disinfozone/The_Info_Web
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

vault backup: 2026-10-13 18:58:30

Browse source
This commit is contained in:
disinfo.zone 2026-10-13 18:58:30 -04:00
parent b4af588f5a
commit 973895149e
No known key found for this signature in database
32 changed files with 2476 additions and 176 deletions
Download patch file Download diff file Expand all files Collapse all files

38
20 - ORGANIZATIONS/PRIVATE/NSO Group.md
View file

@ -16,7 +16,7 @@ tags:
summary: "Israeli spyware company founded in 2010 by Omri Lavie, Shalev Hulio, and Niv Carmi, developer of Pegasus, whose government clients selected over 50,000 potential targets, including Khashoggi's family, before the July 2021 Pegasus Project exposure."
location: "Herzliya, Israel"
created: 2026-06-18
updated: 2026-10-12
updated: 2026-10-13
relations:
- type: partner_of
with: "[[Unit 8200]]"
@ -43,27 +43,31 @@ NSO licensed Pegasus exclusively to government clients, framing the product as a
The documented deployment patterns include: [[Mexico|Mexico]] (one of NSO's largest clients, where multiple administrations used Pegasus against journalists including [[Cecilio Pineda Brito|Cecilio Pineda Brito]], activists, lawyers, and even a child, per the [[Citizen Lab|Citizen Lab]] investigation); [[Catalonia|Catalonia]] (the "[[CatalanGate|CatalanGate]]" finding by Citizen Lab in 2022 documenting dozens of Catalan independence politicians and activists targeted by the Spanish state); [[El Salvador|El Salvador]] (surveillance continuing through 2022 despite NSO's reform pledges); and the [[Saudi Arabia|Saudi]] targeting of [[Jamal Khashoggi|Khashoggi]]'s associates.[^3][^8][^9][^10]
In January 2020 CNBC named [[Saud al-Qahtani]] among Saudi officials said to have bought Pegasus, writing that the spyware "has been widely reported as having been purchased by Saudi officials including Saud al-Qahtani, Prince Mohammed's former advisor who was implicated in the Khashoggi murder but ultimately not charged by the Saudi authorities."[^11] The sentence appears in CNBC's report on the UN statement about the analysis of [[Jeff Bezos]]'s iPhone by [[FTI Consulting]], and CNBC attributes the purchase claim to earlier press reporting.
### The Khashoggi Surveillance
Pegasus was deployed against the associates of Jamal Khashoggi before the October 2018 murder inside the Saudi consulate in [[Istanbul|Istanbul]]. [[The Guardian|The Guardian]] reported in July 2021, based on the Pegasus Project leak, that Pegasus was found on the phone of Khashoggi's wife [[Hanan Elatr|Hanan Elatr]] months before the killing. An Emirati government agency separately placed NSO spyware on the phone of a Khashoggi associate, [[Al Jazeera|Al Jazeera]] reported. Khashoggi's friend [[Omar Abdul Aziz|Omar Abdul Aziz]] sued NSO Group, claiming the spyware enabled the murder by mapping Khashoggi's network and communications. A federal judge dismissed the widow's lawsuit against NSO in October 2023.[^11]
Pegasus was deployed against the associates of Jamal Khashoggi before the October 2018 murder inside the Saudi consulate in [[Istanbul|Istanbul]]. [[The Guardian|The Guardian]] reported in July 2021, based on the Pegasus Project leak, that Pegasus was found on the phone of Khashoggi's wife [[Hanan Elatr|Hanan Elatr]] months before the killing. An Emirati government agency separately placed NSO spyware on the phone of a Khashoggi associate, [[Al Jazeera|Al Jazeera]] reported. Khashoggi's friend [[Omar Abdul Aziz|Omar Abdul Aziz]] sued NSO Group, claiming the spyware enabled the murder by mapping Khashoggi's network and communications. A federal judge dismissed the widow's lawsuit against NSO in October 2023.[^12]
The Khashoggi surveillance ran through the same [[Mohammed bin Salman|MBS]]-[[WhatsApp|WhatsApp]] channel that [[Jared Kushner|Jared Kushner]] used to communicate with the Saudi crown prince, and through the broader Saudi-Emirati intelligence network that operated Pegasus against the targets. The NSO Group sits at the intersection of the documented surveillance infrastructure that enabled the Khashoggi assassination and the Kushner-MBS relationship that shaped the Trump administration's response to it.[^11]
