White House Warns Hollywood Producer, Chewing Gum Magnate That Buying NSO Group Is Probably A Bad Idea

Let’s get this out of the way right up front: NSO Group — as ethically horrendous as it is — offers at least one unbeatable product. Its Pegasus malware is a zero-click exploit capable of fully compromising targets’ phones. This means the company is worth something, even if it’s not the sort of company most people would desire to keep (in both the business and the social sense of the phrase).

So, despite eighteen months or so of relentlessly negative press, NSO still has potential buyers. The latest batch is by far the weirdest, though.

Robert Simonds, a US financier whose credits include producing several Adam Sandler films, has been engaged in talks to acquire the blacklisted spyware company’s assets, according to multiple sources familiar with the matter.

A firm owned by Simonds’s friend, William “Beau” Wrigley – who was an heir to his family’s chewing gum fortune and has since become involved in the cannabis industry – has conducted due diligence in connection to a possible NSO deal, according to a document seen by the Guardian.

The last American suitor probably made more sense than this tag-team of a Sandler-enabler and a doubler of pleasure. That was L3Harris — one component of which is Harris Corporation, the manufacturer of highly controversial Stingray cell tower spoofers. An acquisition of controversial tech by a maker of controversial tech makes perverse sense, whereas a gum-and-movies duo doesn’t seem to provide quite the level of expertise needed to manage/exploit a company that has spent most of its existence operating in “rogue” mode.

However, these buyers do seem to have at least one idea of what to do with this toxic asset, not that it’s necessarily a good idea:

One possible option being mulled by Simonds, sources suggest, would involve buying out remaining debt holders and other creditors and stripping assets like Pegasus – NSO’s key hacking tool – out of NSO and transferring it into a new company.

Basically, an attempt to launder NSO’s reputation by removing the “NSO” part of it and replacing it with a name that won’t (immediately) generate abysmal Google search results.

But there’s another problem here that might be more difficult to tackle. NSO has been blacklisted by the US Commerce Department, which means this acquisition would be, at best, ill-advised. That’s the message being sent by the Biden Administration, which strongly suggests Simonds and Wrigley spend their money on something else.

The Guardian contacted the National Security Council to ask how the administration would respond to the takeover of NSO assets by a US citizen. An NSC spokesperson said in a statement that the Biden-Harris administration remained concerned that the proliferation of tools like those produced by NSO Group posed a “serious counterintelligence and security risk to US personnel and systems”.

“Any US company should be aware that a transaction with a foreign entity on the entity list will not automatically remove the designated entity from the entity list. It may also prompt a review of whether the acquisition gives rise to a counterintelligence threat to the US government and its systems and information, whether other US equities may be at risk, and to what extent a foreign entity or government retains a degree of access or control,” the spokesperson said.

The NSC isn’t saying this can’t be done. It’s saying it most likely can’t be done. If Simonds et al want to roll the dice on this acquisition, they’re going to be spending a lot of time interacting with the US government (which is opposed to this transaction) and the Israeli government (which is also likely opposed to this transaction, but for different regulatory reasons).

Is NSO worth the trouble? Possibly. But the possibility of making a profit off Pegasus declines with every passing day. NSO doesn’t appear to be able to turn a profit when it can’t sell to human rights abusers. And whatever flaws Pegasus currently exploits will eventually be patched out of existence. Rebranding it post-acquisition won’t make those problems go away.