Spyware providers are flocking to international arms fairs to sell to NATO foes

The report shows that the problem goes well beyond NSO Group.

European and Middle Eastern spyware and surveillance firms are marketing intrusion software to adversaries of the U.S., its intelligence allies and NATO, Atlantic Council research published Monday reveals.

Looking at more than 200 companies that attended international arms fairs in the past two decades, researchers found that 85% of companies likely selling interception or intrusion technologies marketed these capabilities to governments outside their home country — even when no intelligence relationship existed. Five companies, including Israel-based Cellebrite and Sweden-based Micro Systemation AB, marketed those capabilities to U.S. and NATO adversaries.

“Cellebrite’s Digital Intelligence technology is used lawfully and with a warrant to help federal government agencies and law enforcement, including Five Eyes member nations, to investigate an event after it has taken place,” a Cellebrite spokesperson told CyberScoop in an email. “The report is inaccurate and misleading regarding how it positions Cellebrite.”

Cellebrite does not sell to countries on the “[Financial Action Task Force]’s blacklist or under sanction by the United States, Israel or the broader international community,” the spokesperson wrote.

MSAB did not respond to a request for comment.

The findings coincide with an explosion of surveillance vendors attending international arms trade shows, including the heavily attended Milipol France and the U.K. -based Security and Policing Home Office. 

The report underscores growing concerns about the threat that spyware companies pose to the United States and its allies. U.S. and European leaders have begun to follow human rights organizations in vocalizing opposition to firms like the NSO Group, whose spyware technology has been used by authoritarian regimes to spy on dissidents and journalists. 

“These vendors are increasingly looking to foreign governments to hawk their wares, and policymakers have yet to sufficiently recognize or respond to this emerging problem,” researchers Winnona DeSombre, Lars Gjesvik and Johann Ole Willers write. “Any cyber capabilities sold to foreign governments carry a risk: these capabilities could be used against individuals and organizations in allied countries, or even in one’s home country.”

Those risks aren’t hypothetical. The data on arms fair attendance collected by researchers included U.S. contractor CyberPoint, the precursor to DarkMatter, which was the subject of U.S. law enforcement after it designed cyber capabilities for the United Arab Emirates that led to spying on U.S. citizens.

The report provides one of the broadest overviews of the intrusion and surveillance industry to date, but the researchers note that it is likely far more firms exist. They say that because they were searching in English, “the dataset woefully underreports the presence of Chinese companies in this space.”

Researchers at the think tank urged U.S. and NATO forces to tighten export controls on the technology and work with arms fairs to limit attendance by companies that sell their technology to authoritarian or adversarial governments.

The United States took a major step against spyware Wednesday when the Commerce Department added Israel-based NSO Group and spyware firm Candiru to its list of companies that pose a national security risk to the United States. NSO Group has protested the U.S. decision. On Friday, three House Democrats called on the Biden administration to take even further action to limit investors from democratic countries from investing in hack-for-hire companies.

Updated 11/9/2021: With comment from Cellebrite.

Someone infected a spyware probe overseer with spyware

Citizen Lab says the phone of a member of Europe’s PEGA Committee was infected twice with Pegasus, the NSO Group spyware that gave the panel its name.

Meta accuses NSO Group of defying spyware injunction, files contempt of court complaint

One House Democrat is pressing Commerce on the government’s spyware use

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems