NSO Group

# NSO Group Technologies

Identity

NSO Group Technologies Ltd., operating under parent holding company Q Cyber Technologies Ltd., is an Israeli private cybersecurity and surveillance technology firm founded in 2010 by Shalev Hulio, Omri Lavie, and Niv Carmi. The company is headquartered in Herzliya, Israel, and specializes in developing and licensing what it describes as "lawful intercept" technology to government intelligence and law enforcement agencies worldwide. NSO Group's flagship product, Pegasus, is a sophisticated spyware platform capable of remotely accessing and extracting data from mobile devices, including iOS and Android smartphones, without user interaction. The company operates under Israeli export control regulations, with all client sales requiring approval from Israel's Ministry of Defense.

NSO Group has characterized itself as a legitimate provider of tools for combating terrorism and serious crime, asserting that it sells only to vetted government agencies and maintains contractual restrictions on use. Critics, human rights organizations, investigative journalists, and digital forensics researchers have documented extensive evidence that NSO technology has been deployed against civil society targets including journalists, activists, lawyers, and political opposition figures in countries with documented human rights concerns. These revelations have made NSO Group one of the most scrutinized private surveillance companies in the world.

The company has undergone multiple ownership changes. In 2019, it was acquired by Novalpina Capital, a London-based private equity firm. Following internal disputes and financial difficulties, control returned to the founders by 2021. In 2022, reports indicated that Francisco Partners, a U.S.-based technology-focused private equity firm, and other investors were involved in the company's financial restructuring. By 2024, NSO faced significant financial strain, repeated litigation, and international sanctions.

Origins & Charter

NSO Group was established in 2010 by three Israeli entrepreneurs with backgrounds in Israel's intelligence and technology sectors: Shalev Hulio, Omri Lavie, and Niv Carmi. The company name derives from the founders' initials: Niv, Shalev, and Omri. From its inception, NSO positioned itself in the emerging market for commercial offensive cyber capabilities—tools that exploit vulnerabilities in digital systems to provide governments with surveillance and intelligence-gathering capabilities outside traditional judicial wiretap frameworks.

The founding team leveraged Israel's established ecosystem of cybersecurity expertise, much of it rooted in military intelligence units such as Unit 8200. Israel became a global hub for companies developing offensive cyber tools, and NSO quickly became one of the most prominent. The company's business model centered on licensing its proprietary spyware platform, Pegasus, which was designed to overcome encryption and other security protections built into consumer mobile devices.

NSO Group's operations are subject to Israel's defense export control regime, administered by the Israeli Ministry of Defense. According to NSO and Israeli officials, the company cannot sell to a client without receiving a license from the ministry, which conducts vetting based on diplomatic, security, and human rights considerations. NSO has repeatedly stated that it sells only to government agencies, not private actors, and that its contracts prohibit the use of Pegasus against U.S. phone numbers, a policy stated to reflect Israeli diplomatic commitments. The company has also claimed to maintain internal compliance and ethics procedures, including an ethics committee.

Critical assessments of NSO's origins and charter note that the company emerged at a time when global demand for surveillance capabilities was expanding, driven by counterterrorism policies post-9/11, growing use of encrypted communications by criminal and extremist organizations, and authoritarian governments' interest in monitoring dissent. NSO marketed Pegasus as a solution to the "going dark" problem described by law enforcement agencies—namely, that encryption and device security were making lawful surveillance more difficult. However, digital rights advocates and security researchers have argued that NSO's business fundamentally undermined global cybersecurity, privacy rights, and the rule of law by enabling state surveillance without meaningful oversight or accountability.

Structure & Leadership

NSO Group's corporate structure has evolved through ownership changes and financial restructuring. The parent holding company is Q Cyber Technologies Ltd., registered in Israel. NSO Group Technologies Ltd. operates as the primary subsidiary.

