92 lines
15 KiB
Markdown
92 lines
15 KiB
Markdown
---
|
|
aliases:
|
|
- NSO Group Technologies
|
|
category: "Private Organization"
|
|
tags:
|
|
- Organization
|
|
- NSOGroup
|
|
- Pegasus
|
|
- Spyware
|
|
- Unit8200
|
|
- Israel
|
|
- Khashoggi
|
|
- MBS
|
|
- PrivateIntelligence
|
|
- Surveillance
|
|
summary: "Israeli spyware company founded in 2010 by Omri Lavie, Shalev Hulio, and Niv Carmi, developer of Pegasus, whose government clients selected over 50,000 potential targets, including Khashoggi's family, before the July 2021 Pegasus Project exposure."
|
|
location: "Herzliya, Israel"
|
|
created: 2026-06-18
|
|
updated: 2026-10-13
|
|
relations:
|
|
- type: partner_of
|
|
with: "[[Unit 8200]]"
|
|
reverse: true
|
|
role: "veterans of the unit helped develop NSO technology, per OCCRP; founder Hulio did not serve in the unit, per Ynet"
|
|
fn: 1
|
|
---
|
|
|
|
NSO Group is an Israeli cyber-intelligence company founded in 2010 in [[Herzliya]], [[Israel]], by [[Omri Lavie|Omri Lavie]], [[Shalev Hulio|Shalev Hulio]], and [[Niv Carmi]] (the company name derives from their first initials: N-S-O). [[Unit 8200]] is Israel's elite military intelligence signals-and-cyber unit, described as the incubator of the Israeli private surveillance-technology sector. Veterans of the unit are known to have helped develop the company's technology, according to the Organized Crime and Corruption Reporting Project.[^1] Ynet reported in 2019 that Hulio did not serve in the unit and that Hulio said an early engineer may have.[^2] NSO developed [[Pegasus (spyware)|Pegasus]], a spyware capable of zero-click mobile-phone compromise that extracts messages, emails, photos, location data, and activates cameras and microphones without the target's knowledge. The [[Pegasus Project|Pegasus Project]] investigation (July 2021), coordinated by [[Forbidden Stories|Forbidden Stories]] and [[Amnesty International|Amnesty International]] across 80 journalists from 17 media outlets, documented a leaked list of over 50,000 phone numbers selected as potential surveillance targets by NSO's government clients.[^3][^4][^5]
|
|
|
|
### The Unit 8200 Pipeline
|
|
|
|
Unit 8200 is the IDF signals-intelligence and cyber-warfare unit that functions as the documented talent pipeline for the Israeli private cybersecurity and surveillance industry. Founders of a documented network of Israeli surveillance-technology firms are alumni of the unit; those firms, with NSO, constitute the "tip of the iceberg" of what the [[OCCRP|OCCRP]] and the [[Boston Review|Boston Review]] describe as a largely unregulated transnational Israeli surveillance industry. Former IDF intelligence officers and former NSO employees have gone on to found additional firms developing zero-click weapons and offensive cyber tools, extending the Unit 8200 pipeline into the broader commercial-surveillance sector.[^1][^6]
|
|
|
|
The Organized Crime and Corruption Reporting Project wrote that veterans of Unit 8200 "are known to have helped develop" the company's technology, and that its workforce had risen to more than 700. OCCRP quoted [[Gadi Aviran]], who founded the intelligence firm [[Terrogence]], telling *The New Yorker* in 2019: "There was this huge pipeline of talent coming out of the military every year."[^1]
|
|
|
|
In a January 2019 profile, [[Ronen Bergman]] wrote in Ynet that Hulio "didn't serve in the IDF's elite Unit 8200," that his last IDF posting was commander of a Home Front Command search and rescue team, and that he met Lavie at Hugim High School in Haifa. Hulio told Bergman that an early NSO engineer "may have served in Unit 8200" but that the technology did not come from there. A senior intelligence official told Bergman that NSO's capabilities had been "proliferated by former members of the intelligence community." The profile names Niv Carmi, who worked at the Prime Minister's Office as a student, as the technical expert brought in when the founders were recruited.[^2]
|
|
|
|
The Unit 8200 pipeline connects the NSO Group to the broader Israeli surveillance-technology export sector documented on the [[Carbyne|Carbyne]] page (the Epstein-Barak-Israeli surveillance-tech investment chain) and to the [[Palantir Technologies|Palantir]]-Israel strategic partnership. The sector operates on the model documented by the [[Jacobin|Jacobin]] reporting: Israeli surveillance technology developed through the occupation of Palestinian territories is exported commercially, with the occupied territories functioning as what critics describe as a testing laboratory.[^6][^7]
