Ukraine’s efforts to bolster its surveillance capabilities, like its efforts to strengthen its military, had support from the United States, Israel’s closest ally.
But Israeli officials balked at any move that might provoke a confrontation with Russia, whose military at the time was aggressively helping Syria combat a rebellion beyond Israel’s northeastern border. According to people who were familiar with the matter, the Defense Exports Controls Agency of the country rejected the license that would have permitted the NSO Group, to provide Pegasus to Ukraine. These people believed this action happened as far back as 2019, but the exact timing was unclear.
Concerns about Russian reaction also affected NSO’s dealings with Estonia, a member of NATO, say people familiar with those actions. According to these people, NSO had licensed Pegasus to Estonia, which achieved independence from five decades of Soviet rule in 1991 and is known for its aggressive counterintelligence measures against Russia, but the company later imposed restrictions on the spyware’s use. People familiar with the Pegasus license say that Estonia isn’t able to attack Russian phones. However, it’s not known what those restrictions are.
Despite being a privately owned company, Israeli officials have sought for many years to ensure that Pegasus distribution is in line with their national diplomatic priorities. The website for the Defense Exports Controls Agency, which is part of the nation’s defense ministry, says it “has worked to protect Israel’s national security and defense interests through its licensing responsibilities in relation to defense equipment, know-how, counter-proliferation, and in terms of preventing damage to Israel’s international relations and national strategic interests.”
NSO officials have long said that Pegasus, which can turn almost any smartphone into a spying device, cannot be used by foreign governments against U.S. +1 numbers or to spy on phones with foreign-based numbers if they are inside the United States. More recently, the company began blocking the ability of foreign governments to use Pegasus against phones linked to British cellular networks in August 2020, according to people familiar with company operations.
But the extent of Israel’s efforts to avoid upsetting Russia by limiting the use of Pegasus has not previously been reported. The Guardian newspaper in Britain and The Washington Post jointly published this article.
The Pegasus Project, a global investigation consortium including The Washington Post, The Guardian and 15 other partners, last year found widespread abuses, with politicians, journalists, human rights workers, diplomats and government officials targeted in numerous countries.
The investigation, led by Paris-based journalism nonprofit Forbidden Stories, also found that government operators of Pegasus often use it as an intelligence gathering tool to surveil targets outside their own borders, in neighboring countries and beyond. People familiar with Pegasus’ use say that NSO customers are dozens of nations, some of which are in Western Europe.
In the nearly four weeks since Russia invaded Ukraine, Israel’s efforts to limit the distribution of a powerful spying tool seem newly relevant. Naftali Bennett is Israel’s prime minister. He has tried to broker between Russia and Ukraine. Israel also reportedly refused to sell its Iron Dome missile defense system, developed with U.S. financial support, to Ukraine last year, according to Israel’s Ynet News. The former head of the Israeli Defense Ministry was Tuesday, and he said that it takes into account a variety factors in issuing a Pegasus license. The statement stated that policy decisions about export control take security and strategic considerations into consideration, as well as adherence to international agreements.
It didn’t directly answer most of The Post and The Guardian’s questions. Questions about Tuesday’s story were not answered by U.S. officials.
Ukraine’s desire to acquire Pegasus and Israel’s reluctance to allow the move was previously reported by Israel’s Channel 12.
The NSO Group, presented with a detailed list of questions, said in a brief statement, “NSO continues to be subjected to inaccurate media reports regarding alleged clients, which are based on hearsay, political innuendo and untruths.”
Mykhailo Fedorov, Ukraine’s deputy prime minister who oversees digital technology for Ukraine, declined to confirm that his nation had sought to acquire Pegasus, but he acknowledged the country has been seeking Israeli technology. He said that although the government of Israel does not participate in discussions or facilitate the acquisition of offensive technology, they are in contact with many Israeli companies and at different stages. “But again, let me say this: We have enough capability to continue winning and we’re adding new tools, including emerging tools, every day.”
Russia, whose embassy in Washington did not respond to a requests for comment, has treated Ukraine with increasing hostility since the Maidan Revolution of 2014 pushed the country toward Europe and the West. Russia took the strategically vital Crimean region in that year, and started a separatist movement that lasted until Russia invaded Ukraine.
Estonian Ministry of Defense spokeswoman Susan Lillevali declined to comment about the use of Pegasus in her country, which has not been previously reported.
Pegasus can infect almost any smartphone, whether made by Apple, Google, Samsung or other companies, through a malicious link embedded in a text message or through what’s called a “zero-click attack.” Such attacks require no action by the phone’s user and begin without any kind of alert. Once Pegasus has infected a device, its operators can access the files and passwords of their owner, as well as track and locate the historical and current locations. Pegasus can also remotely activate microphones or cameras to listen to calls, record video and eavesdrop.
The NSO Group has repeatedly said that Pegasus is intended for use against terrorism and major crimes such as drug trafficking, and that the company investigates reports of abuses and cuts off nations that misuse the system. The company stated that it won’t license Pegasus to dozens of countries because they are concerned about human rights and other issues.
After the Pegasus Project was published last summer, it was also discovered that Pegasus had been used to target the telephones of American diplomats in Uganda. The Biden administration in November blacklisted NSO Group, depriving it of access to American technology.
Craig Timberg is a Washington Post technology reporter. Stephanie Kirchgaessner, a Washington-based investigative journalist for The Guardian is Stephanie Kirchgaessner. Shane Harris, Ellen Nakashima, and Souad Medhennet are Washington Post national security journalists. This report was contributed by Cat Zakrzewski, a Post technology reporter.