‘We violated people’s privacy for a living’: How Israel’s cyber army went corporate
The blurred line between the military and private sector in Israel has allowed dangerous cyber weapons like NSO's spyware to flourish worldwide.
At a security conference and exposition called “iHLS Innotech” held in Tel Aviv last week, five Israeli cyber experts spoke at a roundtable titled “Ethics of the Sale of Cyber and Intelligence Tools at the Offensive Realm.” The panelists, all men hailing from lengthy careers in the military and private sector, joked that the conversation would be so difficult that it warranted a bottle of scotch whiskey at 10:45 a.m.
As the scotch made a number of rounds on the stage, some of the panelists spoke about promoting stricter initiatives to regulate the sale of cyber weapons and technologies, such as barring veterans of army intelligence units who have used these technologies from working for offensive cyberespionage firms. But the consensus among the panelists was that companies would most likely continue selling their services with the blessing of Israeli export law.
“I want to say that, that as a private individual, I want my government to spy on people, even on me,” said Guy Mizrahi, the panel’s chair and an ex-Vice President of Rayzone Group, an intelligence firm which came under fire in late 2020 for facilitating mass surveillance abroad. “I think other countries should have those capabilities also, and not all of them can develop them on their own.”
The panel was careful with wading into the debate that has dominated the news cycle in recent weeks. This month, human rights investigators foundthat the devices of six Palestinian human rights advocates and three senior Palestinian Authority officials had been infected with the “Pegasus” spyware, produced by the Israel-based NSO Group. The revelations came less than a week after the United States officially blacklisted NSO Group as an entity that contravened U.S. national security and foreign policy interests, thereby banning the firm from trading with American companies. Both NSO group and the Israeli government have declined to publicly discuss the matter, citing national security concerns.
Firms like NSO Group have become notorious in recent years for exporting their cybertechnology to autocratic regimes around the world, and for their products being used on thousands of people ranging from presidents to journalists. But as the attendees of the Innotech conference showed, these are not simply private companies conducting business abroad: they are deeply connected to the Israeli military establishment, and their products are central to Israel’s own surveillance arsenal.
Public information about NSO Group, as well as testimonies of former Israeli intelligence officers and NSO employees who spoke to this author on condition of anonymity due to fears of repercussions, shed light on the extent to which Israel’s largely unregulated surveillance regime is intimately bound up with the private sector, with Palestinians in the occupied territories bearing the brunt of its practices.
‘Anything you imagine it can access, it can’
Named for the divine horse of Greek mythology that symbolizes speed, beauty, and artistic inspiration, “Pegasus” has today become synonymouswith illicit espionage, human rights abuses, and the autocratic regimes that deploy it. The company that designed the spyware, NSO Group, was founded in 2010 by Shalev Hulio, an entrepreneur who came into the cybersecurity industry long after his military service, and who served as the company’s CEO until stepping down earlier this month, becoming the firm’s “Global President” and vice chair of its board.
In 2012, Hulio prototyped Pegasus, a software that could take full control of any smartphone from a distance. Initially marketed as a customer support tool to allow technicians at cell phone carriers to fix devices from afar by “taking over” the phone, Pegasus became a source of great interest among governments and militaries: not only does the technology grant access to text messages and phone calls, but it also has the power to activate cameras, recording devices, emails, and social media accounts of any device, anywhere. Hulio was quickly propositioned by intelligence officials in Israel and from the European Union to develop the software further.
Over the next decade, Hulio built up NSO Group as a boutique cyberespionage firm and honed its product by heavily recruiting from elite Israeli intelligence units such as 8200, which is responsible for surveillance across the occupied territories. Many developers who worked at NSO spent their army service deploying and refining similar cyberespionage weapons for the state. With their expertise, NSO produced spyware so potent that it could be deployed on phones without their owners so much as clicking a link or opening a message. As one ex-employee of the company told me under the condition of anonymity, “anything you imagine it can access and capture, it can.”
