• NSO Group, best known for its Pegasus spyware, unseats its CEO as staff are culled
• American blacklisting and pending lawsuits force major changes  
• Company will now concentrate on sales to NATO members countries 

In Ancient Greek mythology, Pegasus, the flying white horse, was born from the pooling lifeblood of the gorgon Medusa as Perseus, heroic slayer of monsters, cut her head off. Notoriously wild and a law unto itself, Pegasus was finally broken and bridled by Bellerophon, the son of the sea god Poseidon, with the help of Athena, the goddess of war, handicraft and practical reason (how’s that for a job description?) Fast forward a few thousand years and we can report today that NSO Technologies, the private Israeli company behind the Pegasus spyware scandal, fell to earth over the weekend in a cloud of virtual horse feathers and hubris. 

Pegasus infiltrates smartphone operating systems and carries out remote zero-click surveillance. It is compatible with both the iPhone and Android operating systems. The company is facing multiple lawsuits alleging that its clients around the world, including the likes of China, Hungary, Myanmar, India, Iran, Russia, Saudi Arabia and the United Arab Emirates, used Pegasus to target swathes of heads of states, politicians, journalists, media personalities, political activists, industrialists, ordinary citizens and even the clergy!

The software can extract data and remotely activate cameras and microphones - all without the user being aware it is happening. So powerful is Pegasus that it is classified as a weapon by the Israeli government and can only be exported to authorised countries with its permission. Despite growing evidence to the contrary, NSO has continued to assert that its software is sold only to government agencies and then only for the purpose of tracking terrorists and criminals. Or it least it did until last weekend. 

In November 2021 the Biden administration placed NSO Group on the US Department of Commerce Entity List following a determination that the company developed and supplied spyware to foreign governments that used the tool maliciously to target organisations and individuals and, in so doing, “acted contrary to the foreign policy and national security interests of the United States”. The blacklisting effectively deprived NSO of key US technology on which it apparently relied to make Pegasus work.

After that, and with major lawsuits filed and more pending, the writing was on the wall for NSO, on Sunday 21 August, the company, which a was founded in 2010, announced that co-founder and CEO, the 40 year-old Shalev Hulio, is stepping down and had been replaced by COO Yaron Shohat, who will lead the company until a new CEO is found. And according to the Times of Israel, 100 staff were made redundant as part of a root and branch ‘reorganisation’.

Hulio isn’t going away, though: He remains a major shareholder in NSO and, despite his “stepping down”, retains a seat on the Board of Directors, will contribute to the company “at a strategic level” and will be the lead on “any future investment or sale” negotiations. His take on yesterday’s events is that “The company is reorganising to prepare for its next phase of growth.” Various media reports say the company is looking to be acquired. 

In the past, NSO was very bullish about what it does. Last year, talking to the Washington Post newspaper, the usually reclusive Hulio complained, “All we hear is this campaign that we are violating human rights,” adding that he knows that Pegasus has “saved lives globally” but was not allowed to say how many, where or when. He did add that “somebody has to do the dirty work.”

In a July 2021 interview with Forbes magazine, Hulio insisted that NSO works with governments to help them apprehend only the most dangerous criminals and terrorists, and that the company cannot be held responsible for any abuses perpetrated via Pegasus software. He said, “We are selling our products to governments. We have no way to monitor what those governments do… we cannot be blamed on the misuse that a government did.”

He added that the ordinary man and woman in the street have nothing to worry about. He told Forbes, “As for the average person, they’ve no need to fear NSO Group. The people that are not criminals, not the Bin Ladens of the world, they can absolutely trust on the security and privacy of their Google and Apple devices.” Except, absolutely they can’t, as example after example illustrates.

As reorganisation kicks in, the chastened company says it will now “examine all aspects of its business” and will ‘streamline’ it by focusing on sale to members of the 30 county-strong NATO military alliance. Interestingly, the European Union, many of whose members states are also part of NATO, is investigating whether use of Pegasus is in breach of EU law and the fundamental rights of its citizens. 

Sooner or later the sale of the company seems likely. NSO has had financial problems in the past and only last year investors voiced pressing concerns that it was at risk of defaulting on its debt. Meanwhile, NSO will have to deal with lawsuits filed by, among others, Apple and Meta (Facebook as was) in the US, while, in the UK, the High Court has ruled Saudi Arabia does not have immunity from a legal challenge over allegations that it used Pegasus spyware against a British resident, Ghanem Humood al-Masarir, a London-based human rights activist and political satirist from Saudi Arabia. And where one lawsuit can be filed, many other cases can follow. Meanwhile, the investigation by the European Parliament continues.

By the way, NSO gets its name from the initial latter of the three man who founded the company: Niv Karmi, Shalev Hulio and Omri Lavia. Not many people know that.