Spyware company NSO Group tries to makes its case in Washington

Embattled Israeli spyware company NSO Group is trying to make a crime-fighting case in Washington, but it faces a near-impossible challenge to get skeptical U.S. lawmakers and human rights activists on board.

Driving the news: NSO chief executive Yaron Shohat spoke with Axios this week during a trip to Washington to push the narrative that the company's spyware tools are a boon in the fight against terrorism and crime.

• But during the three-day trip, NSO representatives said they didn't plan to meet with any Biden administration officials. At least one skeptical Democratic congressional office told Axios they didn't get any outreach from the company.

Zoom out: NSO's Pegasus phone-hacking spyware gained widespread attention in 2021 following an investigation from a consortium of news organizations detailing the ways governments have used the tool to spy on journalists, human rights activists and high-ranking politicians.

• Unlike typical forms of malware, Pegasus is "zero-click," meaning it can sneak onto a target's device without them even having to click on a malicious phishing link.
• Since 2021, the company has been placed on a U.S. trade blacklist, inspired a UN call for a global moratorium on spyware sales, and was nearly the subject of a Supreme Court case.

The big picture: NSO's Washington tour comes as the administration pieces together a forthcoming spyware executive order, and shortly after lawmakers gave the intelligence community new powers to protect against certain commercial spyware.

• But Shohat told Axios that he believes NSO can still win over skeptics with a simple argument: "Our product saves lives around the world," he said.

Catch up quick: Shohat started as CEO in August as part of a larger company restructuring following years of scrutiny of the Israeli spyware firm's product use.

• When Shohat started, NSO had just laid off 100 employees and was eagerly seeking a buyer to pull it out of financial ruin.

Details: Shohat told Axios that NSO is now cash-flow positive due to its mostly Western European government customers that use the tool to track down terrorists, child sex abusers and other criminals.

• NSO has now terminated 10 customer contracts for abusing the tool following internal investigations, he said, and the company will continue to investigate any other reports claiming its customers are spying on journalists and dissidents.
• NSO, which claims to sell only to government customers, says it has tweaked its products and internal auditing programs to better flag abusive use, although the company declined to say how it has done so to protect the product from hackers and criminals.

Between the lines: NSO argues that its tools are preferable to alternatives that are far more dangerous, like mercenary hacking firms and spyware coming out of Russia and China.

• "The government that buys it, they are the ones operating it, they’re the ones deciding who to target, they are the one who is getting the intelligence gathered from the devices," Shohat told Axios.
• "We are not a part of it; we are not exposed to it. That’s part of the misconception that exists," he added.

The other side: Without specifics about how exactly NSO is preventing abuse or providing retribution to victims, the new CEO's arguments aren't budging human rights activists and researchers.

• "The cat is out of the bag: The world now knows that a major use of Pegasus is to monitor journalists and human rights groups," John Scott-Railton, a senior researcher at the University of Toronto's Citizen Lab who closely monitors NSO's work, told Axios. "It’s a tool of espionage that has nothing to do with crime or terror."
• Brett Solomon, the head of Access Now, agreed that governments have started to recognize the threats posed by spyware and begun to take action. "Spyware has not been solved, but I do think we have been able to collectively put this issue much more on the global agenda," he told Axios at the World Economic Forum in Davos, Switzerland, last week.
• "If we look at the direct record of the company, that’s just patently untrue," said Roman Gressier, an American journalist working for Salvadorian outlet El Faro who was targeted with Pegasus, about NSO's claims that it focuses solely on crime and terrorism. "How can anyone take them at their word?"

Yes, but: The U.S. isn't completely averse to using commercial spyware. The New York Times reported last month that the Drug Enforcement Administration is using spyware from a different Israeli company.

What they're saying: "This kind of technology is a must to provide public safety and protect it," Shohat said.

Sign up for Axios’ cybersecurity newsletter Codebook here.