Shalev Hulio, a co-founder, has been the most publicly visible figure, serving as CEO during critical periods of the company's growth and controversy. Hulio studied political science and business management at Tel Aviv University and previously founded other technology ventures before NSO. He has publicly defended NSO's business and asserted that the technology is used responsibly by the vast majority of clients. Omri Lavie and Niv Carmi, the other co-founders, have remained less prominent publicly but held significant roles in the company's early years.

In 2019, NSO Group was acquired by Novalpina Capital, a London-based private equity firm, for a reported $1 billion. The acquisition was intended to provide capital for expansion and international growth. However, Novalpina's management became embroiled in internal disputes, and by 2021, amid mounting legal and reputational challenges for NSO, control reverted to the founders. Shalev Hulio reassumed the role of CEO.

In 2022, reports indicated that Francisco Partners, a U.S.-based private equity firm specializing in technology investments, along with other investors, participated in a financial restructuring of NSO. The company faced significant debt obligations and revenue challenges due to export restrictions, legal liabilities, and reputational damage. By 2024, NSO reportedly attempted to exit the government spyware market or pivot its business model, though the company continued to face financial strain and legal pressures.

NSO's operational structure has included research and development teams focused on discovering and exploiting software vulnerabilities (zero-day exploits) in widely-used mobile operating systems and applications. The company has employed hundreds of engineers, salespeople, and support staff. NSO maintained offices in Israel and reportedly had international representation for client relations, though its primary engineering and intelligence operations have remained in Israel. The company has operated under significant operational security, with limited public transparency about its workforce, client list, or internal decision-making processes.

Major Activities & Operations

NSO Group's core activity has been the development, licensing, and operational support of the Pegasus spyware platform. Pegasus is a modular surveillance tool capable of remotely infecting mobile devices, gaining full access to communications, stored data, location information, cameras, and microphones. Technical analyses by digital forensics organizations have documented that Pegasus exploits previously unknown vulnerabilities (zero-day exploits) in iOS, Android, and other systems, enabling infection through methods that require no user action—so-called "zero-click" attacks. These capabilities have made Pegasus exceptionally difficult for targets to detect or prevent.

NSO's business model involves licensing Pegasus to government intelligence and law enforcement agencies on a subscription or per-target basis. According to company statements and investigative reports, NSO does not operate Pegasus on behalf of clients; instead, clients receive training and technical support to operate the system themselves. NSO has maintained that it does not have access to the data collected by client agencies, a claim that has been challenged by critics who note that NSO retains significant technical control over the platform and provides ongoing infrastructure support.

Estimates of NSO's client base have ranged from at least 40 government agencies to as many as 60, across countries including Mexico, Saudi Arabia, United Arab Emirates, Morocco, Hungary, India, Rwanda, Azerbaijan, Kazakhstan, Bahrain, and others. Some clients have been publicly acknowledged by NSO or confirmed through investigative reporting, forensic evidence, or legal proceedings. NSO has consistently declined to disclose its full client list, citing confidentiality obligations and national security concerns.

Documented use cases of Pegasus have ranged from counterterrorism and criminal investigations—contexts NSO highlights in its public statements—to targeting of civil society, journalists, human rights defenders, and political opposition figures. Forensic investigations by organizations such as Citizen Lab, Amnesty International's Security Lab, and other independent researchers have identified hundreds of individuals whose devices were infected or targeted by Pegasus. In several high-profile cases, victims were targeted shortly before or after significant events, including arrests, public advocacy, or publication of investigative journalism.

NSO has also developed other products, including Phantom, a data collection platform for extracting information from cloud services and remote servers. However, Pegasus has remained the company's flagship and most scrutinized product.

Historical Importance

NSO Group represents a landmark case in the global proliferation of commercial surveillance technology and the privatization of offensive cyber capabilities previously confined to state intelligence agencies. The company's rise coincided with a broader shift in which private firms, often with close ties to national security establishments, began developing and marketing sophisticated digital intrusion tools to governments worldwide. This market has raised profound questions about sovereignty, human rights, the rule of law, and accountability in the digital age.

