlie Kirk’s name to push their agenda.
“The bill would strip Section 230 protections from companies if it can be proven in court that they used an algorithm to amplify content that caused harm. This change means tech giants would “own” the harmful content they promote, creating a private cause of action for individuals to sue.‘
Big Tech’s strongest lobbying firm is suing Virgina over law limiting kids to one hour of social media (Emma Roth / The Verge)
The bill, set to take effect on January 1, 2026, would require social media platforms to ensure that users under the age of 16 can’t use their services for more than 60 minutes per day.
A law firm representing Meta, Google, and Amazon argues that the measure would violate the First Amendment and would force companies to require privacy-risking age verification for all users, not just those under 16.
