In the past few months, we have read a lot about the terrifying spyware ‘Pegasus’ that uses zero-day exploit to hack any iPhone and Android devices, even the latest models running on the latest software version. The limelight led the developer of Pegasus spyware, NSO, an Israeli-based company, in hot waters with Human rights organizations and more importantly with the United States.
Last month, NSO was declared a national security risk by the U.S. Commerce Department’s Bureau of Industry and Security (BIS) and was put on the Entity List for engaging in activities that are contrary to the national security or foreign policy interests of the United States. A new report by Ars Technica provides more details on how NSO got itself blacklisted by the U.S. and now faces possible bankruptcy.
A red line was crossed, when Pegasus sold to Ugandan general was used to hack U.S. officials stationed in Africa
After several damning reports on the use of Pegasus to hack journalists, rival politicians, activists, and others were published, Reuters claimed that Pegasus was also used to hack the iPhone’s of at least nine U.S State Department employees stationed in Uganda or other in East African countries in the last seven months. Although it was unknown who carried out the attacks, it was certain that they used NSO’s spyware to do so.
According to the new report, it might be the Ugandan government. It is claimed that NSO CEO sold Pegasus to Uganda in 2019.
In February 2019, an Israeli woman sat across from the son of Uganda’s president and made an audacious pitch—would he want to secretly hack any phone in the world? Lt. General Muhoozi Kainerugaba, in charge of his father’s security and a long-whispered successor to Yoweri Museveni, was keen, said two people familiar with the sales pitch.
NSO’s chief executive, Shalev Hulio, landed in Uganda to seal the deal, according to two people familiar with NSO’s East Africa business. Hulio, who flew the world with the permission of the Israeli government to sell Pegasus, liked to demonstrate in real time how it could hack a brand-new, boxed iPhone.
And two years after the sale, the spyware was used to hack 11 U.S. officials in the Uganda embassy. As NSO customers knew that U.S. phone numbers were off-limits, the attackers targeted victims who were using Ugandan numbers with Apple IDs using their State Department emails.
In the aftermath NSO, tried to contain the situation by launching an investigation and closing business in Africa but the damage was done. That violation was considered as crossing a major red line which landed NSO on the U.S blacklist and sued by Apple. The report states:
Israeli and US officials declined to confirm that the Ugandan hack directly triggered a decision to blacklist NSO. But one US official who discussed the issue with Israel’s defense ministry said: “Look at the entire sequence of events here—this is careful, not by chance.” He added that putting NSO, one of the jewels of Israel’s tech community, on a US blacklist was designed to “punish and isolate” the company.
NSO, which Moody’s has estimated earned $243 million in revenues in 2020, is currently facing a financial crisis. And if the U.S senate puts a sanction on the company, it will be cut off from the US banking system and its employees will be banned from traveling to the country.
For now, the US pressure had left NSO with few options, said company insiders. Moody’s has downgraded NSO’s debt as the company’s free cash flow turned negative in 2020 and is expected to remain negative this year. “There’s a high risk NSO might not be in compliance” with a covenant on the $500 million in loans it took in 2019 to go private at a $1 billion valuation, said Moody’s.
