Khadija Ismayilova long ago learned to be paranoid.
The Azerbaijani investigative journalist has been harassed, threatened, and jailed for her award-winning exposés into official corruption. Intimate videos, secretly recorded in her bedroom, have been leaked in an attempt to discredit her. She learned to use encrypted messaging apps and kept up with the latest technology to keep her and her sources safe.
“It’s like a war,” she said of her efforts to stay a step ahead of her country’s authoritarian regime.
“We’ve been recommending to each other this tool or that tool, how to keep it more and more secure from the eyes of the government.”
But in late May, Ismayilova learned that she’d lost the arms race to a weapon she hadn’t even imagined. Forensic evidence showed that her phone had been secretly infected with spyware, called Pegasus, that could access every single one of its documents, photographs, messages, and contacts. Her entire life had long since been laid bare.
“I realized that there is no way,” she said with resignation. “Unless you lock yourself in an iron tent, there is no way they will not interfere into your communications. It’s horrifying.”
Once again, Ismayilova believes she has fallen victim to Azerbaijan’s government — but this time, it had some help in getting to her. Pegasus, the software that breached her phone, is made by NSO Group, an Israeli company of which the regime in Baku is almost certainly a client.
(Neither Azerbaijan nor NSO Group have acknowledged that the autocratic government is using the controversial spyware, although a forensic analysis of another Azerbaijani journalist’s phone showed it was also infected by Pegasus.)
Co-founded by two high-school friends in 2010, NSO Group specialized in breaking into mobile phones from the very beginning. As the devices spread across the planet, governments eager to listen in came calling. The company grew into a major player in the spyware market, with dozens of clients, over 700 employees, and revenues of $250 million as of 2018.
The company says it licenses its Pegasus software only to governments, and only to help them fight terrorism and crime. But journalists and digital privacy experts have repeatedly found authoritarian regimes using Pegasus to spy on reporters, dissidents, and human rights advocates.
And though NSO Group is near the top of the pyramid, it’s not alone. The company is just one actor in an ecosystem of private “cyber intelligence” firms, many based in tech-savvy, entrepreneurial, and militarized Israel.
These companies insist that their technology is essential in the battle against crime and that their products save lives. But their success has led to what experts call a “democratization” of access to sophisticated spyware. Once available only to the few elite intelligence services that could develop it themselves, it can now be purchased by security agencies and law enforcement from Azerbaijan to Kazakhstan, Mexico to Togo.
The spyware companies also feed a lucrative market for the “exploits,” or bugs, that their software uses to break into victims’ systems. Since tech companies like Apple and Google fix these as soon as they’re discovered, there is a constant demand for new vulnerabilities that freelance hackers are willing to supply — for a price. Experts say the huge sums spyware companies spend on new exploits dwarf the resources tech companies spend to patch them.
“Because there’s that very appealing economic incentive, there are always going to be more people finding these things,” said Claudio Guarnieri, the head of Amnesty International’s Security Lab. “Manufacturers will always be in ... a losing position.”
“It’s just a cat and mouse game,” he said. “And in this situation, the cat is always ahead.”
NSO Group’s public-facing website is long on reassuring language, advertising the company’s values (“accountability” and “integrity”) and presenting a bland mission statement: “We work to save lives and create a better, safer world.”
Only a single phrase — that NSO Group helps its clients “meet the challenges of encryption” — betrays any hint of what its technology actually does. (Pegasus, the company’s main product, is not even mentioned by name.)
In fact, though NSO Group has been around for over a decade, its website appeared just two years ago, reportedly as part of a new public relations strategy. Stung by repeated negative exposés about misuse of its software, the company decided its previous silence wasn’t working.
Co-founder and CEO Shalev Hulio has started making himself available for interviews, in which he has argued that the narrative around the company would be different if he could only divulge its full story.
“I can say in all modesty that thousands of people in Europe owe their lives to hundreds of our company employees,” he told Israeli outlet Ynetnews in 2019.
