An unseen battle is being waged across the digital landscape, turning the very devices we rely on into silent observers. Civil liberties organizations have persistently shined light a constellation of Israeli technology enterprises—many birthed by alumni of elite military intelligence units such as Unit 8200, Unit 81, and the Mossad—as pivotal actors in a burgeoning global commercial surveillance market. These firms have supplied powerful tools deployed against journalists, activists, political dissidents, and, in several verified instances, individuals residing within the United States and other Western democracies. Advocacy groups, including War on Want, emphasize that Israel serves as the global headquarters for more spyware companies than any other nation, a roster that includes NSO Group, Candiru, Cellebrite, Verint, NICE, Black Cube, Cytrox, and Intellexa.
One firm on that list stands above the rest. Working out of Herzliya, north of Tel Aviv, NSO Group is the most conspicuous case. Shalev Hulio, Omri Lavie, and Niv Karmi founded it in 2010, the initials of their first names giving the company its name, though Karmi left about a month in. Hulio and Lavie are widely reported to be alumni of Unit 8200, the Israeli military’s signals intelligence arm, and Karmi came out of Mossad and military intelligence. The firm built its reputation on Pegasus, spyware that can quietly seize control of a smartphone and reach its camera, microphone, messages, and location.
In 2021 the Pegasus Project, a joint investigation by Amnesty International, Forbidden Stories, and more than a dozen news organizations, reported that the tool had been turned on journalists, human rights defenders, and politicians. It also found that people close to the murdered Saudi journalist Jamal Khashoggi were selected for surveillance by NSO clients before and after his death, though the investigators could not identify which clients, and Hulio denied any role in the killing.
The collision with American technology companies came through the courts, and it did not go NSO’s way. In 2019 Meta, which owns WhatsApp, sued the firm, accusing it of exploiting a flaw in the app to plant Pegasus on roughly 1,400 phones over a matter of weeks, among them those of attorneys, journalists, activists, dissidents, and senior government officials across several countries. The clickless attack needed only a WhatsApp call, which the target never had to answer. A federal judge found NSO liable in December 2024, and in May 2025 a jury ordered it to pay about $167 million in punitive damages and $444,000 in compensatory damages. The following October the court reduced the punitive figure to roughly $4 million but imposed a permanent injunction barring NSO from ever targeting WhatsApp again, a far graver blow to a company whose business is access.
The regulatory ground shifted in November 2021. On November 3, the Commerce Department added NSO to its Entity List, choking off its access to American technology and citing conduct contrary to “the national security or foreign policy interests of the United States.” Three weeks later Apple sued, accusing the firm of creating fraudulent Apple IDs and deploying a zero click exploit called FORCEDENTRY to break into its customers’ devices, including those of Americans whose phones “have been surveilled by NSO’s spyware on mobile devices that can and do cross international borders.”
Apple abandoned the case in September 2024, and its reasons were revealing. It told the court that pressing on would force it to expose the threat intelligence it uses to defend against spyware, and that it might never obtain the decisive files anyway, because Israeli officials had seized documents from NSO in 2020 to keep them out of a U.S. court. The Guardian surfaced that seizure in July 2024, reporting it as an effort to stop NSO from complying with discovery in the parallel WhatsApp case. In other words, Apple walked away in part because the Israeli state had helped put the evidence beyond reach.
The pressure has come from outside the boardroom too. Amnesty International has pursued legal action inside Israel to strip NSO of its export license, and the University of Toronto’s Citizen Lab has documented Pegasus deployed against Catalan politicians and European Parliament members, dissidents from Saudi Arabia and the United Arab Emirates, and staff at Western civil society groups. Microsoft, Google, Cisco, and others joined Apple’s original filing in support, calling NSO’s tools a threat to the wider internet.
NSO commands the headlines, but it is not alone. Candiru, a secretive Tel Aviv firm, landed on the Commerce Department’s Entity List the same day as NSO in 2021, cited for selling spyware used against journalists, dissidents, and rights defenders. A joint investigation by Citizen Lab and Microsoft mapped more than 750 domains tied to Candiru’s infrastructure, many of them built to impersonate the very groups its targets trusted, among them Amnesty International and the Black Lives Matter movement, along with the World Health Organization and news outlets. Microsoft counted at least one hundred victims, including politicians, human rights workers, academics, and embassy staff, in Spain, the United Kingdom, and across the Middle East.
The trade is not limited to remote spyware. Cellebrite, an Israeli forensics company, makes the phone unlocking and data extraction tools that thousands of police forces rely on, including in the United States, where Immigration and Customs Enforcement is a customer. Critics say the gear is turned on dissent as readily as on crime. Amnesty International documented Serbian authorities using Cellebrite to unlock the phones of a journalist and an activist during detention, then loading spyware onto the devices. Citizen Lab has since traced Cellebrite extractions to the seized phones of activists in Russia, Jordan, and Kenya, each unlocked while its owner sat in custody for opposing the government. Reporters in Botswana and Myanmar had their devices extracted after writing about those in power. Cellebrite has said it cuts off customers who misuse its tools, though researchers found Russian authorities kept using them after the company pulled out of the country.
Ahead of Cellebrite’s 2021 debut on the Nasdaq, human rights and press freedom groups pressed regulators to hold the listing until the company could show it had stopped selling to abusive governments. Cellebrite has since cut off customers in Russia, Belarus, Serbia, Hong Kong, Bangladesh, and Myanmar after abuses came to light, though critics argue it polices its own rules only when caught.
The presence of Israeli firms runs deeper still, into the plumbing of American telecommunications. Verint, once known as Comverse Infosys, and NICE Systems both grew out of Israeli signals intelligence, and both have drawn American scrutiny over their role in domestic wiretapping infrastructure. In his 2008 book The Shadow Factory, the investigative journalist James Bamford argued that Israeli founded companies supplied much of the wiretapping hardware and software running through the United States telephone network, and he flagged Verint’s close ties to the FBI’s central wiretapping office. His most quoted line claims that “virtually the entire American telecommunications system is bugged by two Israeli-formed companies with possible ties to Israel’s eavesdropping agency, with no oversight by Congress.” Bamford named those two companies as Verint and Narus. The charge is his, it dates to 2008, and it has never been independently confirmed, but it captured a unease about foreign built surveillance embedded in American networks that has never fully faded.
Verint carried other baggage. Its parent company, Comverse, collapsed into a securities fraud scandal whose chief executive, Kobi Alexander, fled to Namibia and later pleaded guilty, and reporting has shown that Verint and firms like it sold surveillance gear to authoritarian governments in Central Asia, including Kazakhstan and Uzbekistan.
The reach of the Israeli surveillance apparatus is not merely a commercial phenomenon; it is an all-encompassing strategic extension of a foreign state power. By embedding itself deep within the digital infrastructure that governs the modern American experience, these companies have proven that our tech sector is not immune to subversion. This is not a normal country we are dealing with, but a state that considers the private frontiers of our citizens to be legitimate territory for its own intelligence and political objectives.