|
|
|
|
### Pegasus and the Government-Client Model
|
|
|
|
NSO licensed Pegasus exclusively to government clients, framing the product as a counterterrorism tool. The documented deployment went far beyond counterterrorism. The Pegasus Project investigation documented that NSO's clients used Pegasus against heads of state, government officials, journalists, activists, political opponents, and the family members of targeted individuals. The leaked list of 50,000+ phone numbers includes targets across multiple countries.[^3][^5]
|
|
|
|
The documented deployment patterns include: [[Mexico|Mexico]] (one of NSO's largest clients, where multiple administrations used Pegasus against journalists including [[Cecilio Pineda Brito|Cecilio Pineda Brito]], activists, lawyers, and even a child, per the [[Citizen Lab|Citizen Lab]] investigation); [[Catalonia|Catalonia]] (the "[[CatalanGate|CatalanGate]]" finding by Citizen Lab in 2022 documenting dozens of Catalan independence politicians and activists targeted by the Spanish state); [[El Salvador|El Salvador]] (surveillance continuing through 2022 despite NSO's reform pledges); and the [[Saudi Arabia|Saudi]] targeting of [[Jamal Khashoggi|Khashoggi]]'s associates.[^3][^8][^9][^10]
|
|
|
|
In January 2020 CNBC named [[Saud al-Qahtani]] among Saudi officials said to have bought Pegasus, writing that the spyware "has been widely reported as having been purchased by Saudi officials including Saud al-Qahtani, Prince Mohammed's former advisor who was implicated in the Khashoggi murder but ultimately not charged by the Saudi authorities."[^11] The sentence appears in CNBC's report on the UN statement about the analysis of [[Jeff Bezos]]'s iPhone by [[FTI Consulting]], and CNBC attributes the purchase claim to earlier press reporting.
|
|
|
|
### The Khashoggi Surveillance
|
|
|
|
Pegasus was deployed against the associates of Jamal Khashoggi before the October 2018 murder inside the Saudi consulate in [[Istanbul|Istanbul]]. [[The Guardian|The Guardian]] reported in July 2021, based on the Pegasus Project leak, that Pegasus was found on the phone of Khashoggi's wife [[Hanan Elatr|Hanan Elatr]] months before the killing. An Emirati government agency separately placed NSO spyware on the phone of a Khashoggi associate, [[Al Jazeera|Al Jazeera]] reported. Khashoggi's friend [[Omar Abdul Aziz|Omar Abdul Aziz]] sued NSO Group, claiming the spyware enabled the murder by mapping Khashoggi's network and communications. A federal judge dismissed the widow's lawsuit against NSO in October 2023.[^12]
|
|
|
|
Citizen Lab's report "The Kingdom Came to Canada," published October 1, 2018, assessed with high confidence that the phone of Omar Abdulaziz was infected with Pegasus.[^13] The authors attributed the infection to "a Pegasus operator linked to Saudi Arabia," an operator they named KINGDOM, which they tied to the 2018 targeting of the Saudi dissident Yahya Assiri and an Amnesty International researcher.[^13] The report states that the authors were unaware of any legal authorization for the infection and monitoring of Abdulaziz in Canada by a foreign government.[^13]
|
|
|
|
The Khashoggi surveillance ran through the same [[Mohammed bin Salman|MBS]]-[[WhatsApp|WhatsApp]] channel that [[Jared Kushner|Jared Kushner]] used to communicate with the Saudi crown prince, and through the broader Saudi-Emirati intelligence network that operated Pegasus against the targets. The NSO Group sits at the intersection of the documented surveillance infrastructure that enabled the Khashoggi assassination and the Kushner-MBS relationship that shaped the Trump administration's response to it.[^12]
|
|
|
|
### Ownership and the Novalpina Deal
|
|
|
|
NSO was acquired by [[Francisco Partners|Francisco Partners]], a technology-focused private equity firm, in 2014. Francisco Partners's ownership period covered the initial expansion of the Pegasus client base across multiple governments, including the documented deployments in Mexico, Saudi Arabia, and the [[United Arab Emirates|United Arab Emirates]]. The Francisco Partners ownership placed a standard private-equity firm in operational control of a cyber-arms company in its portfolio.[^3][^14]
|
|
|
|
