When Apple rushed an urgent security update out to its iPhone and iPad users on Thursday, it was accompanied by an uncomfortable story.
The security breach it was fixing up had been used to target Ahmed Mansoor, a prominent dissident in the United Arab Emirates, and had been created by an Israeli company, the NSO Group.
A report by the Citizen Lab at the University of Toronto concluded that links sent to Mansoor via text message belonged to “an exploit infrastructure connected to NSO Group, an Israel-based ‘cyber war’ company that sells Pegasus, a government-exclusive ‘lawful intercept’ spyware product.”
Had Mansoor clicked the links, his phone would have essentially become a spying device to monitor his activities and emails, messages, and even activate the microphone and camera.
The report, which grabbed headlines around the world, said the facts “seemed to conclude” that the UAE government had used Israeli technology in its attempts to quash dissent. It followed other reports that NSO technology may have been used by Mexico and Panama as well.
The incident raised uncomfortable questions about the darker side of Israel’s reputation as a Start-Up Nation, a term typically used to trumpet the innovative Israeli technology ecosystem that has developed widely used computer chips, traffic-fighting apps, and programs to keep people’s online information safe.
That dark side, the selling of cyber warfare technology to foreign governments, parallels an older discussion on foreign arms sales.
Israel was among the few countries that continued selling weapons to the apartheid government in South Africa, as global opinion turned against it in the late 1980s, and recently declassified files in the UK showed that Israel sold arms to the junta in Argentina during the Falklands War in 1982.
But the lines between lethal and nonlethal sales – or traditional and cyber weapons – can be blurry. A recent UN report showed that Israel continued selling wire-tapping equipment to South Sudan, even after it nixed arms sales during the civil war there in 2014.
“When you sell cyber arms to a government, it’s not clear how they’re going to use it, or against whom. And the same goes for actual weapons,” said Dr. Gabi Siboni, who heads the Program on Cyber Security at the Institute for National Security Studies in Tel Aviv.
Because cyber tool sales are regulated like weapon deals, the government has to approve any such transactions, meaning there is a strategic component to where and why Israel might sell to one party, but not another.
“We do it for several reasons,” said Prof. Efraim Inbar, director of the Begin-Sadat Center for Strategic Studies in Ramat Gan. “We do it for money, we do it to buy some political influence, and usually we are less selective in choosing customers.”
Changes in Israel’s political and economic standing and new pressures from the United States have in recent years altered the calculus on who can buy Israeli arms, he said. The politics of such transactions have become so important, he added, that the Foreign Ministry now “almost has veto power” over the process.
“It’s a growing consideration now. We’re trying not to send equipment that’s used to oppress people, but there are always gray areas. We try to be sensitive, and this is why the Ministry of Foreign Affairs now has a role in these kinds of transactions,” Inbar said.
Zamir Dahbash, a spokesman for NSO, confirmed that the Herzliya-based company “sells only to authorized governmental agencies, and fully complies with strict export control laws and regulations.”
Once the tool is sold, Dahbash added, NSO does not operate it, and cannot oversee how governments use it.
Dahbash also said that the company signed agreements with its customers requiring that its products be used “in a lawful manner. Specifically, the products may only be used for the prevention and investigation of crimes.”
Siboni found this explanation plausible.
“I think this tool was just used for intelligence gathering, and cyber is one of the main platforms for intelligence gathering,” he said.
But in a 2013 Globes interview, the company’s founders acknowledged that the technology could be used for darker purposes.
“It’s like if you ask Smith & Wesson if it’s a problem that they manufacture guns,” cofounder Omri Lavi, who has declined interviews since the UAE story broke, told Globes.
“The manufacturer doesn’t have a problem, only the ones who bought and used it do.”
Most of the countries that NSO sold to, he added, were longtime friends of Israel and used the technology to fend off serious crime and terrorism.
Most of them.