Citizen Lab's report "The Kingdom Came to Canada," published October 1, 2018, assessed with high confidence that the phone of Omar Abdulaziz was infected with Pegasus.[^13] The authors attributed the infection to "a Pegasus operator linked to Saudi Arabia," an operator they named KINGDOM, which they tied to the 2018 targeting of the Saudi dissident Yahya Assiri and an Amnesty International researcher.[^13] The report states that the authors were unaware of any legal authorization for the infection and monitoring of Abdulaziz in Canada by a foreign government.[^13]
The Khashoggi surveillance ran through the same [[Mohammed bin Salman|MBS]]-[[WhatsApp|WhatsApp]] channel that [[Jared Kushner|Jared Kushner]] used to communicate with the Saudi crown prince, and through the broader Saudi-Emirati intelligence network that operated Pegasus against the targets. The NSO Group sits at the intersection of the documented surveillance infrastructure that enabled the Khashoggi assassination and the Kushner-MBS relationship that shaped the Trump administration's response to it.[^12]
### Ownership and the Novalpina Deal
NSO was acquired by [[Francisco Partners|Francisco Partners]], a technology-focused private equity firm, in 2014. Francisco Partners's ownership period covered the initial expansion of the Pegasus client base across multiple governments, including the documented deployments in Mexico, Saudi Arabia, and the [[United Arab Emirates|United Arab Emirates]]. The Francisco Partners ownership placed a standard private-equity firm in operational control of a cyber-arms company in its portfolio.[^3][^12]
NSO was acquired by [[Francisco Partners|Francisco Partners]], a technology-focused private equity firm, in 2014. Francisco Partners's ownership period covered the initial expansion of the Pegasus client base across multiple governments, including the documented deployments in Mexico, Saudi Arabia, and the [[United Arab Emirates|United Arab Emirates]]. The Francisco Partners ownership placed a standard private-equity firm in operational control of a cyber-arms company in its portfolio.[^3][^14]
In 2019, the co-founders Hulio and Lavie re-acquired NSO from Francisco Partners with funding from [[Novalpina Capital|Novalpina Capital]], a London-based private equity firm founded by [[Stephen Peel|Stephen Peel]]. The Novalpina acquisition valued NSO at approximately 1 billion dollars. The re-acquisition coincided with the period of intensifying scrutiny on NSO's government-client deployments, and the Novalpina ownership became itself a subject of controversy when Novalpina's limited partners raised concerns about the ethical implications of owning a cyber-arms company. Novalpina subsequently underwent its own internal crisis, and the ownership structure of NSO entered a period of documented instability.[^3][^12]
In 2019, the co-founders Hulio and Lavie re-acquired NSO from Francisco Partners with funding from [[Novalpina Capital|Novalpina Capital]], a London-based private equity firm founded by [[Stephen Peel|Stephen Peel]]. The Novalpina acquisition valued NSO at approximately 1 billion dollars. The re-acquisition coincided with the period of intensifying scrutiny on NSO's government-client deployments, and the Novalpina ownership became itself a subject of controversy when Novalpina's limited partners raised concerns about the ethical implications of owning a cyber-arms company. Novalpina subsequently underwent its own internal crisis, and the ownership structure of NSO entered a period of documented instability.[^3][^14]
The Pegasus Project investigation (July 2021) and the subsequent regulatory and legal pressure (including [[Apple|Apple]]'s lawsuit against NSO, the U.S. Commerce Department's addition of NSO to the [[Entity List|Entity List]] in November 2021, and the WhatsApp v. NSO litigation) have constrained the company's operations. The ownership trajectory from startup to Francisco Partners portfolio company to Novalpina-controlled entity to a constrained and legally challenged operation documents the arc of a private intelligence firm that operated with limited accountability through multiple ownership regimes.[^3][^12]