In 2019, the co-founders Hulio and Lavie re-acquired NSO from Francisco Partners with funding from [[Novalpina Capital|Novalpina Capital]], a London-based private equity firm founded by [[Stephen Peel|Stephen Peel]]. The Novalpina acquisition valued NSO at approximately 1 billion dollars. The re-acquisition coincided with the period of intensifying scrutiny on NSO's government-client deployments, and the Novalpina ownership became itself a subject of controversy when Novalpina's limited partners raised concerns about the ethical implications of owning a cyber-arms company. Novalpina subsequently underwent its own internal crisis, and the ownership structure of NSO entered a period of documented instability.[^3][^14]
|
|
|
|
The Pegasus Project investigation (July 2021) and the subsequent regulatory and legal pressure (including [[Apple|Apple]]'s lawsuit against NSO, the U.S. Commerce Department's addition of NSO to the [[Entity List|Entity List]] in November 2021, and the WhatsApp v. NSO litigation) have constrained the company's operations. The ownership trajectory from startup to Francisco Partners portfolio company to Novalpina-controlled entity to a constrained and legally challenged operation documents the arc of a private intelligence firm that operated with limited accountability through multiple ownership regimes.[^3][^14]
|
|
|
|
### WhatsApp Litigation
|
|
|
|
WhatsApp sued NSO in October 2019 in the Northern District of California. A July 16, 2020 order described NSO as an Israeli limited liability company, described [[Q Cyber Technologies]] as an Israeli corporation and NSO's only active director and majority shareholder, and recorded the complaint's allegation that defendants sent malware through WhatsApp's system to about 1,400 mobile devices.[^15]
|
|
|
|
On December 20, 2024, Judge Phyllis Hamilton granted WhatsApp's motion for partial summary judgment on liability under the federal Computer Fraud and Abuse Act and California's Comprehensive Computer Data Access and Fraud Act, and denied NSO's motion for summary judgment. The order granted the sanctions motion in part, considered terminating sanctions, preferred evidentiary sanctions, and stated that a trial would proceed only on damages.[^16]
|
|
|
|
On May 6, 2025 a jury returned a unanimous verdict of $444,719 in compensatory damages and $167,254,000 in punitive damages (Dkt. 736), a total of $167,698,719.[^17] On October 17, 2025 Judge Hamilton granted a permanent injunction and remitted the punitive award to $4,002,471 (a nine-to-one ratio to compensatory damages); WhatsApp accepted the remittitur on October 31, 2025; on November 12, 2025 the court entered the permanent injunction, which excludes NSO's foreign sovereign customers, and a final judgment of $4,447,190.[^17][^18] On December 19, 2025 the court denied a stay of the injunction pending appeal.[^19]
|
|
|
|
### Footnotes
|
|
|
|
[^1]: "Where NSO Group Came From and Why It's Just the Tip of the Iceberg." *OCCRP.* https://www.occrp.org/en/project/the-pegasus-project/where-nso-group-came-from-and-why-its-just-the-tip-of-the-iceberg
|
|
[^2]: Ronen Bergman, "Weaving a cyber web," *Ynetnews*, January 11, 2019. https://www.ynetnews.com/articles/0,7340,L-5444998,00.html
|
|
[^3]: Co-founders Shalev Hulio and Omri Lavie were high-school friends who founded the company in 2010, according to OCCRP, "Where NSO Group Came From and Why It's Just the Tip of the Iceberg," The Pegasus Project. https://www.occrp.org/en/project/the-pegasus-project/where-nso-group-came-from-and-why-its-just-the-tip-of-the-iceberg
|
|
[^4]: "The Pegasus Project." *Amnesty International,* July 2021. https://www.amnesty.org/en/latest/news/2021/07/the-pegasus-project-2/
|
|
[^5]: "Pegasus: The New Global Weapon for Silencing Journalists." *Forbidden Stories.* https://forbiddenstories.org/pegasus-the-new-global-weapon-for-silencing-journalists/
|
|
[^6]: "Cyberespionage with Benefits." *Boston Review.* https://www.bostonreview.net/articles/cyberespionage-with-benefits/
|
|
[^7]: "Israel Has Turned the Occupied Territories Into a Laboratory for Surveillance." *Jacobin,* July 2023. https://jacobin.com/2023/07/israel-occupation-surveillance-security-state-technology-export
|
|
[^8]: "Reckless Exploit: Mexican Journalists, Lawyers, and a Child Targeted with NSO Spyware." *Citizen Lab.* https://citizenlab.ca/research/reckless-exploit-mexico-nso/
|
|
[^9]: For the Catalonia (CatalanGate) finding, see the Citizen Lab 2022 CatalanGate report.
