W

ith the advancement of the digital age, international relations and power struggles have shifted from the physical realm to the virtual world, taking on a new and complex dimension. The conventional intelligence gathering methods of the past have now been replaced by far more complex, difficult to detect and wide-ranging cyber espionage activities. One of the most critical fronts in this new arena of conflict is the chips, hardware, and software at the heart of the technological devices that are indispensable parts of our daily lives.

States’ desire for technological superiority and information dominance drives them to embed hidden backdoors even in the most innocent devices we use, fundamentally shaking the global technology landscape and the international security paradigm. This practice is evolving beyond a niche intelligence tactic and moving towards the centre of geopolitical competition. This process, spanning from the physical hardware manipulations of the Cold War to the systemic compromise of today’s software and supply chains, presents a dilemma for states.

The impact of the quest for information dominance on national security

A backdoor, in its most basic definition, is a method designed to provide covert access to a system by bypassing normal security controls. These deliberately placed mechanisms aim to provide persistent and privileged access, even after the initial security vulnerabilities have been patched. In state-sponsored espionage activities, backdoors can be divided into three main categories: software, hardware, and cryptographic. While software-based backdoors (such as Trojan horses) are more common and relatively easier to detect, the real major threat is posed by hardware and cryptographic backdoors.

A hardware backdoor embedded in a device’s microchip or factory firmware operates below the operating system level, making it nearly impossible to detect with software-based security measures. Installing such a backdoor is highly costly and difficult, as it requires intervention in the supply chain during the design or manufacturing phase. However, it offers the highest level of persistence and stealth.

At this point, the argument that the pursuit of absolute information dominance through backdoors creates a paradoxical scenario that makes nations using these methods more vulnerable gains significance. A state that installs backdoors in technological infrastructures to monitor its rivals also renders its own infrastructure more vulnerable to similar attacks. For the backdoor created inevitably becomes an entry point for criminals, terrorists and hostile states as well, dragging everyone into greater insecurity. This situation erodes global security while ushering in a new and more dangerous era of technological conflict.

From the Cold War to the digital age

The roots of modern digital espionage activities lie in intelligence operations during the Cold War. The physical hardware manipulations of that era served as a model for today’s complex cyber-attacks and supply chain interventions. One of the most striking examples from this period is Operation Rubicon, in which the CIA and the West German BND secretly took control of the Swiss encryption machine manufacturer Crypto AG.

Thanks to this operation, which lasted for decades, the secure communications of more than 120 countries were illicitly intercepted and read. While secure machines were sold to NATO allies, weakened and easily breakable versions were sold to neutral or hostile countries. The Crypto AG operation established the playbook for covertly taking over a trusted global supplier, weakening most of its products, and using the intelligence gained for diplomatic and military advantage. Another significant case from the Cold War era is the crypto wars of the 1990s and the famous Clipper Chip initiative.

In 1993, the U.S. government proposed a hardware chip that would be mandatory for secure voice communication and would contain a backdoor known as a key escrow. Under this system, each chip’s unique key would be stored in two separate government agencies, and law enforcement could access these keys with a court order to decrypt communications. However, this proposal failed due to significant backlash from civil liberties advocates and the technology industry. The failure of the Clipper Chip’s overt, legally mandated control mechanism prompted intelligence agencies to pursue more covert and deniable methods to undermine encryption. The public crypto wars of the 1990s did not end; they merely went underground.

Actors and strategies in global cyber espionage

Today, cyber espionage and the use of backdoors have become a global phenomenon. All major intelligence services have concluded that the most effective method is to be invited in through a compromised trusted product or update, rather than infiltrating a target’s network from the outside. This tactical convergence is creating a universally fragile and unreliable technological ecosystem. In the United States, Edward Snowden’s revelations documented how the NSA systematically built backdoors into the global digital ecosystem through programmes such as PRISM and BULLRUN.

Through the PRISM program, the NSA collected user data directly from the servers of major US internet companies, while the BULLRUN program attempted to undermine encryption standards. One of the most notorious examples is the NSA imposing Dual_EC_DRBG, a flawed random number generator, as a standard and being able to break the encryption of countless products thanks to the cryptographic backdoor in this algorithm. It has also been revealed that the NSA’s Special Access Operations unit physically interfered with network equipment destined for export to install backdoors.

