The Biden administration has blacklisted Israeli firm NSO Group, accusing the technology company of developing and supplying spyware to foreign governments “that used these tools to maliciously” target a range of actors, including journalists and activists.
In a statement on Wednesday, the US Department of Commerce said NSO Group was among four firms being added to its Entity List of companies considered to be engaged in activities contrary to US foreign policy and national security.
NSO Group sparked outrage from rights groups earlier this year after an investigation by international media outlets revealed the firm’s Pegasus spyware was used by security forces and authoritarian governments in several countries.
The Entity List, which incurs US trade restrictions, includes the Chinese smartphone manufacturer Huawei.
NSO Group and another Israeli firm, Candiru, were added because their spyware has “enabled foreign governments to conduct transnational repression, which is the practice of authoritarian governments targeting dissidents, journalists and activists outside of their sovereign borders to silence dissent”, the commerce department said.
“Such practices threaten the rules-based international order,” it added.
NSO Group said it was “dismayed” by the US decision and vowed to advocate to reverse it.
“We look forward to presenting the full information regarding how we have the world’s most rigorous compliance and human rights programs that are based on the American values we deeply share, which already resulted in multiple terminations of contacts with government agencies that misused our products,” a spokesperson for the firm said in a statement.
Russia-based Positive Technologies and Singapore-based Computer Security Initiative Consultancy PTE LTD also were blacklisted on Wednesday.
“What happens when they’re on the list is that these companies are not allowed to import any US technology that might help them develop [their product], and also other countries are not allowed to import it [US technology] and then pass it on to these companies,” Al Jazeera’s Alan Fisher reported from Washington, DC.
John Scott-Railton, a senior researcher at The Citizen Lab at the University of Toronto, which has widely reported on the use of NSO Group’s Pegasus spyware, said on Twitter that the US designation deals a “major blow” to the Israeli firm.
He said some potential consequences to look out for were an “immediate impact on NSO’s business practices & companies that will work with them”, as well as a “dramatic chilling effect on investors & NSO’s long term future”.
Danna Ingleton, deputy director of Amnesty International Technology, said the blacklisting “sends a strong message to NSO Group that it can no longer profit from human rights abuses without repercussions”.
“This is also a day of reckoning for NSO Group’s investors – will they continue to bankroll a company whose technology has been used to systematically violate human rights?” Ingleton said in a statement.
— Amnesty Tech (@AmnestyTech) November 3, 2021
Amid years of criticism, NSO Group repeatedly has denied wrongdoing, arguing that its tools are meant to track criminals and “terrorists”. It also dismissed the findings of the investigation into Pegasus earlier this year, which was based on a major data leak, as “uncorroborated theories”.
Governments accused of using the spyware, including Saudi Arabia and the United Arab Emirates, have also rejected the allegations.
Push for sanctions
But in July, several Democratic lawmakers in the US urged the Biden administration to sanction NSO Group.
“Private companies should not be selling sophisticated cyber-intrusion tools on the open market, and the United States should work with its allies to regulate this trade,” the US Congress members said in a joint statement.
President Joe Biden and his top aides have largely avoided public criticism of Israel. But in his speech to the UN General Assembly in September, Biden warned against using emerging technologies to “deepen repression”.
NSO Group is a private firm, but rights groups have denounced the Israeli government for licensing the company’s exports.
The US State Department clarified later on Wednesday that the sanctions would not affect Israel itself. “We are not taking action against countries or governments where these entities are located,” it said in a statement.
“As is the case with all announcements of this kind, partner governments are notified in advance and that was the case here,” State Department spokesperson Ned Price told reporters on Wednesday.
Reports that Pegasus spyware potentially targeted the phone of French President Emmanuel Macron had sparked tensions between France and Israel. Earlier this week, the Reuters news agency cited an Israeli official as saying that the two countries are handling the case “discreetly”.
The US Department of Commerce said on Wednesday that the sanctions against the four cyberware companies were “part of the Biden-Harris administration’s efforts to put human rights at the center of US foreign policy, including by working to stem the proliferation of digital tools used for repression”.