How NSO became the company whose software can spy on the world

In 2019, when NSO Group was facing intense scrutiny, new investors in the Israeli surveillance company were on a PR offensive to reassure human rights groups.

In an exchange of public letters in 2019, they told Amnesty International and other activists that they would do “whatever is necessary” to ensure NSO’s weapons-grade software would only be used to fight crime and terrorism.

But the claim, it now appears, was hollow.

Unknown to the activists, NSO would later hatch a deal that would help a longtime government client with an awful human rights record. Dubai, a monarchy in the United Arab Emirates, wanted NSO to give it permission to expand its potential use of the spyware so it could target mobile phones in the UK.

Quick Guide

What is in the Pegasus project data?

Show

It needed to do so, it argued, to track down drug dealers using foreign sim cards to evade surveillance.

Insiders at the company were hesitant, a person familiar with the matter said. It was a risky proposition given the track record of customers such as the UAE. In 2016, it had tried to use NSO spyware to hack the phone of one of the most outspoken and respected Emirati human rights activists, Ahmed Mansoor. He was imprisoned by Emirati authorities one year later and is still in jail.

But the Guardian has been told an NSO committee reviewing the deal agreed to Dubai’s request. Potentially, it meant that authorities in Dubai would be able to bypass privacy and anti-hacking laws that would usually protect individuals living in democracies from being spied on without a warrant and having their phones hacked by a foreign government.

Some of the people in whom authorities showed a possible interest, leaked records now indicate, were not drug dealers at all. They were human rights activists and dissidents living in exile.

Using NSO’s signature software, Pegasus, Dubai’s rulers could seek to infiltrate any mobile phone they wanted in the UK, eavesdrop on calls, look at photos, read text messages and even turn a phone’s microphone or camera on remotely. In most cases, they could do it without leaving a digital fingerprint.

This is the power of NSO’s spyware – and why countries from Mexico to Saudi Arabia, Rwanda and India appear to have been willing to pay a high price for its capabilities.

This week, the Pegasus project, a media collaboration that included the Guardian and was coordinated by the French media group Forbidden Stories, revealed new allegations of abuse, with leaked records showing the phone numbers of journalists, dissidents and political activists.

Q&A

What is the Pegasus project?

Show

The database, which was the heart of the Pegasus project investigation, included the phone details of 13 heads of state, as well as diplomats, military chiefs and senior politicians from 34 countries.

Others whose numbers appear on the leaked list include the French president, most of his cabinet, reporters in Hungary and Mexico, 400 people in the UK, including a member of the House of Lords, two princesses – and a horse trainer.