Chinese telecommunications giants Huawei and ZTE have been viewed as a national security risk due to allegations that their equipment may contain backdoors accessible to the Chinese government. China’s 2017 National Intelligence Law, which compels all organisations to cooperate with state intelligence, has heightened these concerns. Although no definitive evidence has been made public, these allegations have led many countries to ban Huawei equipment from their 5G networks.

On the other hand, it is known that Russian state-sponsored groups, particularly in the SolarWinds case, infiltrated software supply chains, putting thousands of government and corporate networks at risk. Furthermore, allegations that Russian-made Kaspersky antivirus software has the potential to be used as a spy tool demonstrate deep mistrust of software originating from strategic rivals. Finally, the Pegasus spyware developed by the Israeli NSO Group is one of the most dangerous examples of the ‘spyware as a service’ model. Sold to governments, this tool has been widely used to target journalists, activists and political opponents, highlighting the risks of the privatization and proliferation of state-level surveillance capabilities.

A

landmark U.N. cybercrime convention that supporters say will strengthen global tools to fight online criminal networks, but critics warn could turbocharge transnational surveillance and political repression is due to be signed in Hanoi this weekend, amid intensifying scrutiny over both its broad scope and its choice of host country.

The treaty — the first comprehensive international instrument on cybercrime negotiated at the United Nations — is intended to help governments cooperate faster on investigations spanning borders. It would enter into force once ratified by 40 states; threshold negotiators expect to be reached in 2026.

U.N. officials have touted the agreement as a “historic step” in closing gaps that currently enable cross-border hackers, ransomware gangs and online criminal operations to evade prosecution by exploiting slow judicial processes and jurisdictional loopholes. The U.N. estimates cybercrime costs the global economy trillions of dollars each year.

But human rights organizations, major technology companies and digital security researchers say the pact contains language so broadly defined that it risks being used not only against cybercriminals — but against journalists, whistleblowers, civil society groups and even ethical security researchers.

Fears of extraterritorial surveillance

The Cybersecurity Tech Accord — an industry coalition representing Meta, Microsoft and dozens of other firms — has called the final text a “surveillance treaty,” saying vague provisions on “content-related crimes” could enable intrusive cross-border cooperation requests that bypass meaningful judicial safeguards.

Some of the most contentious clauses relate to data-sharing. Once in force, signatory governments could request user data or subscriber information directly from foreign authorities. Tech firms warn this could allow governments to target critics abroad under pretexts of “cyber sabotage” or “digital disinformation.”

“Instead of limiting state abuse, this could institutionalize it,” said Raman Jit Singh Chima of Access Now. “The risk is that countries with repressive track records can demand data in ways that threaten activists, journalists and political opponents.”

The U.N. Office on Drugs and Crime (UNODC), which led negotiations, insists human rights safeguards are built into the text. It says states will retain the right to refuse cooperation requests if they conflict with international law. “There are explicit human rights protections in the convention,” UNODC said in a statement.

Vietnam’s role draws scrutiny

Diplomats and rights advocates say the optics of holding the signing ceremony in Vietnam have amplified concerns rather than eased them. Hanoi has one of Asia’s most restrictive environments for online speech. At least 40 people have been arrested this year alone for posting criticism of the government or the Communist Party on social media, according to Human Rights Watch.

The U.S. State Department’s 2025 human rights report cited “significant restrictions on online freedom of expression” in Vietnam, including pervasive state monitoring and criminal penalties for comments judged to “distort history” or threaten “national harmony.”

“Hosting the treaty in Hanoi sends a troubling signal about who will set the tone for enforcement,” Chima said. “It implicitly validates the idea that cyber governance and repression belong in the same space.”

Vietnamese officials counter that the country faces a surge in cyberattacks against strategic infrastructure and sees the pact as a tool for deterrence. “International cooperation is urgently needed,” said Le Xuan Minh, head of cybersecurity at the Ministry of Public Security.

Ethical hackers fear collateral damage

Another sticking point for civil society is uncertainty around whether “white hat” security research — penetration testing, vulnerability disclosure and code auditing — will be shielded. Without strong language distinguishing “good-faith hacking” from malicious exploits, research groups say governments could retaliate against those who uncover state-linked security flaws.

