Cyberweapons manufacturers plot to stay on the right side of the United States

Featured Sponsor

Store	Link	Sample Product
UK Artful Impressions	Premiere Etsy Store

In the summer of 2019, as Paragon Solutions was building one of the most powerful cyberweapons in the world, the company made a prescient decision: Before courting a single customer, it’s best to sideline the Americans.

The Israeli start-up had seen local rival NSO Group, makers of the controversial Pegasus spyware, fall foul of the Biden administration and be blacklisted in the United States. So Paragon sought guidance from top American advisors, secured funding from US venture capital groups, and eventually landed a prime client that eludes its competition: the US government.

Interviews with a half-dozen industry figures about the two companies’ divergent trajectories underscore how the shadowy spyware industry is reshaping itself around those who are pro-American interests.

According to four of these people, the US Drug Enforcement and Administration Agency is a major customer of Paragon’s flagship product, dubbed Graphite.

The malware stealthily pierces the protections of modern smartphones and evades the encryption of messaging apps like Signal or WhatsApp, sometimes harvesting data from cloud backups, just like Pegasus does.

Paragon was established by Ehud Schneorson, the retired commander of Unit 8200, the Israeli military’s elite signals intelligence arm. According to people familiar with the company, which includes former Prime Minister Ehud Barak on its board, it has secured investments from two US-based venture capital firms, Battery Ventures and Red Dot.

Paragon, Barak, Battery Ventures and Red Dot declined to comment.

In 2019, even before work on Graphite was completed, on the advice of a senior retired Mossad official, Paragon hired Washington DC-based WestExec Advisors, the influential advisory group made up of former Obama White House officials including Michele Flournoy, Avril Haines and Antony Blinken. Former US ambassador to Israel, Dan Shapiro, was also consulted, people familiar with the consultative effort said. Shapiro declined to comment.

WestExec said it had “advised Paragon on its strategic approach to the US and European markets as well as the formulation of its industry-leading ethical commitments designed to ensure the appropriate use of its technology,” adding that it was “proud of our contributions in these critical areas”.

Following Democratic President Joe Biden’s election in 2021, Blinken was named secretary of state, while Haines is now director of national intelligence. Both had left WestExec at the time of the Paragon contract, the lobbying firm said. Flournoy – once considered in the running to lead the defense department – remains an influential voice on US foreign affairs.

American approval, even if indirect, has been at the heart of Paragon’s strategy. The company sought a list of allied nations that the United States would not object to seeing Graphite deployed. Those familiar with the matter have suggested that 35 countries were on that list, though the exact nations involved could not be determined. Most were in the EU and some in Asia, people said.

“All they did was with the strategy that at the end of the day, the United States should see them as the good guys,” said one person familiar with the decisions.

This contrasts with NSO’s recent problems. In 2019, assisted by Prime Minister Benjamin Netanyahu’s regional diplomacy, NSO was a $1 billion company selling its products in Saudi Arabia, Mexico and dozens of other countries.

When the Biden administration took office, NSO’s lucrative clients were proving to be its Achilles heel, as many of those regimes continued to deploy the multimillion-dollar weapon against journalists, dissidents and opposition leaders.

As evidence of the abuse spreads, such as the target US diplomats in Uganda in 2021, NSO found itself in the crosshairs of both the US government and the world’s largest technology companies. Meta, owner of Apple and WhatsApp, sued him.

“There is a growing sense that this particular type of malware is so invasive, so surreptitious that its proliferation poses both a human rights risk and a counterintelligence risk to the United States,” said Stephen Feldstein, who studied the spread of spyware such as Pegasus and Graphite for the Carnegie Endowment.

For nearly a decade, the only restriction for some of the biggest spyware makers has been Israeli export controls, which regulate malware like Pegasus as weapons. Feldstein said Israeli officials “make decisions about geopolitical solutions, not human rights violations.”

Paragon’s founders, however, were more sensitive to the increasingly dark view the United States was taking on the proliferation of cyberweapons.

After NSO’s malware was traced to the phones of associates of assassinated Saudi columnist Jamal Khashoggi, Paragon refused Israeli government requests to replace Pegasus with Graphite in the Saudi armory, according to two people familiar with the issue.

Paragon’s decision to avoid a valuable Saudi contract finally paid off. Two other Israeli firms, Quadream and Candiru, which have sold similar hacking capabilities to the Saudi government, were sued by Microsoft and rights group Citizen Lab after their malware was used on journalists and dissidents. Candiru was blacklisted alongside NSO in November 2021. Quadream recently halted operations, Israeli newspaper Calcalist reported.

The United States has stepped further to reshape the spyware market to favor those who sell cyberweapons to the United States and its allies, while curbing those chasing lucrative contracts with authoritarian regimes.

President Joe Biden signed a executive orderMs March by prohibiting any US agency from purchasing spyware that “poses national security risks or has been misused by foreign actors to enable human rights abuses around the world.”

The wording of the executive order is seen by pundits as targeting NSO, while carving out space for companies like Paragon to continue selling similar spyware, but only to the United States’ closest allies. The US expectation – as yet unproven – is that friendly nations are less likely to abuse such a weapon on civil society or to spy on US government officials deployed abroad.

“It’s really showing that the United States believes that many of these types of tools are illegal,” said David Kaye, who as the United Nations’ rapporteur on freedom of expression has spent years trying to hold the NSO group accountable for the abuse of its spyware customers. “And if the proliferation of these tools is a national security issue, then that really changes the conversation from the human rights issue.”

NSO said it “doesn’t believe its positioning on the [US Commerce Department blacklist] has never been justified,” adding: “ironically, other cyber intelligence companies that are not subject to the list sell to countries without any regulatory structure and that NSO refuses to make sales [to].”

However, the DEA’s purchase of Graphite, reportedly only for use by its partners in Mexico to help fight drug cartels, has begun to garner attention. The DEA said it was using “every legal investigative tool available to prosecute the foreign-based cartels and individuals operating around the world responsible for the drug poisoning deaths of 107,735 Americans last year.”

Congressman Adam Schiff, chairman of the House Intelligence Committee, wrote to the DEA in December asking for more details on the purchase. Mexico is among the worst users of NSO’s Pegasus, purchased almost a decade ago.

Schiff wrote: “such use [of spyware] could have potential implications for US national security, as well as run counter to efforts to discourage the widespread proliferation of powerful surveillance capabilities against autocratic regimes and others who may abuse them.”