In addition to OSY Technologies and Q Cyber Technologies, seven other NSO affiliates are active in Luxembourg, including Triangle Holdings, Square 2, Novalpina Capital Partners, Novalpina Capital Group, Northpole Holdco, NorthPole Bidco and NorthPole Newco, the ministry said on Tuesday.

The ministy did not provide details on the areas of business that the different entities are active in but said that none of them was authorised to export cyber-surveillance products from Luxembourg.

“It is important for me to express to you my great concern over the alleged acts of espionage against, in particular, human rights defenders, journalists or political leaders and to remind you of the Luxembourg normative framework in which you operate,” Asselborn said in a letter to the NSO entities published on Wednesday.

A consortium of 80 journalists from ten countries--dubbed the Pegasus Project--on Monday claimed that 50,000 phone numbers were selected as potential targets of NSO phone hacking spyware.

The Israeli company behind the technology, NSO, has said it only sells its product to carefully vetted government clients who are only permitted to use them in legitimate investigations, for example in cases of terrorism and crime. In a on 21 July, it said it would no longer respond to media requests related to the revelations, calling them “a vicious and slanderous campaign.” 

The NSO spyware was previously linked to the murder of journalist Jamal Khashoggi but Asselborn at a press conference in 2019 said Luxembourg would not investigate the company. “We need to be able to prove it. In this case nobody could prove to us that this was the case,” he said.

The case led to renewed calls for legislation in Luxembourg. The country is vying for a seat on the UN Human Rights Council that will open up later this year.

“We call on you to refrain from any decision-making that could lead to an illicit use of the goods and technologies that you make available to your customers,” Asselborn warned the nine NSO subsidiaries.

Luxembourg is closely following the case, the foreign minister warned, asking the entities to respond to the allegations.

“Luxembourg will not, under any circumstances, tolerate that export operations from Luxembourg contribute to human rights violations in third countries and will ensure, if applicable, to take the necessary measures to remedy any violation of human rights and to prevent future violations,” Asselborn said.