“Governments unhappy with disclosures could weaponize this treaty,” said a senior policy expert at a major Western tech firm. “That’s not hypothetical — it has happened before under narrower laws.”

The UNODC maintains the pact “encourages” states to permit legitimate research, but analysts point out the wording is non-binding.

While the final list of signatories is expected to be released only at the ceremony, the European Union and Canada have signaled their intention to join, saying last-minute language improvements secured at negotiations were sufficient to justify signature.

Whether the United States signs remains uncertain. The U.S. State Department declined to comment on attendance, reflecting internal divisions between national security officials, who favour faster digital evidence-sharing, and privacy advocates who fear expanded state reach.

China and Russia have strongly backed the convention, having pushed early drafts that prioritized “information stability” — language rights groups interpreted as code for controlling political dissent online. Some diplomats say the final text is more balanced than originally proposed but still wide enough to empower abuse.

Singapore’s cybersecurity authorities reported a sharp rise in cyber threats in 2024, with ransomware, outdated infrastructure vulnerabilities, and state-linked cyberattacks dominating the digital landscape. The findings were published on September 3 in the Singapore Cyber Landscape (SCL) 2024/2025, an annual report that not only reviews the previous year’s cybersecurity situation but also commemorates a decade of progress since the establishment of the Cyber Security Agency of Singapore (CSA) in 2015.

The report paints a picture of a small but digitally advanced nation grappling with the challenges of rapid digitalization while seeking to build a safer, more resilient cyberspace. Over the past ten years, Singapore has positioned itself as a regional leader in cybersecurity policy, innovation, and capacity building — but 2024 served as a reminder of the evolving and persistent threats that continue to test its defenses.

“The cyber threat landscape is becoming increasingly complex. Threat actors are not only more numerous but also more sophisticated, often state-linked and well-funded,” said a CSA spokesperson. “Singapore cannot afford complacency. Our focus must remain on building resilience, fostering public-private collaboration, and staying one step ahead of malicious actors.”

Rise of ransomware and legacy malware exploitation

One of the most concerning findings in the 2024 report was the marked increase in ransomware incidents and the exploitation of unpatched, legacy systems. Many attacks in 2024 were carried out using older malware strains, some of which had been identified and patched years ago.

This suggests a continuing challenge in promoting basic cyber hygiene practices among individuals, businesses, and even certain critical sectors. Despite heightened awareness campaigns, many organizations failed to update their software or implement layered security measures, leaving themselves open to ransomware schemes that encrypted data and demanded payments, often in cryptocurrency.

“Ransomware remains a lucrative business model for cybercriminals because it exploits the weakest links — outdated systems and poor patching practices,” the report noted.

Advanced persistent threats targeting strategic sectors

Beyond ransomware, Singapore faced continued targeting by Advanced Persistent Threat (APT) groups, which conduct stealthy, prolonged operations to compromise high-value networks. One such group highlighted in the report, UNC3886, has been actively focusing on strategic sectors, including Critical Information Infrastructure (CII), which encompasses energy, transport, and financial services.

APT activity in 2024 demonstrated increasing scale, sophistication, and persistence, aligning with global trends of cyber operations linked to geopolitical tensions. Singapore’s position as a major financial hub and technology innovator makes it an attractive target for cyber espionage and disruption campaigns.

CSA’s 10-year milestone

This edition of the SCL is particularly significant as it marks the 10th anniversary of the Cyber Security Agency of Singapore. Since its inception in 2015, CSA has overseen major national initiatives, from setting up sector-specific resilience frameworks to building a talent pipeline in cybersecurity.

To commemorate this milestone, the report includes Founders’ Stories — first-hand accounts from early CSA leaders detailing the agency’s formative years, the lessons learned from early cyber incidents, and how Singapore’s strategy evolved from reactive measures to a proactive, globally connected approach.

Over the past decade, CSA has also strengthened Singapore’s role in international cyber diplomacy, forming strategic alliances and participating in global threat intelligence sharing initiatives to counter transnational cybercrime.

C

hainalysis, a Singapore-based blockchain data platform, published a report, which claims that cryptocurrencies are used to finance terrorism. According to the research, in 2021, terrorist groups like Al-Qaeda and Daesh (ISIS) attempted to finance their operations by using cryptocurrencies. Experts consider providing funding to non-state actors and similar actions as “terrorism financing.”