But the new openness only goes so far. Hulio declines to discuss NSO Group’s clients, or even to confirm who they are. Asked about specific cases by German newspaper Die Zeit last year, he said it was up to the customers that buy his software to determine who is a legitimate target. “Is a lawyer a legit target? A human rights activist, is he a legit target? ... Yes or no? A sixteen year old kid? The answer is: it depends.”
But though he acknowledged that intelligence work can be a morally ambiguous business — ”that’s what it takes to catch the bad guys sometimes” — Hulio insisted to the newspaper that NSO Group was a force for good.
“If I knew that, because of our company, human rights were violated dramatically, I would hand in my keys and leave,” he said. “I didn’t found this company to violate human rights. We founded NSO to help law enforcement and intelligence agencies.”
This is an origin story he has told on several occasions. After leaving the Israel Defense Forces, he started out selling Israeli products in U.S. shopping malls. He then got together with a high-school friend, Omri Lavie, to found a company that helped mobile operators troubleshoot customers’ phones remotely.
Sometime around 2009, Hulio said, they were approached by an unnamed European intelligence agency who said they needed help.
At the time, security services and law enforcers were desperate to solve what some called the “going dark” problem: the growing usage of encryption to safeguard messages as they travelled between devices. The trend accelerated after Edward Snowden’s revelations in 2013 made clear that U.S. intelligence agencies were conducting mass surveillance online.
“That’s when you started seeing pretty much everybody doing it,” Guarnieri, the security researcher, said. “Apps [with end-to-end encryption] started popping out all over the place.”
As a result, he explained, hacking the devices themselves became the only way to intercept communications.
This is exactly where NSO Group excelled. A document detailing the features of the company’s Pegasus system, leaked in 2015, renders its capabilities starkly clear: “Encryption … and other communications concealing methods are no longer relevant when an agent is installed on the device.”
But Pegasus goes far beyond reading messages. Once implanted on a user’s phone, the system can collect a stunning range of information, including photos, emails, contacts, and data transmitted over other apps, like Facebook and WhatsApp. It can even record live audio and video.
For years, a common way of getting Pegasus installed on someone’s phone was tricking them into clicking on a malicious link. The tactics used to do so reached astonishing levels of manipulation: Two Mexican journalists were taunted with supposed compromising photos of their partners; another received a plea for help finding a missing daughter with a link to a purported portrait. Just one click, and Pegasus would have been implanted, ready to extract anything and everything.
These capabilities were widely publicized for the first time in a 2016 report by Citizen Lab, a research center at the University of Toronto that focuses on human rights and technology. The publication, called “The Million Dollar Dissident,” used detailed forensics to show how Pegasus had infected the phone of a prominent human rights activist from the United Arab Emirates.
At the time, Citizen Lab researchers said, NSO Group’s technology was already impressive.
“I think it was the first time we had seen any spyware which could infect the latest up-to-date phone just by tapping on the link,” said Bill Marczak, a senior research fellow.
“That’s why we chose the name ‘Million Dollar Dissident,’” said John Scott-Railton, a senior researcher. “We want to highlight the fact that real resources were being put into targeting dissidents, not just that it was an afterthought” he said. “NSO allowed us to make that argument.”
More recently, Pegasus has gained the ability to infiltrate phones without resorting to suspicious links — or any interaction at all. In 2019, WhatsApp sued NSO Group for exploiting a vulnerability in which a simple call to the victim’s device could install the spyware. The victim didn’t even need to answer.
“One of the biggest problems is that we don't know about the latest thing that Pegasus can and cannot do,” said Eva Galperin, the director of cybersecurity at the Electronic Frontier Foundation. “This is actually one of the things that makes it really hard to train activists and journalists how to defend themselves. … They’re always hearing either outdated advice or incorrect advice.”
