NSO GROUP

OLYMPUS opened an institutional file, and filed it in the wing that operates the systems the rest of the drawer only watches. A firm has no Big Five and no Dark Triad, and the unit does not invent them; what a firm has is a product, a customer list, an export license, and a docket. NSO Group is catalogued here as the locksmith — the company that sells the master key and insists it only ever hands it to the government. The finding is the position: a private Israeli firm whose zero-click product silently opens any phone, whose customers are states, and whose license to sell is granted by a defense ministry. Not a hand on any single target. A key, and the question of who is standing at the door once it opens. The “breach reach” of a spyware vendor is real, but the numbers in the front matter are reach, offensive capability, and durability under fire — not malice. Unlike most files in this drawer, part of this record is ADJUDICATED: a US federal court found the hacking as fact.

Institutional Archetype

THE LOCKSMITH — The archetype is the maker of the master key who sells only to the authorities and disclaims what the authorities do with it. NSO does not run its own operations against its own targets; it licenses Pegasus to government clients, who select the numbers. The structural power is that the instrument is the same regardless of the hand: the zero-click exploit that reaches a cartel lieutenant’s phone reaches a journalist’s phone by the identical mechanism, and the vendor’s business model requires it to work on any phone before it can be sold as working on the phone the customer names. That is the hazard — not authorship of any single infection, but authorship of the capability inside which every infection is possible. The instrument is the exploit chain. The leverage is that a democracy and an autocracy buy the same key from the same shop.

Mandate & Origin

NSO Group Technologies was founded in 2010 in Herzliya, Israel, by Niv Carmi, Shalev Hulio, and Omri Lavie — the company name is an acronym of the three founders’ first names. Carmi is a former Mossad operative; Hulio and Lavie were childhood friends whose earlier venture, Communitake, built remote-smartphone-management technology that (by the founders’ account) drew intelligence-agency interest in a bypass for encrypted messaging. Its flagship product, Pegasus, is zero-click spyware that silently compromises a target phone and delivers the operator everything on it — messages, calls, email, microphone, camera. Under a 2007 Israeli law, cyber-intrusion products require an export license from the Defense Ministry’s Defense Export Controls Agency (DECA); NSO’s stated mandate, repeated in its public statements, is that it sells “only to legitimate law enforcement agencies” for counterterrorism and serious crime, under those licenses and with safeguards against misuse.

In its own words. NSO describes itself in its court filing of 27 September 2024 as “an Israeli company that produces (and, with the permission of the Israeli Ministry of Defense, licenses) lawful-intercept technologies for government agencies to investigate crime and combat terrorism,” says “These tools were developed in large part as a countermeasure to “end to end” encryption (E2EE) technology,” and adds that “NSO’s marketing and licensing activities are vetted by its Business Ethics Committee (now its Governance, Risk and Compliance Committee) and approved by the Government of Israel’s Ministry of Defense” (NSO, Statement in Response to Apple’s Motion for Voluntary Dismissal, N.D. Cal. 3:21-cv-09078, Dkt. 100). Its first Transparency and Responsibility Report, dated 30 June 2021, states: “NSO licenses Pegasus to sovereign states and state agencies, does not operate Pegasus, has no visibility into its usage, and does not collect information about customers,” and on the licence: “DECA has, in fact, in quite a few cases, denied our applications for export licenses.” It lists “over 55 countries to which it has not and will not sell cyber intelligence products,” reports “12 product misuse investigations and preliminary reviews” in 2020 and that “approximately 15% of potential new opportunities for Pegasus were rejected for human rights concerns that could not be resolved,” and concedes: “Effective monitoring of customer activity is a significant challenge, since we do not have immediate insight into the use of our products” (NSO, Transparency and Responsibility Report 2021, PDF copy hosted by OCCRP). The Israeli government’s own account of the export regime, as Defence Connect reproduces a December 2021 release: the updated end-user declaration “implements the policy of the Ministry of Defense to control the end use of cyber systems,” obliges the acquiring state to restrict use to “the investigation and prevention of crime and terrorism,” and names the sanctions for non-compliance, “restricting the use of the cyber system or shutting down the system” (Defence Connect, 23 December 2021).

Funding & Backers

NSO’s ownership is itself a map of the private-surveillance market. Francisco Partners, a US private-equity firm, acquired majority control in 2014 for a reported $120 million; founders Hulio and Lavie bought the company back in 2019 via the London-based Novalpina Capital fund. In October 2025, NSO confirmed that a group of US investors acquired a controlling stake, a group Calcalist reported to be led by Hollywood producer Robert Simonds — the transaction that, on its face, moves ownership of the Pegasus maker to American hands even as the firm remains on the US government’s own trade-restriction list and states its operations stay under Israeli Ministry of Defense supervision. Who owns the locksmith is part of what the key is: a firm sanctioned by the US Commerce Department in 2021 passed into majority US ownership four years later, with the export controls and the litigation still live.

NSO’s spokesperson, Oded Hershowitz, gave the confirmation in his own words: “an American investment group has invested tens of millions of dollars in the company and has acquired controlling ownership,” and “It continues to be fully supervised and regulated by the relevant Israeli authorities, including the Ministry of Defense and the Israeli regulatory framework”; he declined to specify the amount or who the investors are (TechCrunch, 10 October 2025). By TechCrunch’s January 2026 account the change of control came with a change of seats: “former Trump official David Friedman was appointed the new executive chairman; CEO Yaron Shohat stepped down; and Omri Lavie, the last remaining founder who was still involved in the company, also left,” and the 2025 transparency report carries Friedman’s line: “When NSO’s products are in the right hands within the right countries, the world is a far safer place” (TechCrunch, 8 January 2026).

Institutional Voice & Intent

The voice is the lawful-intercept register — the responsible-vendor’s, not the operator’s. NSO speaks in the grammar of “legitimate law enforcement,” “warrants,” “terrorists and criminals,” and “safeguards”: a compliance vocabulary that frames the firm as a regulated defense exporter serving sovereign clients, with abuse the client’s fault and the client’s alone. The persuasion is in the licensing — a product cleared by a defense ministry reads as governed, even when the governance is a permit to sell.

Stated intent: Provide governments and their law-enforcement agencies with lawful-intercept capability to prevent and investigate terrorism and serious crime, under export license and with safeguards against misuse.

Observed intent: Be the market-leading vendor of turnkey phone compromise to state clients, with the license as the shield and the client named as the operator whenever a target turns out to be a journalist, a dissident, or a head of state.

Gap: The stated and observed intents diverge at the point the forensic record documents. NSO’s clients selected targets including — per the Pegasus Project, Citizen Lab, and Amnesty International — journalists, human-rights lawyers, and people in murdered Saudi journalist Jamal Khashoggi’s circle. Whether NSO knew or intended any specific abuse is not establishable from the outside and is precisely what NSO’s licensed-vendor posture is built to keep unanswerable. What the record does settle is narrower and harder: a US federal court found that NSO hacked roughly 1,400 WhatsApp users. The gap is structural — a business whose product only sells if it works on any phone, sold to states whose target lists the vendor says it does not control — and the court reached the one part of it a court can reach.

In the courtroom the register changes. The compliance vocabulary gives way to the business case. NSO’s brief opposing the WhatsApp injunction argued that it “would put NSO’s entire enterprise at risk” and “force NSO out of business,” as “Pegasus is NSO’s flagship product”; its chief executive testified in August 2024 that defendants “have installation vectors for Pegasus today”; and when its vice-president of research and development was asked in September 2024 whether NSO still invested in circumventing WhatsApp’s security measures, he answered “this is our business.” The court records the same witness testifying that Pegasus could obtain “unlimited access to targets’ mobile devices” (WhatsApp v. NSO, order of 17 October 2025, Dkt. 802). The first register says a governed tool in careful hands; the second says the injunction reaches the product’s livelihood, in the firm’s own telling.

Interest: What each position pays, documented, with the best case its holders state. The positions are NSO’s own, taken from its filings and reports; its licensing ministry, its state customers and the platforms that sued it are named where the record places them beside it.