According to the 2022 Crypto Crime Report, Al-Qaeda bought cryptocurrency in 2019 and 2020 via Facebook groups and Telegram channels. According to the report, the money services businesses (MSBs) which enabled some of these transactions were detected by the Federal Bureau of Investigation (FBI), Homeland Security Investigations (HSI), and Internal Revenue Service, Criminal Investigation (IRS-CI).

The al-Qassam Brigades, the military arm of Hamas, as a non-state actor collected more than $100,000 in donations in early 2021, the report claims. Additionally, the Israeli government confiscated a large portion of it from related MSBs in July.

How Non-state Actors Use Cryptocurrencies

The National Bureau for Counter Terror Financing (NBCTF) announced on June 30, 2021 that it confiscated cryptocurrencies from numerous wallets linked to Hamas-funding operations. This action comes after a long investigation into these activities. According to many media accounts, the operation followed a significant surge in bitcoin donations to the al-Qassam Brigades in May 2021 as a result of heightened fighting between Hamas and Israeli forces.

In recent years, Hamas has suffered financial woes due to the lack of cooperation between banks and the organization. To overcome its financial difficulties, in 2019, Hamas asked its supporters to donate in Bitcoin.

The NBCTF seized assets including Bitcoin, Ether, Tether, and XRP. According to the Chainalysis report, the seizure was made possible through a review of blockchain data and open-source intelligence (OSINT). This is the first cryptocurrency confiscation specifically targeting a non-state actor, containing a variety of digital currencies. 

The G20 Bali Summit, which took place on November 15-16, was expected to place a strong emphasis on the regulation of cryptocurrencies due to the rise in their use and in money laundering. The final declaration of the 17th meeting of the G20 gained a lot of attention as it called on the OECD to improve its commitment and monitoring of the widespread implementation of the Global Forum on Transparency and Exchange of Information for Tax Purposes. The declaration also welcomed the MSB’s approach to establishing a comprehensive international framework for the regulation of crypto assets and their activities based on the principle of “same activity, same risk, same regulation.”

Experts argue that governments and NGOs must provide quick answers when demanded and abide by regulations.

Daesh (ISIS) and Cryptocurrencies

Daesh’s use of cryptocurrency has constantly increased as the terrorist organization cannot use conventional financial transaction methods. Many MSB systems, such as PayPal and MoneyBeam, can be accessed globally, are used to transfer funds quickly, and, most importantly, it is difficult to identify the actual end-user.

Hence, terrorist groups are able to use shell companies and fast money transfer to move financial assets into their accounts. On the other hand, while there is a customer identification rule in traditional banking activities, MSBs offer legal loopholes as well. Terrorist groups can benefit from these loopholes to conduct transactions with anonymous accounts. Daesh realized this and started using PayPal and Bitcoin.

In 2017, U.S. citizen Zoobia Shanaz was charged with money laundering. Shanaz used cryptocurrencies, including Bitcoin, through stolen cards to support Daesh in Iraq and Syria, raising as much as $85,000. A review of the U.S. official sources on the investigation does not provide detailed information on how the fraud was perpetrated.

The report “Bitcoin and the Dark Web: The New Terrorist Threat” published in 2018 by Antonia Ward, a RAND Europe analyst, notes that Daesh raised funds using cryptocurrencies in 2014. The clearest evidence is that the list of weapons such as rockets, rifles, grenades, and other equipment were given with prices in cryptocurrency. A campaign called “Jahezona” was launched and Bitcoin QR codes were added.

On another occasion, Daesh launched advertisement campaigns by sharing Bitcoin addresses. The transactions that ensued took place on the dark web.

Similar to Daesh, Al-Qaeda has used cryptocurrencies. The year 2019 saw the solicitation of Bitcoin donations using a Telegram account called “Tawheed” and Jihad Media, which purportedly had ties to Al-Qaeda groups in Syria back then.

Al-Qaeda requested donations using the slogan “Fundraising Campaign – Finance Bullets and Rockets for the Mujahideen,” and supplied a Telegram account to contact for more information. Donations were requested via a variety of channels, including Bitcoin, Western Union, and PayPal.

As terrorist organizations quickly adapt to technological innovation for survival, eradicating them is becoming harder.

I

nterpol has conducted an operation against cyber-enabled financial crimes and money laundering. The operation, called “HAECHI III,” started in June and ended in November 2022.

Operation HAECHI III was planned by Interpol’s National Central Bureaus (NCBs), in particular the Interpol Financial Crime and Anti-Corruption Center (IFACC). The operation involved countries from Asia and Europe, including the United States, the United Kingdom, and Singapore. Hyun Se Lee, the head of NCB in Seoul, stated, “As we look to the future, we recognize the importance for decisive and concerted law enforcement action across borders. This year’s leg of Operation HAECHI III speaks volumes of IFCACC’s dedicated coordination and the strong commitment of participating countries, all of which foretell of new law enforcement victories ahead.”

Operation HAECHI III notably targeted illicit online gambling-related money laundering, investment fraud, sextortion, romance frauds, and voice phishing. Law enforcement agencies, Financial Intelligence Units (FIUs), asset recovery offices, prosecutors, and private sector financial experts joined forces for Operation HAECHI III in order to locate illicit cash and money mules, uncover money laundering activities, and deactivate related bank accounts.

Additionally, investigators noted an increase in fraudulent investment schemes that involve the use of instant messaging apps where encrypted information is shared and wallets for cryptocurrencies are promoted as a form of payment.

As a result of this long-running operation, 1,600 cases were solved and $130 million worth of virtual assets were seized. The operation also created an intervention tool entitled “Anti-Money Laundering Rapid Response Protocol (ARRP),” which allows countries to recover digital assets.

Anti-Money Laundering Rapid Response Protocol (ARRP)

Interpol has been trying for a long time to develop a new intervention tool to intervene in the flow of illicit funds, which plays an active role in the cybercriminal economy of countries. Finally, after months of pilot testing, it produced a tool called a “rapid intervention tool” in the fight against money laundering. According to Rory Corcoran, the director of the IFCACC, “The ARRP is a game-changer in the battle against global financial crime, where speed and international cooperation are critical to catching illicit monies before they vanish into the coffers of money mules abroad.”

Game-Changer Policies Help

The ARRP was used for the first time in Operation HAECHI III and it allows countries to work together to prevent the proceeds of crime. The seizure of 1.2 million euros obtained through commercial mail fraud in Ireland was strong evidence of the successful use of the ARRP during the operation.

Scenes from the Operation

Two Red Notice fugitives, who were wanted by Korea in an investigation for their alleged participation in a global Ponzi scheme, were apprehended in Greece and Italy after stealing 28 million euros from 2,000 Korean victims.

During the illegal transaction targeted by HAECHI II, victims were threatened by being told that their identity had been stolen or that their names were involved in narcotics crimes. They were then asked to transfer money under these pretexts.

Interpol reported that four bitcoin wallets used by con artists were seized, adding that a total of $159,000 had been transferred by victims of the call center scam. Over the course of the five-month operation, roughly 2,800 bank and virtual asset accounts that were being utilized to launder illegally obtained funds were shut down.

Operation HAECHI III provided strong evidence that the IFCACC will take the lead in Interpol’s efforts to provide operational support against money laundering related to virtual assets. The illicit use of virtual assets, especially cryptocurrencies, has advanced significantly in recent years and is now a common way to facilitate crime.

Cyber security is becoming an increasing issue for peoples as well governments with the rise of cyber-criminal acts across the globe.

“Stop what you’re doing and read this. This leak is going to be the story of the year,” wrote the eminent NSA whistleblower Edward Snowden last month as Amnesty International and Forbidden Stories obtained a leaked list of 50,000 phone numbers of potential targets of the Israeli spyware company, NSO Group.

NSO’s main service is Pegasus, a malware that infects iPhones and Android devices to enable the tool’s operators to extract messages, photos, and emails; record calls; and secretly activate microphones. The geographical scope of both NSO clients and victims seems limitless – from the Middle East to Europe, the U.S., Africa, East Asia, and Latin America. Traces of the Pegasus malware were most recently discovered on phones in the United Kingdom and France, amongst 45 other countries where the virus was found.

