Contractors Can’t Protest Israeli Company’s Spyware Deals with Tyrants and Do Business with South Dakota

Last year, part-time Governor Kristi Noem ordered South Dakota state agencies not to do business with contractors who support boycotts, divestment or sanctions against Israel. Noem’s first executive order punishes contractors for “refusing to deal, terminating business activities, or other similar actions that are intended to penalize, inflict economic harm, or otherwise limit commercial relations specifically with the State of Israel, companies doing business in or with Israel or authorized by, licensed by, or organized under the laws of the State of Israel….”

So I guess if you want to do business with South Dakota, you can’t take any substantive stand against Israeli surveillance technology company NSO Group for selling Pegasus spyware that the Saudis and other governments have been abusing to snoop on journalists, human rights activists, and political opponents:

NSO Group’s spyware has been used to facilitate human rights violations around the world on a massive scale, according to a major investigation into the leak of 50,000 phone numbers of potential surveillance targets. These include heads of state, activists and journalists, including Jamal Khashoggi’s family.

…From the leaked data and their investigations, Forbidden Stories and its media partners identified potential NSO clients in 11 countries: Azerbaijan, Bahrain, Hungary, India, Kazakhstan, Mexico, Morocco, Rwanda, Saudi Arabia, Togo, and the United Arab Emirates (UAE).

NSO Group has not taken adequate action to stop the use of its tools for unlawful targeted surveillance of activists and journalists, despite the fact that it either knew, or arguably ought to have known, that this was taking place.

…The investigation has so far identified at least 180 journalists in 20 countries who were selected for potential targeting with NSO spyware between 2016 to June 2021, including in Azerbaijan, Hungary, India and Morocco, countries where crackdowns against independent media have intensified.

The revelations show the real-world harm caused by unlawful surveillance:

• In Mexico, journalist Cecilio Pineda’s phone was selected for targeting just weeks before his killing in 2017. The Pegasus Project identified at least 25 Mexican journalists were selected for targeting over a two-year period. NSO has denied that even if Pineda’s phone had been targeted, data collected from his phone contributed to his death.
• Pegasus has been used in Azerbaijan, a country where only a few independent media outlets remain. More than 40 Azerbaijani journalists were selected as potential targets according to the investigation. Amnesty International’s Security Lab found the phone of Sevinc Vaqifqizi, a freelance journalist for independent media outlet Meydan TV, was infected over a two-year period until May 2021.
• In India, at least 40 journalists from nearly every major media outlet in the country were selected as potential targets between 2017-2021. Forensic tests revealed the phones of Siddharth Varadarajan and MK Venu, co-founders of independent online outlet The Wire, were infected with Pegasus spyware as recently as June 2021.
• The investigation also identified journalists working for major international media including the Associated Press, CNN, The New York Times and Reuters as potential targets. One of the highest profile journalists was Roula Khalaf, the editor of the Financial Times.

“The number of journalists identified as targets vividly illustrates how Pegasus is used as a tool to intimidate critical media. It is about controlling public narrative, resisting scrutiny, and suppressing any dissenting voice,” said Agnès Callamard [Amnesty International, “Massive Data Leak Reveals Israeli NSO Group’s Spyware Used to Target Activists, Journalists, and Political Leaders Globally,” The Pegasus Project: Global Democracy Under Cyber Attack, 2021.07.18].

NSO Group’s American branch, Westbridge, has pitched its spyware (branded Phantom in the U.S.) to the Secret Service and local police forces.

NSO Group founder and boss Shalev Hulio says his spyware “saves lives and prevents terrorist attacks” and says NSO cuts off clients who abuse his tools:

Hulio claimed that over the past 11 years, the company sold its services to 45 countries, and rejected some 90 countries that offered to pay for the software it sells.

“I think that this says a lot, because there are companies around the world where the business model is built on going to places where NSO refuses to work,” he told the radio station.

Hulio also claimed that NSO Group had terminated the use of its software in five countries after it found out that they had abused the system. “If there is a country that you know is a country that violates human rights, doesn’t value human life, tracks journalists, even if not through our tools — these are countries that we do not want to work with, and that is why we stopped working with them,” he said [Emanuel Fabian, “NSO Head Claims Company Ended Services in Human Rights-Violating Countries,” The Times of Israel, 2021.07.20].

The claim that NSO Group doesn’t do business with human rights violators is malarkey. They have dealt with bad regimes with Israel’s explicit blessing, as Israel has exploited NSO’s powerful Pegasus tool for diplomatic advantage that overrides any concern about human rights:

In its 2018 “Hide and Seek” report, about the global reach of NSO Group, Citizen Lab reported that 36 clients around the world operated Pegasus. This included the United Arab Emirates – a country that was already known to be quite fond of spying on journalists and dissidents. Around 2008, UAE elites ran a secret service unit that employed former US intelligence agents to spy on dissidents and journalists. Called Project Raven, this unit only became known to the public years later.

At the time NSO Group was created, diplomatic relations between Israel and Gulf countries like the UAE were far from being normalized. Nonetheless, the company managed to ink contracts with these countries – thanks in part to Israeli diplomacy. “The export of these systems is used as a tool in diplomacy,” said a UK-based lawyer who is involved in litigation against NSO. “Netanyahu used Israeli tech to open access and opportunities for the state of Israel, like using them as some kind of ambassadors.”

After several months of negotiations, Saudi Arabia signed a contract worth $55 million, according to Israeli news outlets. It was most likely NSO Group’s largest contract. “Companies like NSO made the road before Israel signed the Abraham accords with the Gulf countries [a normalization pact finalized in 2020 between Israel, UAE and Bahrain],” said a lawyer representing the victims of NSO Group in Israel. “So you can imagine that they could be protected.”

Because of their invasiveness, and the high potential for misuse, spyware tools like Pegasus must obtain export licenses directly from the Israeli Ministry of Defense. According to the UK-based lawyer, a number of criteria must be followed in order to export cyber-surveillance technologies abroad. But because these criteria are not public it is hard to know whether export licenses are being properly vetted, they said [Audrey Travère, translated by Phineas Rueckert, “The Rise and Fall of NSO Group,” Forbidden Stories: The Pegasus Project, 2021.07.19].

But if you find the production and sale of such dangerous surveillance tools to human rights abusers dangerous and morally repugnant, you’d better not do or say anything about it. If you decline to buy products from Israel in protest of that government’s facilitation of spying on journalists and other opponents of authoritarianism, or if you fire up your mad DSU cyber skills to design software that would detect and block Pegasus and sink NSO Group’s commercial activities, the state of South Dakota will by executive order punish you by refusing to do business with you.