The scandal-plagued NSO Group cybersecurity company behind the controversial Pegasus surveillance software will likely be dissolved in the near future and then restructured under a different name, experts in the field claim.
A deluge of negative headlines has come out over Pegasus, a powerful spyware weapon that can remotely activate a cellphone’s microphone or camera as well as collect all of its data. A growing number of allegations against the software say that it has been misused in Israel and around the world, most notably to hack the phones of politicians, journalists, human rights activists and private citizens.
An international investigative report released last summer known as the Pegasus Project found that roughly 50,000 people across the globe had been targeted by the spyware.
In response, the United States recently decided to blacklist NSO Group, and European Parliament members have called for an inquiry into abuse of the spyware. The company also faces a number of lawsuits.
Amid all the bad press, one cybersecurity veteran believes that the embattled cyber-tech firm is taking its last gasp.
“From a tactical point of view, I think we’re seeing the last breaths of NSO,” said Guy Barnhart-Magen, chief technology officer and co-founder of the cybersecurity company Profero, “They will be dissolved and restructured into a new company with less media attention. When so much money is involved, nothing disappears overnight.”
Barnhart-Magen has more than two decades of experience in the cybersecurity industry. Founded in early 2020, Profero specializes in incident response (IR), meaning it helps companies prepare for cyberattacks, contain them and manage their aftermath if a breach occurs.
Due to its negative public image, NSO Group has resorted to paying double or even triple market average rates for certain positions when hiring, according to Barnhart-Magen.
“It’s very difficult for them to obtain the right technical people that would care more about money than morals,” he said. “They’re paying a very large premium to get these kinds of people.”
The dismantling of NSO Group could happen fairly quickly. The company reportedly is in talks to be sold for some $300 million to a company run by ex-U.S. soldiers, according to the Haaretz newspaper.
The potential sale to Integrity Partners could see the company’s business connections restored as its headquarters are moved to the U.S., which would mean that its technology would be regulated by American laws. Integrity Partners, which bills itself as a mobility and infrastructure investment firm, would then lobby to have the company removed from the U.S. blacklist.
The Pegasus surveillance system does not require a user to click on anything in order to activate. Instead, it exploits vulnerabilities found in the apps or operating system of a given device. Once the spyware has secretly installed itself on a smartphone, it can access virtually any data found there and then pass that on to the attacker. This means that photos, videos, messages, recordings, GPS records, passwords and call logs are all fair game.
There does not appear to be a cybersecurity tool that can defend against this powerful weapon.
“To be perfectly honest, not really,” Barnhart-Magen said. “[Despite] my own dislike of Pegasus, NSO and the way that they deal with things, they have one of the best technical teams in the world.”
Phone companies may in time develop ways to defend against Pegasus, but there is no long-term solution, he says. Even if NSO Group is dissolved and restructured, Barnhart-Magen argued that governments and law enforcement agencies would continue to rely on Pegasus.
“It’s just too lucrative a tool,” he said. “I don’t think there is any escape.”
While NSO has garnered significant media attention for its surveillance software, there are many other firms that have developed technologies with similar capabilities. In fact, the cybersecurity warfare market reached some $40 billion in 2020, and is expected to be valued at nearly $104 billion by 2025, according to the Mordor Intelligence market research firm.
Those who have high-risk profiles that are likely to be targeted, such as journalists or human rights workers, should try to mitigate the risks by keeping their phones’ software up-to-date as much as possible, and regularly downloading and installing updates.
“If you’re a reporter, for example, use older model burner phones which you are not using for your day-to-day,” Barnhart-Magen said.
In Israel, the police allegedly used Pegasus to gain access to Israeli citizens’ phones without a court order, the business daily Calcalist reported. Israel Police officials denied using the spyware against innocent civilians, but also noted that any use was carried out with legal oversight.
Amir Cahane, a researcher at the Israel Democracy Institute and lawyer by training, has been researching state surveillance laws for years. Cahane believes that Israel’s existing wiretap law, which dates back to 1979, is in dire need of an update.
“Lots of things have happened in the last 43 years since the Israeli Wiretap Act was legislated and it needs to be brought into the 21st century,” said Cahane. “If the NSO tool is used merely as a substitute for traditional wiretapping – that is, listening in on conversations and intercepting data while this data is transmitted – then perhaps you can shoehorn in this use within the existing legal framework.”
“However, if [it] was used by the police to extract information already stored inside devices, then this is not within the purview of Israeli law as it is construed and interpreted by the Department of Justice itself,” he added.
A stronger legal framework needs to be implemented in order to regulate online surveillance overall, Cahane stressed. In addition, he advocated for an independent oversight body that would be responsible for authorizing warrants for surveillance on people’s phones, as well as overseeing if such measures were carried out properly in accordance with the law.
“The ability to access this treasure-trove of information should be restricted and it should be regulated in such a manner that an intrusion on one’s privacy will be proportionate to the purpose that this intrusion is serving,” Cahane noted. “The great concern is how to regulate this kind of power: the ability of the state to reach into the most private information someone keeps and use it against him.”
The story is written by Maya Margit and reprinted with permission from The Media Line