Pegasus technology demonstrated that commercial actors could match or exceed the offensive capabilities of some state intelligence agencies, particularly in exploiting consumer technology platforms. The zero-click remote exploitation capabilities developed by NSO pushed the boundaries of what was technically feasible and challenged the ability of device manufacturers, cybersecurity defenders, and civil society to protect against state-sponsored surveillance.

NSO's activities have had documented consequences for press freedom, human rights, and political processes in multiple countries. Investigations have linked NSO spyware to the surveillance of journalists reporting on corruption, activists organizing against authoritarian governments, lawyers representing political prisoners, and opposition politicians in democratic and nondemocratic contexts alike. The existence of NSO's technology has had a chilling effect on civil society in countries where its use has been documented, as individuals aware of the potential for surveillance alter their communications and activities.

The international response to NSO has also been historically significant. In November 2021, the U.S. Department of Commerce added NSO Group to the Entity List, effectively prohibiting U.S. companies from providing technology, software, or services to NSO without a license. The designation was based on a determination that NSO's products were used in ways contrary to U.S. foreign policy and national security interests, including targeting U.S. government personnel. This marked one of the first times the U.S. government imposed such restrictions on an Israeli cybersecurity firm and reflected the Biden administration's emphasis on technology and human rights.

NSO Group's case has also catalyzed legal, regulatory, and technical responses. Apple, Meta (formerly Facebook), and other technology companies have sued NSO for unauthorized access to their systems and harm to their users. Legislators in the United States, European Union, and other jurisdictions have considered or enacted new regulations governing the sale and use of surveillance technology. Civil society organizations have used NSO as a case study in advocating for transparency, accountability, and human rights protections in the digital sphere.

Documented Controversies

Established Fact In 2016, a Pegasus infection attempt was identified on the iPhone of Ahmed Mansoor, a prominent human rights activist in the United Arab Emirates. Citizen Lab and Lookout Security analyzed the attack and documented three zero-day vulnerabilities in iOS that were being exploited to deliver Pegasus. Apple issued patches shortly thereafter. This case was one of the first public exposures of NSO's capabilities and marked the beginning of sustained scrutiny.

Established Fact In 2017, researchers at Citizen Lab documented the use of NSO spyware to target members of Mexican civil society, including journalists investigating government corruption, lawyers representing victims of state violence, and public health advocates opposing government soft drink policies. The targeting occurred during the administration of President Enrique Peña Nieto and involved text messages containing malicious links. Mexican officials initially denied purchasing or using Pegasus, but investigative reporting later confirmed government contracts with NSO.

Established Fact In 2018, forensic evidence analyzed by Citizen Lab indicated that Pegasus spyware was used to target close associates of Saudi journalist Jamal Khashoggi shortly before his murder at the Saudi consulate in Istanbul in October 2018. The targeting included individuals in Khashoggi's immediate circle, raising concerns about whether NSO technology contributed to surveillance that facilitated the killing. NSO denied that its technology was used in connection with Khashoggi's murder and stated it had no information supporting such use, but did not disclose whether Saudi Arabia was a client.

Established Fact In July 2021, a consortium of international news organizations published investigations based on a leaked list of more than 50,000 phone numbers that forensic analysis indicated were selected as potential targets for Pegasus surveillance by NSO clients. The list was obtained by Forbidden Stories, a Paris-based journalism nonprofit, and Amnesty International, and was analyzed by the Amnesty International Security Lab, Citizen Lab, and media partners including The Washington Post, The Guardian, Le Monde, and others. Forensic examination of a sample of phones associated with numbers on the list confirmed Pegasus infections or attempted infections in dozens of cases. The investigation, known as the Pegasus Project, documented targeting of at least 180 journalists, more than 600 politicians and government officials, at least 85 human rights activists, and at least 65 business executives across multiple countries.

