The US Commerce Department’s Bureau of Industry and Security (BIS) has announced that it has added Israeli company NSO Group, which developed the Pegasus spyware, to its Entity List, thus slapping it, along with three other companies, with sanctions. The BIS explained that the NSO Group was included due to engaging in activities that threatened the "national security or foreign policy interests" of the US.
The NSO Group was specifically targeted for developing and supplying spyware to foreign states, with BIS most likely referring to Pegasus – a program capable of infiltrating smartphones and downloading the personal data of users without their knowledge or consent. The Israeli firm sold its spyware to multiple repressive foreign governments but claimed that it was only used for national security issues such as catching terrorists and criminals.
An investigation by the non-profits Forbidden Stories and Amnesty International released in July 2021 showed that the surveillance app is often used to spy on political opponents, activists, journalists and even prominent opposition politicians. Similar reports have emerged in media since 2016, but only the July 2021 report prompted a global scandal that drew attention to Israel's NSO Group and its notorious product.
"These tools have also enabled foreign governments to conduct transnational repression, which is the practice of authoritarian governments targeting dissidents, journalists and activists outside of their sovereign borders to silence dissent. Such practices threaten the rules-based international order", the BIS said, explaining adding the NSO Group, as well as another Israeli company, to the Entity List.
Apart from NSO Group, the US slapped sanctions on another secretive Israeli company, Candiru, which developed a program with functionality similar to Pegasus and also sold it to foreign governments, including Uzbekistan, Saudi Arabia, Qatar, Singapore and the UAE.
While the NSO Group repeatedly insisted that it monitored the use of its tool and never allowed it to be used for political purposes, numerous opposition activists and journalists globally have reported that their telephones were on the list of some 50,000 numbers targeted by Pegasus and leaked by Forbidden Stories and Amnesty International in July. The publication of the investigation into the use of Pegasus prompted criticism from not only human rights activists, but also from several governments.
In addition to NSO Group and Candiru, the BIS added Russian firm Positive Technologies and Singapore-based Computer Security Initiative Consultancy PTE. LTD to the Entity List over the distribution of cyber tools used in breaching computer systems.