• Sell lawful intercept to states, under licence. Position: “NSO develops lawful-intercept tools like Pegasus that are necessary for our world to be safer” (Dkt. 100). What it pays: licence revenue from the 60 customers in 40 countries its 2021 report counts, in a product its own filing says was “developed in large part as a countermeasure to “end to end” encryption (E2EE) technology,” so that the feature that makes a messenger worth using is the feature the product is sold to defeat (NSO, Transparency and Responsibility Report 2021). Best case, NSO’s: “Companies that provide E2EE technology and similar technologies have repeatedly refused to cooperate with law enforcement and intelligence agencies to counter these threats.” Who else gains: the state agencies that license it, which the report says NSO licenses “only to the law enforcement and intelligence agencies of sovereign states,” and the Israeli Ministry of Defense, which per NSO’s filing approves its marketing and licensing. Who loses on the same rule: the platforms whose encryption is their product. The court’s reading, in the platforms’ favour, is that unauthorised access to a messenger’s data is “an interference with that sale.”
• The customer, not the vendor, answers for the target list. Position: the report’s “NSO licenses Pegasus to sovereign states and state agencies, does not operate Pegasus, has no visibility into its usage, and does not collect information about customers,” and “Nor do we have any knowledge of the individuals whom states might be investigating.” What it pays: responsibility for any given target sits with a foreign state outside a US court’s reach; the court itself held that “of course an injunction in this case cannot apply to” the foreign sovereign customers (Dkt. 802). Best case, NSO’s: the Northern District of California “is not the appropriate forum for adjudicating claims that a foreign technology company licensed lawful-intercept technology to foreign governments, which then used the technology to monitor foreign criminals and terrorists in foreign countries for those countries’ own national security and other sovereign interests” (Dkt. 100). Who else gains: the customer governments, carved out of the injunction. The court’s answer on the claim it decided: “the court’s consideration of liability and damages was based on NSO’s accessing of Whatsapp’s servers,” NSO’s own conduct, not the customers'.
• Lift the Entity List and enter the US market. Position: Friedman’s line in the 2025 report, “When NSO’s products are in the right hands within the right countries, the world is a far safer place” (TechCrunch, 8 January 2026), and the earlier campaign ProPublica describes in July 2022, “a broad campaign in the United States to get off the U.S. government’s blacklist,” with Pillsbury Winthrop Shaw Pittman, Chartwell, Paul Hastings and Bluelight Strategies engaged (ProPublica, 12 July 2022). What it pays: the listing reads, for NSO, “All items subject to the EAR” with a licence review policy of “Presumption of denial” (Federal Register, 4 November 2021); removal reopens US-origin items and the US market, and the listing is a restriction on the asset the October 2025 buyers acquired. Best case, NSO’s, through its counsel: it “worries about improper or otherwise abusive use of its tools against journalists, human rights advocates, and others” (ProPublica). TechCrunch records that, as of May 2025, “NSO had failed to sway the new administration.” Who else gains: none documented beyond the owners.
• Reverse the WhatsApp judgment on appeal. Position: NSO’s brief that the injunction “would put NSO’s entire enterprise at risk”; the appeal is pending in the Ninth Circuit, where CPJ and partners filed an amicus brief on 20 May 2026 (CPJ). What it pays: if the liability ruling or the injunction fell, the firm’s reverse-engineering of a platform’s code to deliver Pegasus would stand without a US judgment against it. Best case, NSO’s, from its own brief: the injunction would “force NSO out of business.” The court noted on remittitur that “other courts may later determine that behavior such as defendants’ is indeed “particularly egregious”.” Who else gains: none documented.

Interest is a documented fact about each position, not a claim about motive, and not a verdict that the argument is wrong. Each best case is stated at the strength its author states it.

Position in the Apparatus

NSO is a node in the operations wing — the commercial-intrusion layer that sits alongside the data-fusion vendors (Palantir Technologies) and the state collection substrate (the NSA surveillance stack) this file also catalogues. Its lineage is the Israeli signals-intelligence-to-commercial pipeline documented across the corpus: alumni of military intelligence units carrying offensive capability into the private sector, and from there to any government with hard currency and an enemies list. Its customer cohort — documented buyers and deployers of Pegasus — spans states across the Gulf and beyond, each disclosed or exposed separately; only reading the forensic reports together shows the same key opening doors on four continents. The pipeline is lawful and the adjacency is recurrence, not a roster anyone curated. The locksmith’s product became the instrument of record for state phone compromise, and its market is every state that can pay.

Actions & Leadership Choices

Founding purpose, judged on evidence. NSO was founded in 2010 as a commercial offensive-cyber vendor, and the commercial status is the founding fact. Judged on its deeds, its purpose is to sell working phone-compromise to the states that will pay for it, with the export license as the governing fiction. That is not a benign-by-default purpose; a private firm whose product must function against any phone, sold to sovereign clients whose target selection the vendor disclaims, has a conflict built into the model. The deeds below are weighed against that conflict.

Consequential actions, especially where it cost something. The record is a sequence of documented exposures and one adjudication. The Pegasus Project (2021, Forbidden Stories consortium with Amnesty and Citizen Lab) documented a list of 50,000-plus phone numbers selected for potential targeting by NSO clients, including some 14 heads of state and hundreds of officials and journalists. Phones in Khashoggi’s circle were infected before his 2018 murder. Citizen Lab documented the FORCEDENTRY zero-click iMessage exploit and the WhatsApp vector (CVE-2019-3568) used to reach roughly 1,400 phones in a two-week window in 2019. In November 2021 the US Commerce Department added NSO to the Entity List, finding it supplied spyware used to target journalists, activists, and officials. In Meta Platforms Inc. v. NSO Group (N.D. Cal.), NSO was found liable in December 2024; a jury awarded $167.3 million in punitive plus $444,719 in compensatory damages in May 2025; and on October 17, 2025, Judge Phyllis Hamilton cut the punitive award to roughly $4 million (a 9-to-1 ratio) and issued a permanent injunction barring NSO from ever targeting WhatsApp again. NSO is appealing.

The self-inflicted exposure is its own exhibit: in 2018 a rogue NSO employee stole the Pegasus source code and tried to sell it on the dark web for $50 million before being arrested. The firm that sells the tool to surveil everyone could not surveil its own programmer.

Leadership choices. NSO’s leadership ledger is the ownership chain and the litigation posture: founders who sold to private equity and bought back in, a firm that fought the WhatsApp case through a jury verdict and an appeal rather than settle, and a 2025 transfer of control to US investors while the Entity List designation and the injunction stayed in force. The choice under cost — to litigate rather than concede, and to keep selling under the license rather than exit the market the way its Israeli-forensics neighbor Cellebrite periodically does — is the choice that defines it.

The adjudication, in the court’s words. On 20 December 2024 Judge Hamilton granted WhatsApp’s motion for partial summary judgment, denied NSO’s, and granted sanctions in part, writing that “defendants have repeatedly failed to produce relevant discovery and failed to obey court orders regarding such discovery” and that “Because this order resolves all issues regarding liability, a trial will proceed only on the issue of damages” (Dkt. 494). Her October 2025 order restates the holding: “the court granted partial summary judgment in favor of plaintiffs under the Computer Fraud and Abuse Act (“CFAA”) and the California Comprehensive Computer Data Access and Fraud Act (“CDAFA”), as well as for breach of contract. The evidence showed that defendants reverse-engineered Whatsapp’s code to create a modified version of the Whatsapp client application, which they then used to install their software on target users’ devices via WhatsApp’s servers,” and “defendants repeatedly re-designed their software to avoid detection and circumvent plaintiffs’ security fixes.” The jury “unanimously awarded plaintiffs the full amount of $444,719 they sought in compensatory damages,” and found “that defendants acted with malice, oppression, or fraud, and awarded plaintiffs $167,254,000 in punitive damages” (Dkt. 802).