NSO quickly ascended the ranks of the private surveillance industry, marketing itself as a weapons manufacturer. In brochures from the early 2010s, NSO described itself a “leader in cyberwarfare” backed by homegrown “Israeli technology.” Along with its unparalleled product, NSO gained a competitive edge by promising its clients — governments, law enforcement agencies, and police forces worldwide — hands-on training with young veterans from Israel, widely regarded as home to the world’s most advanced intelligence establishments.
In its early days, NSO Group recruited field trainers and product managers from Unit 8200’s exclusive alumni networks. In an 8200 alumni page from 2014 that this reporter reviewed, NSO placed a job posting that promised prospective employees “60% time abroad” at especially “exotic locations.” Those who went on to work for the firm reportedly raked in high salariesupwards of $30,000 a month and traveled across the world as part of their work, meeting with heads of state, military generals, and diplomats.
In many ways, these veterans effectively served as ambassadors of Israel’s new spyware diplomacy. They trained officials in democracies and autocracies alike to use advanced cyberweapons on their own civilians, without the inconvenience of oversight or accountability. The Israeli government further used these sales to pave the way for diplomatic relations with Arab and Muslim governments such as the United Arab Emirates, Morocco, Azerbaijan, and Saudi Arabia — some of which would sign the “Abraham Accords” with Israel in 2020.
With time, a number of other boutique cyberespionage firms — including Candiru, Black Cube, and Dark Matter — arrived on the scene, headhunting veterans of Israeli and American intelligence forces to develop equally powerful weapons. Collaborations between the Israeli private sector and military allowed many of these firms to quickly ascend a largely unregulated global market. A self-branded leader of offensive cyber technologies, by 2016 Israel boasted the largest number of surveillance firms per capita in the world, with NSO as its star player.
A soldier one day, a contractor the next
Law enforcement agencies and militaries have been eavesdropping on their citizens’ telecommunications for over a century. But the rise of cellular networks and end-to-end encrypted messaging in the early 2000s began making the interception of cellular communication nearly impossible. Governments and militaries thus strove to develop offensive cybersecurity weapons that could breach even the most secure platforms. The Israeli army, like others around the world, worked closely with the burgeoning private cybersecurity sector in a surveillance arms race.
In conversations with this author, veterans of Israeli intelligence units confirmed that institutionalized collaboration between private surveillance companies and Israeli intelligence units is simply business as usual. “No one was surprised by the news,” said G, a former commander in an Israeli intelligence unit, when asked about the cyberespionage on Palestinian phones in the occupied territories. Outsourcing employees, prototyping software, and sharing databases are common practices between the private industry and the military, the former officers alleged.
Israeli intelligence veterans say the connections between the military and private surveillance firms go much further than hiring practices. “These aren’t free market initiatives,” G said. “The military relies on private companies to develop many of its weapons, including malware, because it takes a huge amount of resources.”
For this reason, G explained, many private surveillance companies supply the Israeli army with their products before they begin exporting them abroad: “The fact that these companies are staffed by recent veterans means there’s a network already in place.” G recounted how, as a soldier, his unit would get days off at the base to tour artificial intelligence start-ups in Tel Aviv. CEOs touted what were then cutting-edge surveillance systems, which they then sold to the Israeli military. The executives emphasized that the soldiers’ expertise made them promising future employees of the firms, G said.
B, another veteran of an intelligence unit, explained that the military has long used private firms to accumulate profit. “The military actually helps develop much of this technology and then works with certain organizations to cash in on exports,” B said. Israel’s Defense Ministry, after all, is required to be deeply involved in the development and exports of all military products including by private firms; the income from the exports climbed to $8.3 billion last year, the second highest ever behind 2017 ($9.2 billion).
“There’s stuff the military can provide, like data, that the private sector can’t get without working closely with them on prototypes,” B added. B also described how intelligence units will often host “hackathons” to facilitate these projects, inviting army veterans and employees of private companies to participate in competitions like “improving the Iron Dome” after the latest war on the Gaza Strip in May.