The company’s usual targets, which were revealed over the last few years, were mostly journalists, activists, and dissidents – some of whom ended up being tortured, arrested, killed, or forcibly disappeared as a consequence. However, the formidable, leaked list included some targets with unbelievable portfolios; NSO has moved from spying on journalists to spying on presidents, prime ministers, royalty, CEOs, and public figures. One of the most prominent highlights in the leaked list was France’s president Emmanuel Macron and Morocco’s king Mohammed VI.

This prompted the French government to demand an explanation from the Israeli government, which then hurried to send its defense minister to Paris for a few hours to assure France that Israel will take this issue seriously. The French National Agency for the Security of Information Systems has confirmed finding traces of Pegasus malware on the phone of a senior journalist in its state-owned international news network France24.

This latest revelation underlines one crucial conclusion: NSO is out of control. Its malicious hacking services, which are virtually unconstrained, have become a major security threat in cyberspace, and it has the full backing of an Israeli government willing to turn a blind eye to the company’s activities in order to bolster its regional and international relations.

Israel is an international hub for spyware companies whose main personnel almost always comes from the Israeli military.

Indeed, NSO is just the tip of the iceberg. Israel is an international hub for spyware companies whose main personnel almost always comes from the Israeli military, especially the Israeli Military Intelligence Unit 8200. The Israeli Defense Forces (IDF) have perfected a multitude of surveillance strategies as a result of their decades-long abuse of Palestinians in the Occupied Territories in flagrant violation of their right to privacy.

The Israeli government under Benjamin Netanyahu was even NSO’s patron, whereby it promoted and pushed its spyware sales across the world. Wherever Netanyahu traveled on official visits, deals between the visited country’s government and NSO followed – from Hungary to Mexico, India, Saudi Arabia, Morocco, the United Arab Emirates, Bahrain, and others.

This positions Israel as a force for regional and international destabilization where state-sanctioned – and state-sponsored – private spyware firms like NSO have been the informal arm of the Israeli government that are employed “off the record” to do the dirtiest work, such as espionage and interference in foreign countries.

This can also be seen in the activities of another Israeli cybersecurity firm, Psy-Group, which ran a $2 million voter suppression operation in support of Donald Trump’s 2016 campaign, according to the 2020 report of the U.S. Senate Select Committee on Intelligence. The operation was paid by George Nader, an advisor to de facto  UAE ruler Mohammed bin Zayed (MBZ).

The Israeli government’s complicity with NSO’s cyberweapons should raise more than eyebrows. Accountability is paramount. The very least Israel’s government should do is to immediately revoke NSO’s export license and ban spyware trade.

NSO does not only offer security, it also provides infectious viruses. It does not aim to make the world safer – with its Pegasus cyberattack tool, it aims to make it more vulnerable, more at risk, and more afraid. If NSO can hack into the phones of statesmen, parliamentarians, and CEOs, no phone is safe from its malware until action is taken.

In late December 2020, several of Silicon Valley’s most prominent giants, including Microsoft, Google, GitHub, and LinkedIn, asked to join Facebook’s lawsuit at a U.S. federal court against the infamous Israeli spyware firm NSO Group Technologies (“NSO” stands for Niv, Shalev, and Omri, the company’s founders).

The lawsuit, filed in 2019, seeks unspecified damages and demands that NSO be denied access to Facebook’s services after NSO has used highly sophisticated spyware called “Pegasus” to hack into the phones of at least 1,400 individuals at the request of government officials. This includes politicians, diplomats, activists, journalists, and dissidents, some of whom have been arrested, tortured, or murdered as a consequence.

Such a lawsuit by a U.S. tech giant against an Israeli spyware firm with close ties to the Israeli government is unprecedented. Facebook has been notorious in terms of taking Israel’s side and cracking down on Palestinian content. Facebook has been blocking posts and accounts of Palestinian activists critical of Israel or supportive of the resistance to its occupation, while overlooking Israeli incitement against Palestinians – a 2019 study found that Israelis incite hatred of Arabs on social media once every 66 seconds.

Last May, Facebook even hired a former Israeli government official and censorship expert on its Oversight Board, which determines what content to permit or water down.

The reasons why the social media giant along with the world’s biggest tech companies would suddenly sue a prominent Israeli company is clear: NSO is out of control. Its malicious hacking services, which are virtually unconstrained, have become a major security threat in cyberspace.

