NSO Group In Talks To Offload Pegasus Spyware – Report

US defence contractor L3Harris is reportedly in talks to takeover NSO Group’s controversial Pegasus surveillance technology.

The Guardian newspaper (along with the Washington Post and Haaretz), cited multiple sources, when it reported on Tuesday the possible L3Harris takeover could give an American company control of one of the world’s most sophisticated and controversial hacking tools.

The possible acquisition should come as no surprise however. In December NSO was reportedly exploring its strategic options that included shutting the Pegasus unit or selling the entire company.

L3Harris takeover?

The Guardian reported that its sources had confirmed that discussions were centred on a sale of the Israeli company’s core technology – or code – as well as a possible transfer of NSO personnel to L3Harris.

But any agreement still faces significant challenges, not least of which would be the approval from the US and Israeli governments.

And gaining that approval could be very challenging indeed.

It should be remembered that in November 2021, the Biden administration placed NSO on its Entity List, and accused it of acting “contrary to the foreign policy and national security interests of the US”.

“Such a transaction, if it were to take place, raises serious counterintelligence and security concerns for the US government,” the Guardian quoted a senior White House official as saying in a statement.

US defence contractor L3Harris neither confirmed or denied it was seeking to acquire NSO’s Pegasus.

“We are aware of the capability and we are constantly evaluating our customers’ national security needs,” an L3Harris spokesperson reportedly said, when asked to comment on the talks. “At this point, anything beyond that is speculation.”

Five eyes clients?

The White House meanwhile reportedly said that it had not been involved in “any way in this reported potential transaction”.

The senior White House official also said the US government “opposes efforts by foreign companies to circumvent US export control measures or sanctions, including placement on the US Department of Commerce’s Entity List for malicious cyber activity”.

The official also reportedly said that any US company – particularly a cleared US defence contractor – should be aware that a transaction with a blacklisted company would “not automatically remove a designated entity from the Entity List, and would spur intensive review to examine whether the transaction poses a counterintelligence threat to the US Government and its systems and information, whether other US equities with the defense contractor may be at risk, to what extent a foreign entity or government retains a degree of access or control, and the broader human rights implications”.

In April this year, it was alleged that the UAE may have used NSO Pegasus spyware on Downing Street and Foreign Office computer systems.

But US approval of the deal could be forthcoming under certain circumstances.

One person familiar with the talks was quoted by the Guardian as saying that if a deal were agreed, it would probably involve selling NSO’s capabilities to a drastically curtailed customer base that would include the “five eyes” intelligence alliance (US, UK, Canada, Australia, and New Zealand), as well as some Nato allies.

Israeli approval

The person also said that the deal faced several unresolved issues, including whether the technology would be housed in Israel or the US and whether Israel would be allowed to continue to use the technology as a customer.

In February the FBI made the startling admission that it had obtained NSO’s Pegasus spyware. The US agency purchased Pegasus during the administration of former President Donald Trump, and bought access to the surveillance tool in order to “stay abreast of emerging technologies and tradecraft”, and had not used in support of any FBI investigation.

And another point to note is that NSO is regulated by the Israeli ministry of defence, which has ultimate say over the company’s government clients.

So any deal could also face a stiff hurdle in Israel.

The Israeli ministry of defence and NSO reportedly declined to comment on the matter.

Legal troubles

NSO is currently engaged in a legal battle with both Meta and Apple.

Facebook’s Whatsapp sued NSO in October 2019, and alleged NSO was behind the cyberattack that infected WhatsApp users with advanced surveillance hacks in May 2019.

Apple also sued NSO in November last year, alleging NSO engaged in surveillance and targeting of iPhone users in the US.

Earlier this month the US Supreme Court asked the Biden administration for its thoughts on whether the justices should hear the case over whether WhatsApp can pursue its lawsuit of NSO.