The hurdles were significant for the team at US company L3Harris, which also had experience with spyware technology. They started with the unfortunate fact that the United States government had blacklisted NSO just months earlier because the Israeli company’s spyware, called Pegasus, had been used by other governments to infiltrate the phones of political leaders, human rights activists rights and journalists. Pegasus is a zero-click hacking tool that can remotely extract everything from a target’s cell phone, including messages, contacts, photos and videos without the user having to click on a phishing link to give them remote access. It can also turn the mobile phone into a monitoring and recording device. NSO had acted “contrary to the national security or foreign policy interests of the United States,” the Biden administration said in announcing the blacklist in November, barring American companies from doing business with the Israeli company. But five people familiar with the negotiations said the L3Harris team had brought with them a surprise message that made a deal look possible. U.S. intelligence officials, they said, quietly supported its plans to buy NSO, whose technology over the years has been of strong interest to many intelligence and law enforcement agencies around the world, including the FBI and CIA. Talks continued in secret until last month, when news of a possible sale of NSO leaked and put all parties at loggerheads. White House officials said they were outraged to learn of the negotiations and that any attempt by US defense companies to buy a blacklisted company would face serious resistance. Days later, L3Harris, which depends heavily on government contracts, notified the Biden administration that it had scrapped plans to buy NSO, according to three United States government officials, although several people familiar with the talks said attempts have been made to revive negotiations. Questions remained in Washington, other allied capitals and in Jerusalem about whether parts of the US government – with or without the knowledge of the White House – had seized the opportunity to try to put control of NSO’s powerful spyware under US power, despite the administration’s very public stance against the Israeli company. It also left in limbo the fate of NSO, whose technology has been a tool of Israeli foreign policy even as the company has come under fire for the ways in which spyware is used by governments against their own citizens. The episode was the latest skirmish in an ongoing battle between nations to gain control of some of the world’s most powerful cyber weapons, and reveals some of the contradictions facing a coalition of nations — including the United States under the Biden administration — as it tries to rein in a lucrative global market for sophisticated commercial spyware. Representatives for L3Harris and NSO declined to comment on negotiations between the companies. A spokeswoman for Avril Haines, the director of national intelligence, declined to comment on whether any US intelligence officials tacitly blessed the discussions. A Commerce Department spokesman declined to elaborate on any discussions with L3 Harris about the NSO purchase. A spokesman for the Israeli Defense Ministry declined to comment, as did a spokesman for the Israeli prime minister. The Biden administration’s decision to blacklist NSO came after years of revelations about how governments had used Pegasus, NSO’s flagship hacking tool, as a means of internal surveillance. But the United States itself bought, tested and developed the Pegasus. In January, the New York Times revealed that the FBI had purchased the Pegasus software in 2019 and that government lawyers at the FBI and the Justice Department had discussed whether to develop the spyware for use in domestic law enforcement investigations. The Times also reported that in 2018 the CIA bought Pegasus for the Djibouti government to conduct counter-terrorism operations, despite the country’s record of torturing political opposition figures and imprisoning journalists. A decision by L3 to end takeover talks would leave NSO’s future in doubt. The company had seen a deal with the US defense contractor as a possible lifeline after being blacklisted by the Commerce Department, which has crippled its operations. US companies are not allowed to do business with blacklisted companies, subject to sanctions. For more than a decade, Israel has treated the NSO as a de facto arm of the state, licensing Pegasus to several countries—including Saudi Arabia, Hungary, and India—with which the Israeli government hoped to foster stronger security and diplomatic ties. But Israel also denied Pegasus to countries for diplomatic reasons. Last year, Israel rejected a request by the Ukrainian government to buy the Pegasus for use against targets in Russia, fearing the sale would damage Israel’s relations with the Kremlin. The Israeli government also makes extensive use of Pegasus and other local cyber tools for its own intelligence and law enforcement purposes, giving it further incentive to find a way for NSO to survive US sanctions. During discussions about the possible sale of NSO to L3 Harris — which included at least one meeting with Amir Eshel, the director general of the Israeli Defense Ministry, who would have to approve any deal — L3Harris representatives said they had get permission from the United States government will negotiate with NSO, despite the presence of the company on the US blacklist. L3 Harris representatives told the Israelis that US intelligence supported the takeover as long as certain conditions were met, according to five people familiar with the discussions. One of the conditions, these people said, was that the NSO’s arsenal of “zero days” — the vulnerabilities in computer source code that allow Pegasus to hack cellphones — could be sold to all of the United States’ partners in so-called Five Eyes Intelligence Sharing Relationship. The other partners are Britain, Canada, Australia and New Zealand. A senior British diplomat declined to comment on questions about the extent of knowledge British intelligence had about a possible deal between L3 and NSO. Such a plan would be highly unusual if finalized, as Five Eyes countries typically only buy intelligence products developed and manufactured in those countries. Israeli Defense Ministry officials were open to this arrangement. But after intense pressure from the Israeli intelligence community, he balked at another request: that the Israeli government allow NSO to share the computer source code for Pegasus — which allows it to exploit vulnerabilities in the phones it targets — with the Five Eyes countries. They also did not agree, at least not at first, to allow L3’s cyber experts to come to Israel and join NSO’s development teams at the company’s headquarters north of Tel Aviv. Defense ministry officials also insisted Israel retain its authority to grant export licenses for NSO products, but said they were willing to negotiate which countries received the spyware. During the discussions, there were several issues that would require the approval of the United States government. L3Harris representatives said they had discussed the issues with US officials, who had agreed in principle, according to people familiar with the discussions. To help negotiate the sale of NSO, L3Harris hired an influential lawyer in Israel with deep ties to Israel’s defense establishment. The lawyer, Daniel Reisner, is the former head of the International Law Department of Israel’s Military Prosecutor’s Office and acted as a special adviser on the Middle East peace process to former Prime Minister Benjamin Netanyahu. In the months since the Biden administration announced the blacklist in November, and as the Israeli government pushed for a way to prevent NSO from backing down, the Commerce Department in Washington sent a list of questions to NSO and another Israeli hacking company that had been blacklisted. At the same time, how the spyware works, who it targets, and whether the company has control over how its nation-state customers deploy the hacking tools. The list, reviewed by the Times, asked whether NSO maintained “positive control over its products” and whether Americans abroad were protected from NSO developing products against them. Another asked if NSO would “shut down access to its products if the US government informs them that there is an unacceptable risk of the tool being used for human rights abuses by a particular customer?” Separate from the proposed NSO and L3 Harris deal, Israeli officials unsuccessfully negotiated with the Commerce Department to remove NSO from the US blacklist ahead of President Biden’s trip to Israel next week. News last month of L3Harris’ talks to buy NSO appeared to blindside White House officials. After the website Intelligence Online reported on the possible…