The word “hacked” needs its docket. The roughly 1,400 devices and the two-week window are WhatsApp’s pleading: “Between approximately April 29, 2019, and May 10, 2019, Defendants caused their malicious code to be transmitted over WhatsApp servers in an effort to infect approximately 1,400 Target Devices” (Complaint, Dkt. 1). The court’s liability and damages rest on NSO’s use of WhatsApp’s servers (“the court’s consideration of liability and damages was based on NSO’s accessing of Whatsapp’s servers”), it excluded “evidence of the identities and occupations of the ~1,400 targets” from the trial, and for the injunction it “approaches this analysis as if the targets were ~1,400 individuals about whom nothing is known” (Dkt. 802). On the injunction it found that “Given the multiple design-arounds, the covert nature of NSO’s work, and the designed undetectability of Pegasus itself, plaintiffs are unable to anticipate all the ways that defendants can access their platform.”

On 17 October 2025 the court held that “the punitive damages award cannot exceed a maximum of $4,002,471,” writing that “there have simply not yet been enough cases involving unlawful electronic surveillance in the smartphone era for the court to be able to conclude that defendants’ conduct was “particularly egregious.”” The order gives WhatsApp the choice: “Plaintiffs may accept a remittitur to $4,002,471, or the court will order a new trial as to the amount of punitive damages.” It granted the injunction, held that “of course an injunction in this case cannot apply to” NSO’s foreign sovereign customers, and that “the injunction shall be limited to the Whatsapp platform” (Dkt. 802). In May 2026 CPJ described the district court as having “issued a permanent injunction stopping NSO from targeting WhatsApp messenger and its users” (CPJ). In June 2026 Meta announced a contempt complaint alleging NSO-linked social engineering of WhatsApp users, saying it “caught them creating test accounts and groups on WhatsApp” and “When a malicious company on the US government’s Entity List continues to defy US courts, existing restrictions must remain firmly in place”; CyberScoop reports that NSO did not respond to requests for comment (CyberScoop, 8 June 2026). That is Meta’s allegation; no ruling on it is cited here.

Around that case: NSO’s petition for certiorari from the Ninth Circuit’s decision of 8 November 2021 (No. 21-1338) drew an invitation to the Solicitor General on 6 June 2022, a brief from the United States on 21 November 2022, and the docket entry “Petition DENIED” on 9 January 2023 (Supreme Court docket). Apple moved on 13 September 2024 to dismiss its own complaint against NSO; NSO’s reply was that it “does not oppose” dismissal and that “the dismissal should be with prejudice” (Dkt. 100). The Commerce Department’s rule of 4 November 2021 gives the reason for the listing in its own words: “investigative information has shown that the Israeli companies NSO Group and Candiru developed and supplied spyware to foreign governments that used this tool to maliciously target government officials, journalists, businesspeople, activists, academics, and embassy workers” (Federal Register, 2021-24123).

CONDUCT verdict: ADJUDICATED — a commercial spyware vendor whose product’s documented use against journalists, dissidents, and officials was catalogued by Citizen Lab and Amnesty, sanctioned by the US Commerce Department, and, on the one claim a court reached, found liable: a US federal jury and judge held that NSO hacked roughly 1,400 WhatsApp users and barred it from doing so again. The rest — client target selection, motive — the record does not settle, and the licensed-vendor posture is built so it never has to.

Alliance Map

These run at the same time, and the overlap is the finding. In 2021 and 2022 the firm was at once the licensee of the Israeli Ministry of Defense, the respondent of a US trade restriction it was paying four firms to have lifted, a defendant in two suits in the same federal district, a petitioner to the Supreme Court and the author of its own first transparency report. In 2025 it added a change of control, a new executive chairman who is a former US official, and an injunction. Each tie is documented in a court record, a government rule, NSO’s own report or a press account that cites its sources; no coordination among them is asserted.

Reach Assessment

Institutional: Pegasus became the instrument of record for state phone compromise — reach measured in the client governments that bought it and the forensic reports that traced it, not in any single infection. Memetic: “Pegasus” became the generic name for commercial zero-click spyware, and the Pegasus Project made the phrase a shorthand for the private-surveillance-industry problem entire; owning the byword is upstream of every policy argument conducted in it. Civilizational: NSO does not build the AI systems this file otherwise tracks. It built the commercial capability that decides whether any given phone — a journalist’s, a diplomat’s, a head of state’s — is an open book, and it sold that capability to states as a product. The breach reach of a spyware vendor is wide because the key travels: a working exploit chain, once sold, opens doors long after anyone checks who was standing behind them.