The Pegasus Project investigation (July 2021) and the subsequent regulatory and legal pressure (including [[Apple|Apple]]'s lawsuit against NSO, the U.S. Commerce Department's addition of NSO to the [[Entity List|Entity List]] in November 2021, and the WhatsApp v. NSO litigation) have constrained the company's operations. The ownership trajectory from startup to Francisco Partners portfolio company to Novalpina-controlled entity to a constrained and legally challenged operation documents the arc of a private intelligence firm that operated with limited accountability through multiple ownership regimes.[^3][^14]
### WhatsApp Litigation
WhatsApp sued NSO in October 2019 in the Northern District of California. A July 16, 2020 order described NSO as an Israeli limited liability company, described [[Q Cyber Technologies]] as an Israeli corporation and NSO's only active director and majority shareholder, and recorded the complaint's allegation that defendants sent malware through WhatsApp's system to about 1,400 mobile devices.[^13]
WhatsApp sued NSO in October 2019 in the Northern District of California. A July 16, 2020 order described NSO as an Israeli limited liability company, described [[Q Cyber Technologies]] as an Israeli corporation and NSO's only active director and majority shareholder, and recorded the complaint's allegation that defendants sent malware through WhatsApp's system to about 1,400 mobile devices.[^15]
On December 20, 2024, Judge Phyllis Hamilton granted WhatsApp's motion for partial summary judgment on liability under the federal Computer Fraud and Abuse Act and California's Comprehensive Computer Data Access and Fraud Act, and denied NSO's motion for summary judgment. The order granted the sanctions motion in part, considered terminating sanctions, preferred evidentiary sanctions, and stated that a trial would proceed only on damages.[^14]
On December 20, 2024, Judge Phyllis Hamilton granted WhatsApp's motion for partial summary judgment on liability under the federal Computer Fraud and Abuse Act and California's Comprehensive Computer Data Access and Fraud Act, and denied NSO's motion for summary judgment. The order granted the sanctions motion in part, considered terminating sanctions, preferred evidentiary sanctions, and stated that a trial would proceed only on damages.[^16]
On May 6, 2025 a jury returned a unanimous verdict of $444,719 in compensatory damages and $167,254,000 in punitive damages (Dkt. 736), a total of $167,698,719.[^15] On October 17, 2025 Judge Hamilton granted a permanent injunction and remitted the punitive award to $4,002,471 (a nine-to-one ratio to compensatory damages); WhatsApp accepted the remittitur on October 31, 2025; on November 12, 2025 the court entered the permanent injunction, which excludes NSO's foreign sovereign customers, and a final judgment of $4,447,190.[^15][^16] On December 19, 2025 the court denied a stay of the injunction pending appeal.[^17]
On May 6, 2025 a jury returned a unanimous verdict of $444,719 in compensatory damages and $167,254,000 in punitive damages (Dkt. 736), a total of $167,698,719.[^17] On October 17, 2025 Judge Hamilton granted a permanent injunction and remitted the punitive award to $4,002,471 (a nine-to-one ratio to compensatory damages); WhatsApp accepted the remittitur on October 31, 2025; on November 12, 2025 the court entered the permanent injunction, which excludes NSO's foreign sovereign customers, and a final judgment of $4,447,190.[^17][^18] On December 19, 2025 the court denied a stay of the injunction pending appeal.[^19]
### Footnotes
@ -77,10 +81,12 @@ On May 6, 2025 a jury returned a unanimous verdict of $444,719 in compensatory d
[^8]: "Reckless Exploit: Mexican Journalists, Lawyers, and a Child Targeted with NSO Spyware." *Citizen Lab.* https://citizenlab.ca/research/reckless-exploit-mexico-nso/
[^9]: For the Catalonia (CatalanGate) finding, see the Citizen Lab 2022 CatalanGate report.
[^10]: "NSO Group's Continued Surveillance." *Rest of World,* 2022 (El Salvador). https://restofworld.org/2022/nso-pegasus-el-salvador/
[^11]: "NSO spyware used to target family of Jamal Khashoggi, leaked data shows." *The Guardian,* July 18, 2021. https://www.theguardian.com/world/2021/jul/18/nso-spyware-used-to-target-family-of-jamal-khashoggi-leaked-data-shows-saudis-pegasus
[^12]: For the Novalpina Capital ownership deal, see the published NSO Group and Novalpina Capital documentation.
