A shock wave has reverberated across Israel in recent months. The multi-billion dollar Israeli company NSO Group, which has been selling hacking tools to governments around the world for more than a decade, finds itself the focus of scrutiny after a series of public scandals. The crisis is so severe that even the company’s future is in question.
Regardless, the cyber products of the industry, which the NSO Group has so significantly shaped, are still very popular with governments. The hacking software business is booming: over the past ten years, the industry has developed from a novice to an important instrument of power for countries all over the world. Even the possible failure of a large company like the NSO Group is unlikely to slow growth.
As recently as December last year, Facebook reported that seven of these “hacking contract” firms from around the world had targeted around 50,000 people on the company’s platforms. In addition to companies from China, India and North Macedonia, the report named four other Israeli companies. The fact that the NSO Group was not even mentioned in the investigation shows that the industry and its target groups are far more extensive than the public normally perceives.
As a manufacturer, NSO Group has always avoided penalties
The allegations against the NSO Group are not new: The company has been confronted with criticism and allegations of abuse for years. 2016 were caught the United Arab Emirates how they targeted human rights activist Ahmed Mansoor with the help of the NSO program “Pegasus”. This exploits software errors to hack iPhones and hand over control to the customers of the NSO Group. In this case, however, the UAE government was found to be guilty and NSO got away with it. Mansoor himself is still in jail, because he criticized the regime.
This pattern was repeated over and over again for years. Governments have consistently been accused of using NSO hacking tools against dissidents, while the company denied any wrongdoing and escaped punishment. But then new reports of alleged abuse against Western governments surfaced in mid-2021. In November the US imposed sanctions against the company, and in December reported the Reuters news agencythat U.S. State Department officials were hacked using Pegasus.
Now, the NSO Group is not only facing expensive public lawsuits from Apple and Facebook, but is grappling with debt, low morale, and fundamental threats to its future. The figurehead for espionage programs is in an existential crisis.
None of this happens for the first time. The mysterious hacker industry first hit the international scene in 2014 Headlineswhen the Italian company Hacking Team was charged with its “undetectable” spy software regardless on human rights and privacy violations to sell to dozens of countries.
The fall of Hacking Team opened the world’s eyes to a global industry dealing in powerful software to break into computers everywhere. The resulting series of scandals seemed to finally break the company’s neck. It lost its business and the ability to legally sell its tools internationally. Hacking Team was sold and believed dead by the public.
In the end, however, the company just renamed itself and started doing that Selling the same products. Only now it was a smaller fish in a much larger pond. “The demise of Hacking Team did not result in any fundamental change in the industry,” said James Shires, assistant professor at the Institute of Security and Global Affairs at Leiden University. “There is still the same dynamism and demand.”
Demand for offensive cyber skills is increasing
The industry’s first customers were a small group of countries that wanted to spread their power around the world via the Internet. Today the situation is much more complex. Many more countries are paying today for the ability to hack opponents both internationally and within their own borders. There are billions of dollars at stake, but there is little transparency and even less accountability.
In parallel with the increase in public scrutiny of companies that offer hacker software, the global demand for these same offensive cyber capabilities has also increased. In the 21st century, government’s most valuable goals are online more than ever, and hacking is usually the most effective way to get them. The result is a growing number of countries willing to spend large sums on developing sophisticated hacking operations.
Cyber investments are a relatively cheap and effective way for governments to compete with rival nations and develop powerful tools to control their own country. “In the last five years in particular, more countries have developed cyber capabilities,” said Saher Naumaan, a senior threat intelligence analyst at BAE Systems.
In addition, more and more of these countries are looking for help abroad. “If you don’t have the opportunity to use the skills or talents of the people in your own country, but you have the means to have it done externally, why not go for a commercial solution,” says Naumaan. “It’s an option in a lot of other industries, and cyberspace isn’t that much different. You pay for something you can’t do yourself.”
In the past, for example, the oil-rich countries in the Persian Gulf lacked the considerable technical skills required to develop their own hacking power. So they spend money on a shortcut. “They don’t want to be left behind,” said Naumaan.
Military corporations from all over the world are now developing and selling such resources. The tools have already been used for outrageous abuse of power. But they are also increasingly used in legitimate criminal investigations and in the fight against terrorism and are the key to espionage and military operations.