NSO GROUP

Institutional Archetype

THE LOCKSMITH — The archetype is the maker of the master key who sells only to the authorities and disclaims what the authorities do with it. NSO does not run its own operations against its own targets; it licenses Pegasus to government clients, who select the numbers. The structural power is that the instrument is the same regardless of the hand: the zero-click exploit that reaches a cartel lieutenant’s phone reaches a journalist’s phone by the identical mechanism, and the vendor’s business model requires it to work on any phone before it can be sold as working on the phone the customer names. That is the hazard — not authorship of any single infection, but authorship of the capability inside which every infection is possible. The instrument is the exploit chain. The leverage is that a democracy and an autocracy buy the same key from the same shop.

Mandate & Origin

NSO Group Technologies was founded in 2010 in Herzliya, Israel, by Niv Carmi, Shalev Hulio, and Omri Lavie — the company name is an acronym of the three founders’ first names. Carmi is a former Mossad operative; Hulio and Lavie were childhood friends whose earlier venture, Communitake, built remote-smartphone-management technology that (by the founders’ account) drew intelligence-agency interest in a bypass for encrypted messaging. Its flagship product, Pegasus, is zero-click spyware that silently compromises a target phone and delivers the operator everything on it — messages, calls, email, microphone, camera. Under a 2007 Israeli law, cyber-intrusion products require an export license from the Defense Ministry’s Defense Export Controls Agency (DECA); NSO’s stated mandate, repeated in its public statements, is that it sells “only to legitimate law enforcement agencies” for counterterrorism and serious crime, under those licenses and with safeguards against misuse.

Funding & Backers

NSO’s ownership is itself a map of the private-surveillance market. Francisco Partners, a US private-equity firm, acquired majority control in 2014 for a reported $120 million; founders Hulio and Lavie bought the company back in 2019 via the London-based Novalpina Capital fund. In October 2025, NSO confirmed that a group of US investors led by Hollywood producer Robert Simonds acquired a controlling stake — the transaction that, on its face, moves ownership of the Pegasus maker to American hands even as the firm remains on the US government’s own trade-restriction list and states its operations stay under Israeli Ministry of Defense supervision. Who owns the locksmith is part of what the key is: a firm sanctioned by the US Commerce Department in 2021 passed into majority US ownership four years later, with the export controls and the litigation still live.

Actions & Leadership Choices

Founding purpose, judged on evidence. NSO was founded in 2010 as a commercial offensive-cyber vendor, and the commercial status is the founding fact. Judged on its deeds, its purpose is to sell working phone-compromise to the states that will pay for it, with the export license as the governing fiction. That is not a benign-by-default purpose; a private firm whose product must function against any phone, sold to sovereign clients whose target selection the vendor disclaims, has a conflict built into the model. The deeds below are weighed against that conflict.

Consequential actions, especially where it cost something. The record is a sequence of documented exposures and one adjudication. The Pegasus Project (2021, Forbidden Stories consortium with Amnesty and Citizen Lab) documented a list of 50,000-plus phone numbers selected for potential targeting by NSO clients, including some 14 heads of state and hundreds of officials and journalists. Phones in Khashoggi’s circle were infected before his 2018 murder. Citizen Lab documented the FORCEDENTRY zero-click iMessage exploit and the WhatsApp vector (CVE-2019-3568) used to reach roughly 1,400 phones in a two-week window in 2019. In November 2021 the US Commerce Department added NSO to the Entity List, finding it supplied spyware used to target journalists, activists, and officials. In Meta Platforms Inc. v. NSO Group (N.D. Cal.), NSO was found liable in December 2024; a jury awarded $167.3 million in punitive plus $444,719 in compensatory damages in May 2025; and on October 17, 2025, Judge Phyllis Hamilton cut the punitive award to roughly $4 million (a 9-to-1 ratio) and issued a permanent injunction barring NSO from ever targeting WhatsApp again. NSO is appealing.

The self-inflicted exposure is its own exhibit: in 2018 a rogue NSO employee stole the Pegasus source code and tried to sell it on the dark web for $50 million before being arrested. The firm that sells the tool to surveil everyone could not surveil its own programmer.

Leadership choices. NSO’s leadership ledger is the ownership chain and the litigation posture: founders who sold to private equity and bought back in, a firm that fought the WhatsApp case through a jury verdict and an appeal rather than settle, and a 2025 transfer of control to US investors while the Entity List designation and the injunction stayed in force. The choice under cost — to litigate rather than concede, and to keep selling under the license rather than exit the market the way its Israeli-forensics neighbor Cellebrite periodically does — is the choice that defines it.

CONDUCT verdict: ADJUDICATED — a commercial spyware vendor whose product’s documented use against journalists, dissidents, and officials was catalogued by Citizen Lab and Amnesty, sanctioned by the US Commerce Department, and, on the one claim a court reached, found liable: a US federal jury and judge held that NSO hacked roughly 1,400 WhatsApp users and barred it from doing so again. The rest — client target selection, motive — the record does not settle, and the licensed-vendor posture is built so it never has to.

Companion file — the drama. The litigation posture, the press war, and the running public receipts are documented on troll.fan, the drama register of this same story: NSO Group case file. This file keeps the mechanism; the drama lives there.

Sources: NSO Group — Wikipedia; The rise and fall of NSO Group — Forbidden Stories; About the Pegasus Project — Forbidden Stories; FORCEDENTRY: NSO Group iMessage Zero-Click Exploit Captured in the Wild — Citizen Lab; HIDE AND SEEK: Tracking NSO Group’s Pegasus Spyware to Operations in 45 Countries — Citizen Lab; Commerce Adds NSO Group and Other Foreign Companies to the Entity List — US Commerce Department, Nov 2021; NSO Ordered to Stop Hacking WhatsApp, but Damages Cut to $4 Million — SecurityWeek; NSO Group Shrinks $167 Million Punitive Award in WhatsApp Case — Bloomberg Law; Spyware maker NSO Group confirms acquisition by US investors — TechCrunch, Oct 10 2025; Fired NSO employee stole and tried to sell Pegasus — Axios.