Score basis. Atk 9 is reach: NSO’s report says it “licenses Pegasus to sovereign states and state agencies” and charts 60 customers in 40 countries, and the court records its vice-president of research and development testifying that Pegasus could obtain “unlimited access to targets’ mobile devices” (NSO report; Dkt. 802). It is not a 10 because the buyers are a short licensed list of states, “over 55 countries” are excluded by NSO’s own list, and no statute obliges anyone to act on what the product extracts. Def 6 is funding insulation: the money comes from the state agencies whose use of Pegasus the report says NSO “has no visibility into,” the licence it sells under is the Israeli Ministry of Defense’s to grant and “in quite a few cases” withhold, and the US trade listing reads “Presumption of denial” (NSO report; Federal Register). It is not lower because the customers number in the dozens and the owners are private investors rather than one payer, and not higher because the permit is a ministry’s. Hp 7 is entrenchment: the product outlived the listing, a liability ruling, a permanent injunction and a change of control, and NSO’s own brief told the court the injunction “would put NSO’s entire enterprise at risk” (Dkt. 802); it is not higher because the injunction reaches WhatsApp only and the customer contracts are not public. Peers on the same values: CISA at 9/8/7, hazard 86, ties on atk, hp and hazard and sits two points higher on def, because Congress pays it and the agencies it directs do not, where NSO’s payers are the customers it licenses to; METR at 9/8/7, hazard 84, reaches the labs by voluntary pre-release access and takes no cash from them, where NSO’s reach is bought by its users. On def 6, Worldcoin at 8/6/8, hazard 84, shares def and sits a point lower on atk and a point higher on hp, with a hazard two points lower; NSO’s two extra points of hazard rest on a reach of 9 with a court-adjudicated record of the conduct behind it. The values hold.

Companion file — the drama. The litigation posture, the press war, and the running public receipts are documented on troll.fan, the drama register of this same story: NSO Group case file. This file keeps the mechanism; the drama lives there.

Sources: NSO Group — Wikipedia; The rise and fall of NSO Group — Forbidden Stories; About the Pegasus Project — Forbidden Stories; FORCEDENTRY: NSO Group iMessage Zero-Click Exploit Captured in the Wild — Citizen Lab; HIDE AND SEEK: Tracking NSO Group’s Pegasus Spyware to Operations in 45 Countries — Citizen Lab; Commerce Adds NSO Group and Other Foreign Companies to the Entity List — US Commerce Department, Nov 2021; NSO Ordered to Stop Hacking WhatsApp, but Damages Cut to $4 Million — SecurityWeek; NSO Group Shrinks $167 Million Punitive Award in WhatsApp Case — Bloomberg Law; Spyware maker NSO Group confirms acquisition by US investors — TechCrunch, Oct 10 2025; Fired NSO employee stole and tried to sell Pegasus — Axios; WhatsApp v. NSO, Complaint, Dkt. 1; WhatsApp v. NSO, order of 20 December 2024, Dkt. 494; WhatsApp v. NSO, order of 17 October 2025, Dkt. 802; Apple v. NSO, NSO’s statement of 27 September 2024, Dkt. 100; NSO v. WhatsApp, No. 21-1338 — Supreme Court docket; Entity List rule, 4 November 2021 — Federal Register via govinfo; NSO Group Transparency and Responsibility Report 2021 — OCCRP-hosted PDF; Israeli end-user declaration — Defence Connect; NSO confirms acquisition — TechCrunch, 10 October 2025; NSO transparency report, Friedman — TechCrunch, 8 January 2026; Meta contempt complaint — CyberScoop, 8 June 2026; NSO lobbying campaign — ProPublica, 12 July 2022; CPJ amicus brief, May 2026; PEGA committee vote — Lawfare.