There’s plenty of need for good advice. Groups like Citizen Lab and Amnesty International have focused on NSO Group in part because the company’s software has appeared in so many high-profile cases involving journalists and activists.
In Mexico — reportedly the very first client to acquire Pegasus — the software has been used against journalists and human rights lawyers. Even nutritionists and policymakers who supported a soda tax were targeted by Pegasus exploit links.
Amnesty International found NSO Group software used against a staff member working on human rights issues in Saudi Arabia. Panama’s former president, Ricardo Martinelli, has been accused of using Pegasus to illegally wiretap and surveil his political opponents.
By 2018, Citizen Lab had documented NSO Group’s software potentially being used in 45 countries. According to the company’s recent “transparency report,” it has 60 clients around the world.
But though NSO Group may be one of the most prominent spyware vendors, it’s far from alone. An entire ecosystem of surveillance companies has arisen to fulfill a growing demand for off-the-shelf intelligence tools.
“When Snowden happened, people were like, we don’t have that tech yet,” said Scott-Railton of Citizen Lab, referring to the former NSA contractor’s revelations that the agency had engaged in mass surveillance. “A lot of countries were like, how do we get the good stuff?”
Because the spyware industry’s practitioners tend to be secretive, conducting their business behind closed doors and at invite-only trade shows, it has fallen to advocacy organizations to survey the field. A 2016 report by non-profit rights group Privacy International found 528 surveillance companies plying their trade across the world, mostly based in the United States and Europe — with Israel rounding out the top five exporters.
Ron Deibert, Citizen Lab’s director, described the products on offer as an “off-the-shelf NSA for countries that can’t afford it.”
“Think about it this way,” he said, referring to a 2017 case involving Ethiopia and another Israeli spyware company. “One of the poorest countries in the world, with less than ... 15 percent Internet connectivity, can nonetheless ... go out and undertake a massive global cyber-espionage operation.”
“We’re living in a time when the world is descending into authoritarianism,” he said. “There are very few countries out there that have robust safeguards in place to prevent abuse of this very powerful, invasive technology.”
There are some mechanisms to prevent abuses. Most countries that host spyware companies are party to the Wassenaar Arrangement, an international agreement that promotes transparency in the export of arms and technology that has military uses. Though Wassenaar initially focused on standard military fare like battle tanks and attack helicopters, “intrusion software” was added to the list in 2013.
Rights groups point out that the extent to which countries actually restrict spyware sales — or treat human rights concerns as a relevant factor — is unknown. As Citizen Lab has noted, sales to countries with “notorious records of abusive targeting of human rights defenders” occur “despite the existence of applicable export controls.”
Israel is not party to the Wassenaar Arrangement, but its export rules do use the lists it establishes. As a result, NSO Group’s sales to its foreign clients are subject to approval by the country’s defense ministry.
But as a top arms exporter, the Israeli government is influenced by both commercial and strategic considerations.
“[Israeli] exports of intelligence equipment can play a particularly important role in strengthening intelligence cooperation [with other countries],” says Privacy International, warning that “it is unclear how high a priority is placed on the consideration of human rights.”
“The real problem is that the Israeli regulation is a state secret,” said a person familiar with NSO Group who spoke to the Guardian on condition of anonymity. “There is no parliamentary oversight. It’s all controlled by the Israeli Ministry of Defense.”
In a response to reporters’ inquiries, the Israeli defense ministry said that it “approves the export of cyber products exclusively to governmental entities, for lawful use, and only for the purpose of preventing and investigating crime and counter-terrorism.” In case of violations, the ministry said, “appropriate measures are taken.”
The Israeli segment of the surveillance industry is especially significant because the country punches far above its weight. The Financial Times has reported that, in 2015, Israeli companies accounted for some 10 percent of the global cyber security market. And according to Privacy International, Israel’s measure of “surveillance companies per capita” is more than 10 times higher than the United States’.
Among the reasons is the country’s enormous talent pool, with mandatory military conscription, a highly educated and tech-savvy population, and elite intelligence units eager to train promising recruits.
