NSO in 2021 came under fire over the Pegasus Files, an investigation which revealed a list of 50,000 potential targets for hacking with its spyware, including world leaders as well as opposition politicians, human rights activists and journalists.
Foreign minister Jean Asselborn (LSAP) in July 2021 confirmed that the Israeli company had nine affiliated entities registered in Luxembourg: OSY Technologies, Q Cyber Technologies, Triangle Holdings, Square 2, Novalpina Capital Partners, Novalpina Capital Group, Northpole Holdco, NorthPole Bidco and NorthPole Newco.
Filings for seven of these entities show that between November last year and as recently as 4 January, new managers were appointed in London. An EU report published this week said that NSO also had a corporate presence in Cyprus, the Netherlands and Bulgaria.
Despite the move of management, the companies remain registered in Luxembourg, the filings show.
The Guardian reported that UK-based directors asked for servers and electronic files to be moved to London as soon as possible, but that a source indicated the changes had been made purely for administrative reasons and that the entities remained under Luxembourg jurisdiction.
EU inquiry
The alleged use of the Pegasus spyware by governments in Spain, Hungary and Poland is currently being investigated by the European Parliament. The European Data Protection Supervisor had previously suggested in the EU. This followed the Biden administration in November 2021 blacklisting NSO for engaging activities contrary to US foreign policy and national security.
NSO has denied wrongdoing, saying it sells the software only to vetted clients with the aim to fight crime and terrorism.
Luxembourg’s prime minister in October 2021 that the state had bought the controversial spyware. During an event he had said that “when we bought it, it was for reasons of state security.”
(DP) later said that he had spoken about this type of technology in general and not about Pegasus specifically. “For reasons of security and in order to protect investigations, it’s not possible to publish the details concerning technical equipment,” he said in answer to an urgent parliamentary question submitted after the event.
An investigative journalist from Hungary whose phone had been hacked with Pegasus after the story broke that countries like Luxembourg are complicit in the surveillance of reporters and human rights activists.
“When it comes to the role of those countries that are hosting the legal entities, they are also profiting from the profit that was made spying on journalists, political opponents, human rights defenders,” Szabolcs Panyi said.