Beyond incentives like these, formal subcontracting has further blurred the line between private surveillance firms and the military. B, like many of his peers, received an offer to stay on in his army unit but as an employee of a private firm after being officially discharged. “You could be a soldier one day, and then the next day come in and stay in the army in the same exact place, but now be a private contractor,” B said. “The only thing that changes is your salary.”
Human rights organizations, whose investigative work was key to landing the NSO Group on the U.S. blacklist this month, have long argued these corporate-military connections are what make the private surveillance industry so dangerous. John Scott-Railton, a senior researcher at the University of Toronto’s Citizen Lab, a digital rights research center that has been investigating commercial surveillance firms for years, described cyberespionage weapons like Pegasus as “anti-accountability” by design. Such software, he explained, “comes from contexts where there is zero accountability for state surveillance powers… And if there’s one thing we know about secret surveillance powers, it is that they will always be abused.”
The former officers interviewed for this piece agreed. “We spent our time essentially carrying out surveillance of a civilian population who had no access to legal counsel and were denied civil rights,” G said of his experience in army intelligence. “We were trained to violate people’s privacy for a living, and then were offered even more money to do it abroad.”
Rebranding a weapon
For the past decade, Israeli export law has classified Pegasus spyware as a weapon subject to the same restrictions as drones, assault rifles, and missiles. Today, however, few who work for NSO want to frame their products as such. Accusations of Israel’s military exploiting surveillance capacities over Palestinians in the occupied territories — including by building secret biometric databases and misusing personal data — have piled up for years, stirring public crises for cyber companies that are beginning to face greater scrutiny by the media and governments.
NSO has instead tried to rebrand its products as “solutions for global security and stability” rather than as weapons. In the past year, the firm has launched a new human rights policy, governance, and oversight board, as well as a social media campaign framing the cyberespionage group as a “proud family.” Yet even those crafting NSO’s new human rights-oriented initiatives have difficulty specifying how their products bring about “security and stability.”
During a Zoom interview in early October, a legal officer at NSO conceded that the “correct use” of mass surveillance weapons “is going to cause certain damage.” “There are some things that are going to be considered acceptable and other things that are not,” he said. “But that’s true with any product, even a hammer. You can use a hammer to build a waterboard, but you wouldn’t be able to predict that’s going to happen when it’s sold.”
Scott-Railton of Citizen Lab disagreed. “If you sell a government a hammer and train them how to build a waterboard with it, you should probably be held responsible,” he said, describing cyberespionage weapons as a kind of “asbestos” rather than a household tool: something cancerous that, when deployed, is often lethal.
The blurred line between private surveillance firms and the Israeli military, however, makes accountability in this industry appear out of reach. Last week, the Israeli government was quick to lobby the United States to remove NSO from its blacklist. According to Haaretz, Shalev Hulio urgedthe Israeli government to stand up for his company in a secret letter, citing longstanding collaborations between the firm and the military.
But even as NSO Group continues to be dragged and exposed in the international media, and as other countries move to blacklist the firm as well, Israel’s military and cyberespionage industry are having very different conversations. At the Innotech conference last week, leaders from both the government and private sector appeared more intent on protecting an industry that is a lucrative source of GDP.
For now, Israel’s surveillance regime over the occupied Palestinian territories will remain a source of profit for Israeli cyberespionage companies, supplying data, an expert workforce, and testing opportunities. These companies will, in turn, continue to supply the Israeli army with cyber weapons used against a civilian population denied recourse to basic legal protections.
The danger, however, is not only that Palestinians living under military rule will be subjected to ever more invasive forms of monitoring. The private industry’s collaboration with the Israeli military is driving a surveillance arms race that threatens to erode civilians’ right to privacy around the world. So long as Israel’s private sector and military remain intimately bound up with one another, it will take more than a blacklist to rein in companies like NSO.
Geen opmerkingen:
Een reactie posten