“There was this huge pipeline of talent coming out of the military every year,” Gadi Aviran, who founded the intelligence firm Terrogence, told the New Yorker in 2019. “All a company like mine had to do was stand at the gate and say, ‘You look interesting.’”
Unsurprisingly, NSO Group is no exception.
Veterans from Unit 8200 of the Israeli Defense Forces, which is responsible for communications intelligence and has been described as “the foremost technical intelligence agency in the world,” are known to have helped develop its technology. Even the company’s spokesperson, Ariella Ben-Avraham, is a former brigadier general who once held the role of “State Chief Censor.”
NSO Group has provided plenty of job opportunities for Israel’s young veterans, with the company’s workforce rising to over 700 in recent years. But that doesn’t mean all of the exploits its software uses come from the inside.
“I imagine there’s a good chunk that they discover and develop themselves,” said Guarnieri, the Amnesty International security researcher. “And there’s probably also a good chunk to be acquired from external researchers and brokers. That’s generally how that industry works.”
To be clear, though there are rumors, no evidence has emerged that NSO Group has purchased exploits from freelance hackers. But spyware firms need a steady stream of new exploits because technology companies like Apple and Google are constantly patching existing vulnerabilities. Their updates are part of an arms race against freelance hackers who can earn staggering sums discovering fresh, still-unpatched bugs referred to as “zero-days.”
By the early 2000s, private companies were already reaching out to freelancers for help, offering them “bounties” for fresh exploits they could package for their customers.
Nicole Perlroth, a New York Times reporter who covers cybersecurity and digital espionage, explored the rise of this market in her best-selling book, “This is How They Tell Me the World Ends.” Her sources told her about companies that sent middlemen to Eastern Europe with duffel bags stuffed with cash to buy fresh exploits.
By 2013, Perlroth writes, the founder of an annual surveillance trade show estimated that the market for exploits had “surpassed $5 billion from ‘nothing 10 years ago.’”
With so much money to be made, unsavory players flocked to it. One was “the Grugq,” a South African man who Forbes photographed with a bag of cash and who made a living as a broker, connecting hackers and their exploits with government agencies willing to pay hundreds of thousands of dollars to acquire them. (He said that 80 percent of his revenues come from clients in the United States, illustrating how, as Perlroth writes, U.S. agencies were “helping drive a lucrative and unregulated cyberarms race.”)
And when Hacking Team, an Italian competitor to NSO Group, was itself hacked in 2015, the leaked emails showed “how zero-day exploits were being priced, traded, and incorporated into ever-more-powerful off-the-shelf spyware and sold to governments with the most abysmal of human rights.”
Today, some powerful exploits are reportedly sold for $2 million or even $2.5 million, demonstrating the headwinds tech companies face in their efforts to outrun the freelancers.
Galperin from the Electronic Frontier Foundation pointed out that both Apple and Google have teams devoted to hunting for “state level actors.”
“But they’re also in a position where they’re playing whack-a-mole,” she said.
Guarnieri also praised Apple for its responsiveness, but lamented that “they’re just always going to be behind.”
Scott-Railton of Citizen Lab said that governments, civil society, and tech companies need to work together to address the issue. “I think it’s unrealistic to assume that any one of those sectors is going to solve the problem alone,” he said.
He noted that litigation, such as WhatsApp’s recent suit against NSO Group, was a step forward. But in the end, said Deibert, Citizen Lab’s head, what was needed was public pressure. Things would only change, he said, “once people begin to realize this is an industry that inherently causes harm.”
When contacted for comment for this project, a law firm responding for NSO Group said that the data used by journalists to point to possible Pegasus infections had been misinterpreted, and reiterated the company’s position that its software is not misused by client governments. (Click here to read more of NSO Group’s response).
With reporting from Pegasus Project partners including Die Zeit, the Washington Post, the Guardian, and Forbidden Stories.
