[ad_1]
The US commerce department’s blacklist is usually reserved for America’s worst enemies, such as Chinese companies that have been accused of aiding human right abuses, and Russians who proliferate biological and chemical weapons programmes.
But on Wednesday, Israel’s NSO Group joined their ranks, marking a rare decision by the Biden administration to include a major technology company that is closely regulated by the Israeli government on its list of entities that threaten US national security.
Also included on the list was another Israeli surveillance company, Candiru, whose technology was recently alleged by researchers at Citizen Lab, working in conjunction with Microsoft, to have been used by its foreign government clients to target members of civil society with “untraceable” spyware.
The US government said the two companies were added to the list because of evidence that they had “developed and supplied spyware to foreign governments that used these tools to maliciously target government officials, journalists, businesspeople, activists, academics and embassy workers”.
NSO Group has long held that its spyware does not infect US users over US networks, and that its signature spyware, called Pegasus, is only meant to target serious criminals.
But the move by the administration – which according to Axios gave Israel just an hour’s notice before announcing its move – underlines that the US government sees NSO and its capabilities as creating a grave threat.
John Scott-Railton, a senior researcher at Citizen Lab at the University of Toronto, which has documented dozens of allegations of abuse involving NSO spyware’s use against journalists and members of civil society, said the placement of NSO on the blacklist would have an immediate “chilling effect”.
“This is not a list you want to be on,” Scott-Railton said.
In addition to the long list of journalists and activists who have allegedly been hacked by foreign governments using the spyware, the mobile phone of a senior US diplomat, Robert Malley, was also contained on a leaked list of individuals selected as possible targets of surveillance by NSO clients. So too were senior French ministers and officials, including France’s president, Emmanuel Macron.
NSO has staunchly denied that any US or French officials have been targeted by its clients.
“It’s a harsh step but I assume it’s because the Israelis weren’t getting the message on the need for them to back NSO off,” said James Lewis, senior vice-president and director of the strategic technologies program at the Center for Strategic and International Studies.
The question now is what effect the US move will have – given how strategically important the surveillance industry is to Israel, one of the world’s largest exporters of spyware and similar tools. Technically, NSO’s inclusion on the so-called Entity List means that the company requires a special license to use any US-originating technology in its services.
“NSO will go away. Maybe the Israelis will quietly tell their companies to cool it. But it’s too important a market for them,” Lewis said.
But the implications are deeper than the technical restrictions. Foreign governments – especially in Europe – who use NSO spyware will now be knowingly working with a company that is seen by the Biden administration as a threat to US interests. That conclusion is based on a unanimous committee of US agencies, which includes the departments of state, defense, energy and – in some cases – the US treasury.
It also raises alarms for the company’s investors, including the largest single investor in the fund that owns NSO: the Oregon public pension fund. A spokesperson for the fund declined to comment.
NSO said it was “dismayed” by the news and would challenge the findings. Rod Rosenstein, the former deputy attorney general who serves as a lawyer for NSO, did not comment on whether he would continue to represent the company.
Nazak Nikakhtar, a former commerce department official who now serves as a partner at the Washington DC law firm Wiley Rein, said the move to add NSO to the US blacklist showed the US had become “hyper-vigilant” on issues around surveillance and cyber attacks, even when they involve nations that are allies.
Nikakhtar said it was likely that the decision had been based on a US intelligence report that traced “significant actions” to the company. “One bad act can trigger it, if it’s significant enough,” she added.
“We may not always be able to bring these perpetrators to justice or bring a prosecution against them. This designation is another tool the US government has to go after those and to penalize the company,” she said. “The reputational harm is significant.”
[ad_2]
Source link