The company has established an ethics committee, which decides whether it can sell its spyware to countries based on their human rights records as reported by global organizations like the World Bank’s human capital index, and other indicators. NSO would not sell to Turkey, for example, because of its poor record on human rights, current and former employees said.
But on the World Bank index, Turkey ranks higher than Mexico and Saudi Arabia, both NSO clients. A spokesman for Israel’s Ministry of Defense, which needs to authorize any contract that NSO wins from a foreign government, declined to answer questions about the company.
A lawsuit alleged last year that in the months before his death, Saudi Arabia used NSO products to spy on Mr. Khashoggi, the Washington Post columnist strangled and dismembered in October by Saudi operatives inside the kingdom’s consulate in Istanbul. NSO denies the accusation. Several of Mr. Khashoggi’s closest contacts were targets of NSO hacking tools, Citizen Lab reported. Without access to Mr. Khashoggi’s devices, researchers have not confirmed whether he was a direct target of NSO surveillance.
Even in cases of blatant abuse, NSO continued to renew contracts with its government clients. In 2013, for instance, NSO inked its first deal with the United Arab Emirates. Within a year, the Emirati government was caught installing NSO spyware on the mobile phone of Ahmed Mansoor, a prominent human rights activist.
After receiving an onslaught of text messages containing links, Mr. Mansoor — a frequent target of Emirati surveillance — grew suspicious and passed the texts to security researchers, who determined the links were NSO lures that exploited vulnerabilities in Apple software to take over Mr. Mansoor’s phone. It was, researchers said, the most sophisticated spyware they had ever uncovered on a mobile device.
The discovery forced Apple to release an emergency patch. But by then, Mr. Mansoor had already been fired from his job, had his passport confiscated, his car stolen, his email hacked, his location tracked, his bank account emptied of $140,000, and was beaten by strangers twice in the same week.