Established Fact Among the individuals identified in the Pegasus Project as confirmed Pegasus targets were journalists at major international outlets including The Financial Times, CNN, The New York Times, Al Jazeera, and others; human rights defenders working on behalf of political prisoners and against state surveillance; lawyers representing clients in politically sensitive cases; and members of civil society organizations in Hungary, India, Azerbaijan, Saudi Arabia, Morocco, and elsewhere. The investigation linked the targeting to specific NSO clients based on country-level forensic indicators and contextual analysis of targets' locations and activities.

Government Finding Following the Pegasus Project revelations, the U.S. Department of Commerce announced on November 3, 2021, that NSO Group and another Israeli firm, Candiru, were added to the Entity List for "engaging in activities that are contrary to the national security or foreign policy interests of the United States." The determination cited evidence that NSO's products "have been used to target and enable the surveillance of government officials, journalists, businesspeople, activists, academics, and embassy workers in multiple countries, including the United States." The designation effectively prohibited U.S. companies from providing technology or services to NSO without a U.S. government license.

Established Fact In 2021, forensic analysis by Citizen Lab confirmed that the iPhones of at least nine U.S. State Department employees stationed in Uganda were infected with NSO Pegasus spyware. The infections were identified by Apple and reported to victims via threat notifications. The targeting represented a direct attack on U.S. government personnel and was cited by U.S. officials as a factor in the decision to add NSO to the Entity List. NSO stated it was not aware of the targeting in advance and terminated the client responsible once it became aware, though it did not publicly identify which client government was involved.

Confirmed by Court In November 2021, Apple Inc. filed a lawsuit against NSO Group in U.S. federal court, alleging that NSO violated the Computer Fraud and Abuse Act and California law by creating and deploying malware targeting Apple products and services, including through the exploitation of iMessage. Apple sought an injunction barring NSO from using Apple software, services, or devices. The lawsuit stated that NSO's attacks "transcend ordinary malware or cybersecurity threats" and were designed to target specific individuals, including journalists, activists, and government officials. The case has proceeded through discovery, with NSO challenging jurisdiction and seeking dismissal, which courts have rejected in part.

Confirmed by Court In October 2019, Meta Platforms Inc. (then Facebook Inc.) and its subsidiary WhatsApp filed a lawsuit against NSO Group in U.S. federal court, alleging that NSO exploited a vulnerability in WhatsApp's call functionality to deliver Pegasus spyware to approximately 1,400 devices. The lawsuit alleged violations of the Computer Fraud and Abuse Act, California Comprehensive Computer Data Access and Fraud Act, and breach of contract. WhatsApp identified at least 100 members of civil society—journalists, human rights defenders, and others—among the targets. In July 2020, a federal judge rejected NSO's motion to dismiss the case on sovereign immunity grounds, ruling that NSO was a private company, not a foreign government, and was not entitled to immunity. The case has continued through discovery and pre-trial proceedings.

Official Record In 2021, Amnesty International and other organizations filed a petition before the Israeli Supreme Court challenging the Israeli Ministry of Defense's export licensing decisions for NSO Group. The petitioners argued that the ministry had failed to enforce its own human rights criteria and that Israeli law required the ministry to consider whether NSO's technology would be used to commit serious human rights violations. In 2022, the Israeli Supreme Court dismissed the petition, ruling that the ministry's export control decisions were subject to broad executive discretion and that the petitioners had not demonstrated grounds for judicial intervention. The court did not rule on the substantive merits of whether NSO exports violated human rights obligations.

Established Fact In 2022, the European Parliament established a Committee of Inquiry to investigate the use of Pegasus and equivalent surveillance spyware within the European Union, following revelations that Pegasus had been used to target members of the European Parliament, opposition politicians, journalists, and civil society figures in Poland, Hungary, Spain, and Greece. The inquiry documented cases in which surveillance occurred without judicial authorization or oversight, raising concerns about rule of law and fundamental rights protections. The committee's final report, published in 2023, called for stricter regulation of surveillance technology, moratoriums on the use of spyware against civil society, and accountability for misuse.

