After NSO Scandal, What’s Next for Israel’s Cyber Industry?

There may or may not be damage to the Startup Nation’s reputation, and significant change to export regulations is not expected

The year 2021 was not a good one for NSO Group, an Israeli technology firm that became famous, and then notorious, for its Pegasus spyware, capable of remote surveillance of smartphones.

Once a promising startup that developed a unique tool to fight against terror and crime, NSO Group is now associated with targeted attacks against journalists and human rights activists, as well as spying on Israeli allies, among them French President Emmanuel Macron as well as top American diplomats in Africa and elsewhere.

The company is now blacklisted by the American government, along with the worst enemies of Israel and the US; its many contracts with tech giants such as Intel were terminated while Apple and WhatsApp took the NSO Group to court for targeting their clients.

Along with NSO, another Israeli firm – Candiru – stands accused of supplying sophisticated spyware to brutal dictatorships that used it to target and persecute critics, civil society activists and journalists.

The heads of NSO Group and similar companies claim they do not bear any responsibility for malign use of their products, just as gun manufacturers are not responsible for murders that might be carried out with their guns. Moreover, every sale they made was approved by Israel’s Ministry of Defense, which closely regulates NSO and other producers of hacking spyware and issues contract-specific export licenses.

The Israeli cybersecurity sector currently generates $10 billion in annual revenue, with “offensive software” – such as Pegasus – accounting for approximately 10% of the sales. Following the backlash from the NSO scandal and especially the US decision to blacklist the firm, Israel promised to narrow the list of countries eligible to purchase such spyware, possibly dropping the United Arab Emirates, Morocco, Saudi Arabia and some other African countries. While the reputational damage to NSO might eventually force the firm out of business, it is also unclear how great the damage is to Israel’s image as the “Startup Nation.”

I really do not think that there will be any negative effect for Israeli high-tech. It’s more of an isolated event.

Arik Segal, technology and innovation adviser at Mitvim – The Israeli Institute for Regional Foreign Policies, believes that while NSO and others like it will feel the heat, the current storm will not greatly affect the Israeli high-tech sphere.

“I really do not think that there will be any negative effect for Israeli high-tech. It’s more of an isolated event,” he told The Media Line.

“Also, regarding people who work there, I also believe that there will be no shortage of candidates [seeking employment]. In the past, people worked in tobacco or lobbying companies, and now they are working at NSO Group. In terms of branding and Israel’s image – it’s mostly in the eye of the beholder. Israel already has a militaristic image, and people who previously held this view of Israel will probably get a boost in their belief, while those who were unconcerned before will probably not even notice,” Segal said.

Dr. Lev Topor, a senior research fellow at the University of Haifa’s Center for Cyber Law and Policy, shares this point of view. He explains that in Israel and throughout the world there is simply not enough oversight of the cyber industry. “The NSO Group operates in an arena without regulation. There are no international cyber laws, there are no do’s and don’ts,” he said.

Each country decides for itself whether or not to establish laws and regulations in this field. In Israel, the companies are subject to state provisions and regulations, but if NSO or any other company for that matter passes this hurdle, the international market will accept it, Topor told The Media Line.

“Also, in the worst-case scenario, states and other firms could work via a business proxy and cooperate with NSO, bypassing the blacklists of the US or of other countries that might follow suit,” he said.

While Pegasus was mostly used against civil society activists, journalists and diplomats, the researcher, who also recently started a global initiative called Privacy.Page that enables internet users to find out whether their personal data was leaked, reminds everyone that spyware is widely used in everyday life.

“Huge amounts of data are stolen and leaked every year, and there is really no solution for the citizens who had a password or credit card or any other information stolen,” Topor said.

I do believe that Israel’s shiny ‘Startup Nation’ image might be damaged

The researchers in the cyber sphere around the globe are unanimous in the belief that the technology is developing much faster than the laws, and governments are often unable to protect their citizens’ data – which explains why private companies and developers like Topor come into the picture – or to properly regulate the export of offensive spyware.

Will Israel’s regulations and laws change as a result of the NSO scandal?

For now, there is little hope of that, says Avidan Freedman, a founder of Yanshoof, a project dedicated to advancing Israeli legislation that sets moral limits on weapons exports.

“There was a promise to hold a discussion on this issue in the Knesset’s Foreign Affairs and Defense Committee, but this committee is closed to the public, and there is no way of knowing what was discussed or decided there,” Freedman told The Media Line. “The Ministry of Defense promised to tighten the control and the regulation, but they also promised to do that a while ago.

“Pegasus and similar spyware programs are not ‘just like weapons.’ They are weapons. They are an integral part of security exports. And if this weapon would threaten Israel’s security and end up in the wrong hands, the Ministry of Defense would treat the issue very differently,” he said.

“Among the 10 largest weapon exporters in the world, only the US and Israel, along with Russia, didn’t ratify the Arms Trade Treaty. However, the US passed its own legislation – the Leahy Law – to regulate the issue of arms sales, which prohibits the US government from providing assistance funds to units of foreign security forces where there is credible information implicating the unit in the commission of gross violations of human rights,” he added.

“I do believe that Israel’s shiny ‘Startup Nation’ image might be damaged” by the NSO scandal, Freedman said.

A degree of reputational risk may exist for Israel, but significant change in the sphere of arms trade is not expected any time soon, and there is no guarantee that an NSO-like scandal will not repeat itself.