|
|
[^10]: "NSO Group's Continued Surveillance." *Rest of World,* 2022 (El Salvador). https://restofworld.org/2022/nso-pegasus-el-salvador/
|
|
[^11]: CNBC, "Bezos phone hacking: UN calls for immediate investigation," January 22, 2020. Copy: https://web.archive.org/web/2020id_/https://www.cnbc.com/2020/01/22/bezos-phone-hacking-un-calls-for-immediate-investigation.html
|
|
[^12]: "NSO spyware used to target family of Jamal Khashoggi, leaked data shows." *The Guardian,* July 18, 2021. https://www.theguardian.com/world/2021/jul/18/nso-spyware-used-to-target-family-of-jamal-khashoggi-leaked-data-shows-saudis-pegasus
|
|
[^13]: Citizen Lab, "The Kingdom Came to Canada: How Saudi-Linked Digital Espionage Reached Canadian Soil," October 1, 2018, https://citizenlab.ca/2018/10/the-kingdom-came-to-canada-how-saudi-linked-digital-espionage-reached-canadian-soil/. Citizen Lab Report No. 115, by Bill Marczak, John Scott-Railton, Adam Senft, Bahr Abdul Razzak and Ron Deibert. The quoted phrase and the legal-authorization sentence are verbatim from the report text.
|
|
[^14]: For the Novalpina Capital ownership deal, see the published NSO Group and Novalpina Capital documentation.
|
|
[^15]: *WhatsApp Inc. v. NSO Group Technologies Limited*, No. 4:19-cv-07123-PJH (N.D. Cal.), Order on motions to dismiss (Dkt. 111, July 16, 2020), pp. 1-2. https://www.govinfo.gov/content/pkg/USCOURTS-cand-4_19-cv-07123/pdf/USCOURTS-cand-4_19-cv-07123-5.pdf
|
|
[^16]: *WhatsApp Inc. v. NSO Group Technologies Limited*, No. 4:19-cv-07123-PJH (N.D. Cal.), Order re motions for summary judgment and sanctions (Dkt. 494, December 20, 2024), at 16. https://www.govinfo.gov/content/pkg/USCOURTS-cand-4_19-cv-07123/pdf/USCOURTS-cand-4_19-cv-07123-24.pdf
|
|
[^17]: *WhatsApp LLC v. NSO Group Technologies Limited*, No. 4:19-cv-07123-PJH (N.D. Cal.), Final Judgment (Dkt. 810, November 12, 2025), p. 2. https://www.govinfo.gov/content/pkg/USCOURTS-cand-4_19-cv-07123/pdf/USCOURTS-cand-4_19-cv-07123-44.pdf
|
|
[^18]: Same case, Order re permanent injunction and remittitur (Dkt. 802, October 17, 2025), pp. 1-2 and conclusion. https://www.govinfo.gov/content/pkg/USCOURTS-cand-4_19-cv-07123/pdf/USCOURTS-cand-4_19-cv-07123-40.pdf ; Order granting permanent injunction (Dkt. 809, November 12, 2025), p. 2. https://www.govinfo.gov/content/pkg/USCOURTS-cand-4_19-cv-07123/pdf/USCOURTS-cand-4_19-cv-07123-43.pdf
|
|
[^19]: Same case, Order denying motion to stay permanent injunction (Dkt. 824, December 19, 2025). https://www.govinfo.gov/content/pkg/USCOURTS-cand-4_19-cv-07123/pdf/USCOURTS-cand-4_19-cv-07123-46.pdf
|