[^13]: *WhatsApp Inc. v. NSO Group Technologies Limited*, No. 4:19-cv-07123-PJH (N.D. Cal.), Order on motions to dismiss (Dkt. 111, July 16, 2020), pp. 1-2. https://www.govinfo.gov/content/pkg/USCOURTS-cand-4_19-cv-07123/pdf/USCOURTS-cand-4_19-cv-07123-5.pdf
[^14]: *WhatsApp Inc. v. NSO Group Technologies Limited*, No. 4:19-cv-07123-PJH (N.D. Cal.), Order re motions for summary judgment and sanctions (Dkt. 494, December 20, 2024), at 16. https://www.govinfo.gov/content/pkg/USCOURTS-cand-4_19-cv-07123/pdf/USCOURTS-cand-4_19-cv-07123-24.pdf
[^15]: *WhatsApp LLC v. NSO Group Technologies Limited*, No. 4:19-cv-07123-PJH (N.D. Cal.), Final Judgment (Dkt. 810, November 12, 2025), p. 2. https://www.govinfo.gov/content/pkg/USCOURTS-cand-4_19-cv-07123/pdf/USCOURTS-cand-4_19-cv-07123-44.pdf
[^16]: Same case, Order re permanent injunction and remittitur (Dkt. 802, October 17, 2025), pp. 1-2 and conclusion. https://www.govinfo.gov/content/pkg/USCOURTS-cand-4_19-cv-07123/pdf/USCOURTS-cand-4_19-cv-07123-40.pdf ; Order granting permanent injunction (Dkt. 809, November 12, 2025), p. 2. https://www.govinfo.gov/content/pkg/USCOURTS-cand-4_19-cv-07123/pdf/USCOURTS-cand-4_19-cv-07123-43.pdf
[^17]: Same case, Order denying motion to stay permanent injunction (Dkt. 824, December 19, 2025). https://www.govinfo.gov/content/pkg/USCOURTS-cand-4_19-cv-07123/pdf/USCOURTS-cand-4_19-cv-07123-46.pdf
[^11]: CNBC, "Bezos phone hacking: UN calls for immediate investigation," January 22, 2020. Copy: https://web.archive.org/web/2020id_/https://www.cnbc.com/2020/01/22/bezos-phone-hacking-un-calls-for-immediate-investigation.html
[^12]: "NSO spyware used to target family of Jamal Khashoggi, leaked data shows." *The Guardian,* July 18, 2021. https://www.theguardian.com/world/2021/jul/18/nso-spyware-used-to-target-family-of-jamal-khashoggi-leaked-data-shows-saudis-pegasus
[^13]: Citizen Lab, "The Kingdom Came to Canada: How Saudi-Linked Digital Espionage Reached Canadian Soil," October 1, 2018, https://citizenlab.ca/2018/10/the-kingdom-came-to-canada-how-saudi-linked-digital-espionage-reached-canadian-soil/. Citizen Lab Report No. 115, by Bill Marczak, John Scott-Railton, Adam Senft, Bahr Abdul Razzak and Ron Deibert. The quoted phrase and the legal-authorization sentence are verbatim from the report text.
[^14]: For the Novalpina Capital ownership deal, see the published NSO Group and Novalpina Capital documentation.
[^15]: *WhatsApp Inc. v. NSO Group Technologies Limited*, No. 4:19-cv-07123-PJH (N.D. Cal.), Order on motions to dismiss (Dkt. 111, July 16, 2020), pp. 1-2. https://www.govinfo.gov/content/pkg/USCOURTS-cand-4_19-cv-07123/pdf/USCOURTS-cand-4_19-cv-07123-5.pdf
[^16]: *WhatsApp Inc. v. NSO Group Technologies Limited*, No. 4:19-cv-07123-PJH (N.D. Cal.), Order re motions for summary judgment and sanctions (Dkt. 494, December 20, 2024), at 16. https://www.govinfo.gov/content/pkg/USCOURTS-cand-4_19-cv-07123/pdf/USCOURTS-cand-4_19-cv-07123-24.pdf
[^17]: *WhatsApp LLC v. NSO Group Technologies Limited*, No. 4:19-cv-07123-PJH (N.D. Cal.), Final Judgment (Dkt. 810, November 12, 2025), p. 2. https://www.govinfo.gov/content/pkg/USCOURTS-cand-4_19-cv-07123/pdf/USCOURTS-cand-4_19-cv-07123-44.pdf
[^18]: Same case, Order re permanent injunction and remittitur (Dkt. 802, October 17, 2025), pp. 1-2 and conclusion. https://www.govinfo.gov/content/pkg/USCOURTS-cand-4_19-cv-07123/pdf/USCOURTS-cand-4_19-cv-07123-40.pdf ; Order granting permanent injunction (Dkt. 809, November 12, 2025), p. 2. https://www.govinfo.gov/content/pkg/USCOURTS-cand-4_19-cv-07123/pdf/USCOURTS-cand-4_19-cv-07123-43.pdf
[^19]: Same case, Order denying motion to stay permanent injunction (Dkt. 824, December 19, 2025). https://www.govinfo.gov/content/pkg/USCOURTS-cand-4_19-cv-07123/pdf/USCOURTS-cand-4_19-cv-07123-46.pdf