The CEO of NSO Group, which owns spyware Pegasus, has said that the BDS Movement or Qatar could be behind the current ‘snoopgate’ controversy. CEO Shalev Hulio, in an interview with Israel Hayom, has stated that the list of phone numbers being circulated as ‘potential’ Pegasus targets is in no way associated with them.
Shalev Hulio said, “We don’t have and have never had any ties to the list that was published, and if it turns out that there was some client who exploited our system to track journalists or human rights workers, they’ll be cut off immediately. We’ve proven that in the past, including with some of our biggest customers, and we stopped working with them.” He said that he would welcome an investigation into the matter.
The NSO CEO said that he checked their servers after an acquaintance told him that ‘they’ had broken into NSO servers at Cyprus and accessed a list of targets.
Hulio stated, “In the meantime, we checked our servers, and we checked with the customers, and we didn’t find anything that had been cracked. But because it seemed strange, I asked the guy to bring us examples from the leaked list. We got them – a few phone numbers – and started to check them with our customers. Not a single one was a target for Pegasus. I realized it had nothing to do with us, and we moved on.”
Shalev Hulio said that most media organisations were convinced of the NSO version of events after they hired lawyers and sent out letters. He said, “The editor [in chief] of the Washington Post even wrote that she didn’t know where the list had come from or who had put the numbers on it, and that she had no confirmation that the numbers were associated with Pegasus or had even ever been targets or potential targets.”
‘BDS or Qatar behind controversy’: Shalev Hulio, NSO Group CEO
Shalev Hulio said that he suspected the BDS Movement or Qatar to be behind the attack. The BDS is a movement to impose boycotts, divestments, and economic sanctions in order to end their ‘oppression’ of Palestine.
“It looks like someone decided to come after us. This whole story isn’t just incidental. The Israeli cyber sector is under attack, in general. There are so many cyber intelligence companies in the world, but everyone just focuses on the Israeli ones. Forming a consortium like this of journalists from all over the world and bringing Amnesty [International] into it – it looks like there’s a guiding hand behind it,” Hulio stated.
He said, “I believe that in the end, it will turn out to be Qatar, or the BDS movement, or both. In the end, it’s always the same entities. I don’t want to sound cynical, but there are people who don’t want ice cream to be imported here [to Israel] or for technology to be exported. The way I see it, it’s no coincident that the same week that people try to prevent Cellebrite’s IPO, an expose about [cyber firm] Candiru is published, and now us. It can’t be that this is all coincidental.”
NSO’s ‘four rules’ for selecting customers for Pegasus
Shalev Hulio said that when the company was founded, four rules were agreed on. “First, we would sell to governments only, and not companies or individuals. You can imagine how many people and companies tried to buy the technology, and we always said no. The second rule is that we don’t sell to every government, because not every government in the world should have these tools. Looking back 11 years after the company was founded, we have 45 customers, but 90 countries to whom we refused to sell.”
He continued, “The third rule is that we don’t activate the system, we just install it, instruct how to use it, and leave. The fourth rule is that we want to be under the Defense Ministry’s regulatory oversight. We have been under voluntary oversight since 2010, even though the law for defense and security oversight of cyber companies was written only in 2017. We haven’t ever made a deal that wasn’t under oversight.”
The NSO Group has constantly denied that the list is associated with Pegasus in any manner. They threatened to file defamation suit against The Wire for their reports on the matter. Amnesty International, one of the organisations that fed the information to the media, later claimed that they had never said the list was of NSO targets in an ambiguous statement.
