NSO's Pegasus complex structure hampers EU probe

• 

Documents exchanged by the company's ownership with members of the European Parliament suggest that an investigation in the European Parliament is trying to find out how the Israeli spyware business NSO Group functions.

The international scandal over Pegasus spyware, used by the Israeli occupation authorities, broke out in July 2021 after a joint media investigation unveiled that the spyware had also been used to keep an eye on politicians, businessmen, activists, journalists, and opposition figures around the world.

The European Parliament launched an investigation on April 19 on the use of the surveillance software in EU member states including Spain's Prime Minister Pedro Sánchez, as well as political parties in Spain, Poland, and Hungary.

However, records exchanged with members of the investigation committee and obtained by Politico reveal how NSO Group established a vast corporate structure with obscure-sounding companies in numerous countries that are hindering EU efforts.

Moritz Körner, a German MEP from the liberal Renew Europe, stated that “the ownership structure behind NSO seems to have been established with the aim of concealing the factual owners and responsibilities. One of the first tasks of the Parliament’s inquiry committee must be to unravel the past and current decision-making processes behind NSO."

According to a company structure shared with MEPs by investment firm Berkley Research Group (BRG), which took over management of NSO Group in the summer of 2021, NSO Group is made up of over 30 subsidiaries and units — with names like CS-Circles Solutions and Westbridge Technologies — spread across "Israel", Luxembourg, Cyprus, Bulgaria, the US, Hong Kong, and the UK.

Saskia Bricmont, a member of the Pegasus investigation, said, "Lack of transparency, complex corporate structures, shell companies, and international shareholders" diminish responsibility and make holding businesses accountable more difficult.

Bricmont went on to say that governments were increasingly relying on the private surveillance sector to get hacking tools, which led to “fundamental rights violations and act[s] outside of legal frameworks.”

After the business' then-owner Novalpina stated the company was exporting from those nations, digital rights organization Access Now contacted Bulgarian and Cypriot authorities in 2019 inquiring if they had issued NSO Group export licenses. The authorities stated that they had not, but fresh information about the company's structure raises the issue of whether they instead gave licenses to one of NSO's numerous subsidiaries.

According to an NSO Group representative, the company's organizational structure is "abundantly clear" and in accordance with all legal and regulatory standards.

While officials attempt to gain control of the Israeli spyware provider, the company itself is embroiled in a violent internal power struggle.

According to the investigation, NSO Group's new owners BRG notified members of the European Parliament that NSO Group's founders Shalev Hulio and Omri Lavie, as well as its former owner Novalpina, are thwarting their efforts to examine and reform the corporation.

However, ownership records obtained by Politico reveal that BRG controls NSO Group. According to Reuters, it took over control of Novalpina and, via it, NSO Group in July 2021. According to the ownership paperwork, it has made many appointments inside the corporate structure since taking over.

The founders, new owners, and previous owners have now moved to European national courts to settle their differences.

According to the documents, BRG is facing legal action in Luxembourg and London from its ex-owner Novalpina, who claims irregularities in the purchase of NSO Group. Novalpina is also claiming ownership of NSO, which would be "once again effectively putting them in control of the NSO Group and any future sales of the Pegasus product,” according to a letter to MEPs.

According to a BRG representative, tensions between the two parties deteriorated in November when NSO Group management abruptly withdrew from negotiations aimed at establishing adequate corporate governance.

Separately, BRG stated in their communication that the founders of NSO Group, Hulio, and Lavie, had started legal action in Luxembourg, which might result in their loss of control of the board.