Aiding Arab Dictatorships and Brutal Regimes

A few days before other tech giants joined Facebook’s lawsuit last December, the cybersecurity watchdog, Citizen Lab, reported that NSO had hacked into the personal phones of 36 journalists, producers, anchors, and executives at the leading Arab media network Al-Jazeera.

Described as the largest concentration of phone hacks targeting a single organization, this NSO spyware operation was conducted on behalf of the governments of Saudi Arabia and the United Arab Emirates. It was less than a year after NSO falsely claimed that it will respect human rights and take steps to prevent its tools being used to commit abuses in the future.

NSO’s hack of Al-Jazeera’s phones was merely the latest incident on an extensive list of spyware attacks carried out with impunity by the Israeli firm whose operations are heavily surrounded by secrecy and conducted in the dark. For instance, a 2017 report called “Gobierno Espía” found that NSO stood behind at least 80 hacks between 2015 and 2016 that targeted high-profile Mexican journalists, lawyers, and activists who reported on or campaigned against corruption.

Mansoor’s arrest was shortly after his phone was hacked by NSO on behalf of the UAE’s repressive government, using what’s known as a “zero-day exploit.”

In 2017, an eminent human rights activist in the UAE, Ahmed Mansoor, was arrested by Emirati authorities and sentenced in a sham trial to 10 years in prison on the charge of “using social media platforms to threaten public order.” Ever since, Mansoor has been subjected to brutal treatment, such as denial of medical attention and imprisonment in solitary confinement for inhumanely long periods.

Mansoor’s arrest was shortly after his phone was hacked by NSO on behalf of the UAE’s repressive government, using what’s known as a “zero-day exploit,” a vulnerability unknown to the software owners that hackers can exploit to gain a backdoor access to someone’s device without their knowledge or actions, such as clicking on a spam link.

The Saudi government used NSO’s services to spy on and track the senior Saudi journalist and critic Jamal Khashoggi who was then mercilessly murdered at the Saudi consulate in Istanbul in 2018. In the same year, Amnesty International said that NSO was helping the Saudi regime to spy on a member of the organization’s staff.

Amnesty petitioned an Israeli court to revoke NSO’s export license given the damage it is causing; however, the court dismissed the case and argued that Israel’s Ministry of Defense maintains meticulous oversight procedures over defense exports. In October 2019, Facebook took preventative action and blocked the accounts of 100 NSO staff and their families. However, a Tel-Aviv court was quick to order Facebook to unblock some of those accounts.

Netanyahu’s Sacred Cow

So how does NSO wreak havoc freely, unconstrained, and with full impunity? Generally, Israel’s Ministry of Defense claims to maintain stringent criteria for issuing permits for the export of cyber intelligence technologies that come after a strenuous process of extreme vetting. Israel’s defense establishment claims that it then continues to oversee such projects even after a permit is issued. However, NSO is one of a number of cyber firms that get a free pass on their dangerous and destructive exports to repressive regimes.

Israel’s private spyware firms like NSO are the informal arm of Netanyahu’s government that are employed “off the record” to do the dirtiest work , such as espionage and interference in foreign countries. For instance, according to the 2020 report of the U.S. Senate Select Committee on Intelligence, an Israeli cyber intelligence firm, called Psy-Group, ran a $2 million voter suppression operation in support of Donald Trump’s 2016 campaign. The operation was paid by George Nader, an advisor to UAE de facto ruler Mohammed bin Zayed.

Similarly, NSO’s criminal and immoral operations have been an Israeli state-sanctioned bridge towards Israeli-Arab normalization with the UAE and Bahrain, two of the firm’s biggest clients. Recently, NSO helped the government of Morocco spy on a prominent Moroccan journalist a few months before official normalization between Israel and Morocco was announced.

Clearly, Israel’s cybersecurity industry is its competitive advantage to maintain relevance and significance in the international arena and gain the favor and support of client governments. However, with Israel unwilling to hold NSO to account, the company has become an unstoppable force of destruction; a tool that bolsters the power and hegemony of some of the world’s most repressive and brutal regimes; and a source of terror to activists who now fear that absolute cyber insecurity will become the region’s new normal.

Facebook’s lawsuit offers a glimmer of hope to stop NSO’s unconstrained assault on the right to privacy and security in cyberspace.