Credible Allegation In 2021, The Guardian and other outlets reported that forensic analysis indicated the phone of Cecilio Pineda Birto, a Mexican journalist murdered in 2017, had been targeted by Pegasus spyware in the weeks before his killing. Citizen Lab analysis indicated targeting consistent with Mexican government use of NSO technology. While direct causation between the surveillance and the killing was not established, the case exemplified concerns that NSO spyware enabled governments to identify, track, and potentially facilitate violence against civil society targets. NSO and Mexican officials denied that Pegasus was used in connection with the journalist's death.

Reported Association NSO Group has maintained that it conducts human rights due diligence, operates an ethics committee, and has terminated client contracts in cases of misuse. However, the company has not disclosed the identities of clients it has terminated, the criteria it uses for termination decisions, or the frequency of such actions. Critics have argued that NSO's transparency and accountability mechanisms are insufficient given the documented scope and pattern of misuse.

Investigations & Official Findings

Multiple official investigations have examined NSO Group's activities and impact:

Government Finding The U.S. Department of Commerce Bureau of Industry and Security, in its November 2021 determination adding NSO to the Entity List, conducted an investigation based on evidence from multiple sources, including forensic research by civil society organizations, media reporting, and intelligence assessments. The department concluded that NSO's products had been used in ways contrary to U.S. national security and foreign policy interests, including targeting of U.S. government personnel and civil society.

Parliamentary or Congressional Finding The European Parliament's Committee of Inquiry on the Use of Pegasus and Equivalent Surveillance Spyware, active from 2022 to 2023, conducted extensive hearings, document reviews, and expert testimony. The committee's final report documented multiple cases of Pegasus use in EU member states without adequate judicial oversight, targeting of opposition politicians and journalists, and failures of national authorities to investigate or provide remedies. The committee recommended that the European Commission propose legislation regulating spyware, called for a moratorium on its use against civil society, and urged member states to hold accountable officials responsible for misuse.

Official Record In 2021 and 2022, multiple governments, including the United States, France, and Israel, conducted internal reviews following revelations that senior government officials, including heads of state and cabinet ministers, had been targeted by Pegasus spyware operated by foreign governments. French President Emmanuel Macron's phone was identified as a potential target in the Pegasus Project investigation, leading to a formal investigation by French prosecutors. Israel's Ministry of Defense conducted an internal review of export licensing procedures but did not publicly release findings.

Confirmed by Court In discovery proceedings in the WhatsApp v. NSO Group case, court filings and deposition testimony have provided rare public insights into NSO's operations. NSO sought to limit discovery on the grounds of state secrets and sovereign immunity, but U.S. courts have largely rejected these claims, ruling that NSO is a private commercial entity subject to U.S. jurisdiction for its activities targeting users in the United States. The litigation is ongoing, with no final judgment as of 2024.

Official Record In 2022, the U.S. House Permanent Select Committee on Intelligence held closed-door briefings on foreign surveillance threats to U.S. government personnel, including the use of NSO spyware against State Department employees. While no public findings were released, members of Congress publicly stated that the incidents represented unacceptable threats and called for stronger countermeasures and diplomatic responses.

Academic Numerous peer-reviewed academic studies and technical reports have analyzed NSO Group's technology, business model, and impact. Citizen Lab at the University of Toronto's Munk School of Global Affairs & Public Policy has published dozens of reports documenting NSO's global deployment, technical capabilities, and targeting of civil society. Amnesty International's Security Lab has published forensic methodologies and case studies, contributing to the evidentiary foundation for public and legal accountability efforts.

Legacy & Historical Debate

NSO Group's legacy is intensely contested. Supporters, including some government and law enforcement officials, argue that NSO's technology has been essential to counterterrorism, stopping violent crime, and rescuing kidnapping victims, and that misuse by a small number of clients should not overshadow legitimate use by responsible governments. NSO has published reports and testimonials asserting that Pegasus has saved lives and prevented attacks, though it has not provided independent verification or detailed case studies.

