Three NGOs led by Amnesty International on Monday issued a report trying to force NSO Group’s activities further into the public light by applying pressure to its investors.
NSO Group is known worldwide for developing Pegasus software, which some governments and intelligence agencies use to hack the cellphones of terrorists, drug rings and pedophiles.
However, Amnesty and other human-rights groups say it has a darker side and also sells to governments that abuse human rights, a charge NSO denies.
To date, Amnesty’s efforts at the UN, dialoguing with nation-states and in the courts have not succeeded at bringing NSO beyond a certain point of transparency, though the rounds of criticism have led the cell phone hacker to become more transparent in certain areas.
Absent success in these other arenas, Amnesty, Privacy International and The Centre for Research on Multinational Corporations (SOMO) have now started a new initiative to expose NSO’s investor class.
The report’s goal seems to be to draw out these investors so that they will, on their own, or due to the new public scrutiny they will face for their investments with NSO, prompt the company to move closer to Amnesty’s version of transparency and responsibility.
According to the report, NSO’s main investor since 2014, Francisco Partners, backed out of the company in a management buyout backed by UK private equity firm Novalpina Capital in 2019.
The report, “flags the various jurisdictions within which NSO Group and its various operating entities and holding companies are located, including the following countries: the British Virgin Islands, Bulgaria, the Cayman Islands, Cyprus, Israel, Luxembourg, the UK, and the US.”
In addition, the report said that it was known “from previous research and litigation efforts that one or more of NSO Group’s entities are granted export licenses in Israel as well as Bulgaria.”
Further, the report said that “NSO Group has confirmed that its corporate entities export from Israel, Bulgaria, and Cyprus.”
More specifically, the report names four public funds as significant investors in NSO, with two based in the UK: South Yorkshire Pensions Authority and East Riding Pension Fund; and two based in the US: Oregon Public Employees Retirement System and Alaska Permanent Fund Corp.
Moreover, the report names a variety of private individuals and investor groups who have invested in NSO Group.
The report’s recommendations include that nation-states, “(a) Implement the UN Special Rapporteur’s call for an immediate moratorium on the global sale and transfer of the products of the private surveillance industry until rigorous human rights safeguards are put in place… (b) Adopt and enforce a legal framework requiring private surveillance companies to conduct human rights due diligence in their global operations… (c) Adopt and enforce a legal framework requiring transparency in the key areas noted above… (d) Disclose contracts with such companies and implement human rights-based procurement standards,” as well as a long list of others.
Next, the report suggests to surveillance companies to “implement a broad range of human rights due diligence, transparency, and accountability measures, in accordance with the UN Guiding Principles on Business and Human Rights and the OECD Guidelines for Multinational Enterprises.”
But probably the newest and most important conclusion from the report is the push to investors themselves to “assess whether their investment portfolios include or may in the future include surveillance companies, and demand that any such portfolio companies fulfill their responsibilities to respect human rights in accordance with the UN Guiding Principles and OECD Guidelines.”
Amnesty said it hoped that greater attention to the issue could help investors “make more informed choices if they had access to information that ensured their investments were not violating human rights.”
The report includes a response from NSO regarding board membership which stated: “As a shareholder, Novalpina appoints members to the Group Boards of Directors for Triangle Holdings SA and OSY Technologies SARL and various committees of those boards, each of which provides strategic direction regarding the activities of the Group.”
However, “Novalpina is not involved in the day-to-day, operational activities of the Group, which is the responsibility of Group management. As with any corporation, senior management may consult from time to time with members of the Board on various matters.”
In July 2020, the Tel Aviv District Court dismissed a lawsuit by Amnesty to try to get the Defense Ministry to revoke NSO’s export license.
NSO also faces a civil lawsuit by Facebook in the US for allegedly hacking around 1,400 WhatApp users’ accounts.
Meanwhile, NSO is considering having its company go public, which would both enable much higher profits, but could also draw a new level of scrutiny into its methods.
Around two years ago, NSO committed to filing an annual report regarding its compliance with human rights and any violations by its clients in abusing its technology.
A spokeswoman for NSO confirmed that the report will finally come out in June, but the level of transparency in the report is still expected to fall short of what is expected from critics like Amnesty.
NSO Group had submitted a full and detailed response to the Amnesty report that was published on May 31, as can be found on Annexes 2 and 4 of the report.
Amnesty international yet again is publishing a lengthy report on NSO Group, largely based on media reports, and without providing the full context of our activities.
Just a few months ago, the Tel Aviv District Court denied Amnesty’s petition to revoke NSO Group’s Export License, stating it did not provide the evidential infrastructure to prove the claim there was an attempt to trace a human rights activist, adding: “…the process of supervising and processing applications for marketing and/or defense export licenses is a sensitive and rigorous process, in its framework the export applications are reviewed in depth by the various security authorities that deal with the various security and diplomatic aspects, as well as technological and other aspects. Licensing is done after a very strict process, and after the license is granted, the Authority conducts close supervision and monitoring, and if necessary, and if it is found that the use of the license conditions is violated, especially when there are violations human rights, they take action to revoke or suspend the defense export license...
I am satisfied that Respondents 1-4 do their job very prudently before a marketing and/or export license is granted and also after it is granted the holder of the license is subject to close monitoring by DECA, which shows a particularly high sensitivity to any violation of human rights.”
NSO Group continues to be a leader in the industry, not just with its technology, but in choosing to set the standard regarding human rights. "In the past few years, we have been very open to criticism, including by human rights groups such as Amnesty, choosing to be very proactive in our compliance process, and even about to finalize our first transparency report. We continue to welcome an open and honest discussions with any person or organization that wishes to raise their concerns and learn more about our life-saving technologies."