The Privatization of Cyber Tools and Operations Further Muddies Attribution Efforts

The recent exposure of NSO, the Israeli company that developed the Pegasus mobile phone spyware, has again brought to the forefront private companies that develop and sell their technology to “only” governments and licensed law enforcement entities for the purposes of spying and surveilling targets of interest.  While ostensibly Pegasus can be used against criminal and terrorist elements, recent revelations show how such technology can be bent to the will of its operators.  In this instance, the spyware was sold to authoritarian regimes to target human rights activists, journalists, religious figures, academics, and attorneys, among others, with approximately 50,000 individuals being targeted by the spyware since 2016, according to a data leak.  Per one report, Pegasus malware targeted as many as 14 heads of state, as well, implying a cyber espionage angle to the malware’s use.  An expose on NSO that manufactured Pegasus revealed that the company cited “cyberwarfare” as its business model.  There seems little doubt as to the intent of Pegasus and how it has been marketed to potential clients.