Critics, including human rights organizations, digital rights advocates, investigative journalists, and many technologists, argue that NSO Group exemplifies the dangers of unregulated commercial surveillance and the failure of existing legal and diplomatic frameworks to protect human rights in the digital age. They contend that NSO knowingly profited from sales to authoritarian regimes and governments with poor human rights records, that the company's due diligence and accountability mechanisms were inadequate or cosmetic, and that the existence of Pegasus has fundamentally undermined global cybersecurity and digital rights.

The debate over NSO also reflects broader questions about the relationship between technology companies and states, the adequacy of export control regimes, and the challenges of governing dual-use technologies that can be used for both legitimate and abusive purposes. Some scholars and policymakers have argued for international treaties governing surveillance technology, similar to arms control regimes. Others have proposed stricter domestic regulations, mandatory transparency, or outright bans on the sale of offensive cyber tools to non-democratic states.

The legal precedents set by cases involving NSO, particularly the rejection of sovereign immunity defenses and the application of U.S. jurisdiction over foreign companies targeting U.S. persons and systems, may shape future litigation and enforcement actions against other surveillance companies. The U.S. Entity List designation of NSO has been viewed as a significant policy shift, signaling that the U.S. government may impose consequences on companies whose products undermine human rights or U.S. interests, even when those companies are allies.

The technical and forensic methods developed by Citizen Lab, Amnesty International, and other organizations to detect and attribute NSO spyware have become models for digital forensics and civil society cybersecurity. These capabilities have enabled victims, journalists, and researchers to document state surveillance and challenge official denials, though the resources required for such forensic work remain significant and unevenly distributed.

NSO Group's financial difficulties and reported efforts to exit the spyware market by 2024 raised questions about the future of the commercial surveillance industry. Some analysts suggested that NSO's troubles, driven by reputational damage, legal liabilities, and export restrictions, could deter other companies or lead to consolidation and greater secrecy. Others warned that demand for surveillance technology remains high, and that new entrants or existing competitors—some with even less transparency—would fill the vacuum.

Continue Investigating

NSO Group's activities are inseparable from the broader architecture of global surveillance and the commercialization of offensive cyber capabilities. The Archive profiles several key actors and entities that have investigated, exposed, or intersected with NSO's operations. Citizen Lab, the University of Toronto-based interdisciplinary research group, has produced the majority of public forensic evidence documenting NSO's technology and its deployment against civil society worldwide. Amnesty International Security Lab developed and shared forensic tools used to detect Pegasus infections and collaborated on the Pegasus Project investigation. Ron Deibert, founder and director of Citizen Lab, has been a leading voice in advocating for accountability, transparency, and human rights protections in the regulation of surveillance technology. Shalev Hulio, NSO's co-founder and CEO, has defended the company's mission and operations in interviews and statements, representing the perspective of NSO and the commercial surveillance industry. Francisco Partners, the private equity firm involved in NSO's financial restructuring, represents the capital and investment interests that have funded the surveillance technology sector. The Israeli Ministry of Defense grants the export licenses that legally authorize NSO's sales, making its regulatory decisions central to NSO's operations and accountability.

The Archive dossier on Pegasus Spyware provides comprehensive documentation of the technology itself, its technical capabilities, deployment, targets, and consequences. Readers investigating NSO Group should also explore related Archive dossiers on digital surveillance, privacy, state power, and technology governance, including Snowden and NSA Mass Surveillance, which documents the scope and methods of state surveillance in the digital age; Five Eyes and ECHELON, which examine international intelligence-sharing frameworks; Vault 7, the CIA's collection of hacking tools; Stuxnet, another landmark case of offensive cyber capabilities; and The Crypto Wars and Encryption Backdoors, which explore the policy and technical debates over encryption, privacy, and surveillance. The Cambridge Analytica Scandal offers a parallel case of technology misuse, private-sector data exploitation, and the challenges of accountability. The Panama Papers and Paradise Papers investigations illustrate the global investigative journalism methods that were also applied in the Pegasus Project. The ongoing investigation into NSO Group, its technology, clients, and impact remains a central case study in the accountability of private actors in the surveillance state.