U.S. Blacklists NSO Group and 3 Others for Selling Spyware, Hacking Tools

The Commerce Department’s Bureau of Industry and Security banned U.S. persons from dealing with four companies—including Israel’s NSO Group—that they say acted against national security interests by trading in hacking tools and selling spyware to foreign governments.

The other listed companies include Israel’s Candiru, Singapore’s Computer Security Initiative Consultancy and Russia’s Positive Technologies.

“The United States is committed to aggressively using export controls to hold companies accountable that develop, traffic, or use technologies to conduct malicious activities that threaten the cybersecurity of members of civil society, dissidents, government officials, and organizations here and abroad,” Secretary of Commerce Gina Raimondo said in a press release Wednesday about the companies addition to Commerce’s Entity List.

While the list often features additions from adversarial nations, Israel and Singapore are notable U.S. allies on cybersecurity. Key lawmakers have even proposed legislation for the Department of Homeland Security to issue grants to cybersecurity-related companies in Israel as long as they were part of a joint venture with a corresponding U.S. entity.

“We are not taking action against countries or governments where these entities are located,” the State Department noted in its press release.

Wednesday’s action and a related interim rule Commerce recently issued come after years of the U.S. trying to determine the right controls over technologies that can be used for legitimate cybersecurity purposes or as weapons by adversaries and intelligence-gathering operations. The interim rule describes how the U.S. finally plans to issue Authorized Cybersecurity Exceptions to control such technology and join 42 other nations that have already been enforcing regulations on hacking tools under the Wassenaar Arrangement.  

But Commerce said U.S. entities would not be issued any such exception for dealing with the four companies listed Wednesday.

Decisions to add or remove companies from the Entity List are made by members of an End-user Review Committee that is chaired by Commerce and includes the departments of State, Energy, Defense and, if necessary, Treasury.

“The ERC also determined that no license exceptions should be available for exports, reexports, or transfers (in-country) to the persons being added to the Entity List in this rule,” BIS wrote. “The ERC imposed a license review policy of a presumption of denial for these four entities.”

NSO Group plans to pursue a reversal of the decision by the ERC, which acts only by unanimous vote. 

The controversial company has repeatedly said its tools are only used by governments to pursue terrorists and illicit activities such as pedophilia but other groups say its Pegasus spyware has been used to track human rights activists and journalists around the world. 

The company has said their powerful technology—which could get complete access to a victim’s smartphone without them clicking on anything—doesn’t work on U.S. phone numbers, but the Pegasus Project revealed dozens of U.S. persons with foreign phone numbers on a list of NSO’s surveillance targets. The list of 50,000 numbers also included those of individuals close to slain journalist Jamal Khashoggi and French President Emanuel Macron along with several members of his cabinet.

On Monday, an Israeli official reportedly said Macron and Israeli Prime Minister Naftali Bennett discussed NSO and agreed the matter should be handled discreetly.

“Today’s action is a part of the Biden-Harris Administration’s efforts to put human rights at the center of U.S. foreign policy, including by working to stem the proliferation of digital tools used for repression,” Commerce said. “This effort is aimed at improving citizens’ digital security, combating cyber threats, and mitigating unlawful surveillance.”