{ "schema_version": "1.0", "target_id": "qcyber", "language": "en", "nodes": [ { "id": "qcyber", "name": "Q Cyber Technologies Ltd", "type": "organization", "role": "", "period": "", "group": "subject", "claim_ids": [ "c-id-incorporation", "c-id-register", "c-id-address-2019", "c-id-shared-address", "c-id-website-2019", "c-id-group-role", "c-id-same-ceo", "c-id-ngtp-sesame", "c-id-ngtp-sesame-register", "c-id-courts-collective", "c-str-qcyber-into-chain", "c-str-fs-note", "c-str-osy-incorporation", "c-str-qcyber-director-nso", "c-str-nso-shareholders-2019", "c-str-treasury-shares", "c-str-qcyber-return-2019", "c-str-iota", "c-str-pega-merger", "c-tax-appeal", "c-tax-shelf", "c-tax-repayments", "c-tax-assessing-position", "c-tax-findings", "c-tax-acquirer-doubt", "c-tax-outcome", "c-tax-lavie-testimony", "c-tax-2019-sale", "c-buy-chain-april-2019", "c-buy-fara-chain", "c-brg-qcyber-suit", "c-brg-qcyber-suit-background", "c-brg-objection", "c-wa-complaint", "c-wa-default", "c-wa-motion-dismiss", "c-wa-ninth-circuit", "c-wa-supreme-court", "c-wa-liability", "c-wa-verdict", "c-wa-remittitur", "c-wa-injunction", "c-wa-appeals", "c-wa-contempt", "c-wa-us-use-argument", "c-wa-declarants", "c-us-apple", "c-us-apple-outcome", "c-us-dada-filing", "c-us-dada-2024", "c-us-dada-appeal", "c-us-dada-2026", "c-us-khashoggi", "c-us-khashoggi-structure", "c-exp-fara", "c-exp-mercury-press", "c-exp-lobbying", "c-exp-bulgaria-cyprus", "c-exp-circles-licences-2026", "c-cus-sovereign", "c-ppl-shohat", "c-rel-westbridge", "c-rel-westbridge-ownership" ], "badges": [ { "label": "WhatsApp suit: liability, jury verdict and permanent injunction (2025; punitive award reduced, on appeal)", "claim_ids": [ "c-wa-liability", "c-wa-verdict", "c-wa-remittitur", "c-wa-injunction", "c-wa-appeals" ], "category": "CIVIL_LITIGATION", "code": "A1", "subject_id": "qcyber" }, { "label": "Apple suit (2021; voluntarily dismissed by Apple in 2024)", "claim_ids": [ "c-us-apple", "c-us-apple-outcome" ], "category": "CIVIL_LITIGATION", "code": "A2", "subject_id": "qcyber" }, { "label": "El Faro journalists' suit (2022; dismissed for lack of personal jurisdiction in 2026)", "claim_ids": [ "c-us-dada-filing", "c-us-dada-2026" ], "category": "CIVIL_LITIGATION", "code": "A3", "subject_id": "qcyber" }, { "label": "Hanan Elatr Khashoggi's suit (2023; dismissed)", "claim_ids": [ "c-us-khashoggi" ], "category": "CIVIL_LITIGATION", "code": "A4", "subject_id": "qcyber" }, { "label": "Tax appeal dismissed: payments to the foreign parent taxed as dividends (July 2026)", "claim_ids": [ "c-tax-findings", "c-tax-outcome" ], "category": "ENFORCEMENT", "code": "A6", "subject_id": "qcyber" } ], "subtype": "company", "jurisdiction": "il" }, { "id": "nso", "name": "NSO Group Technologies Ltd", "type": "organization", "role": "", "period": "", "group": "group_companies", "claim_ids": [ "c-id-address-2019", "c-id-shared-address", "c-id-nso", "c-id-website-2019", "c-id-group-role", "c-id-same-ceo", "c-id-courts-collective", "c-str-osy-agreement", "c-str-qcyber-into-chain", "c-str-fs-note", "c-str-fp-confirmation", "c-str-triangle-square2", "c-str-triangle-subscribers", "c-str-triangle-split", "c-str-qcyber-director-nso", "c-str-nso-shareholders-2019", "c-str-treasury-shares", "c-str-price", "c-str-blackstone-2017", "c-str-pega-merger", "c-tax-repayments", "c-tax-findings", "c-tax-acquirer-doubt", "c-tax-lavie-testimony", "c-tax-2019-sale", "c-buy-announcement", "c-buy-complaint-account", "c-buy-fp-exit", "c-buy-terms", "c-buy-tracking-shares", "c-buy-triangle-reroute", "c-buy-triangle-board-dec-2019", "c-buy-novalpina-role", "c-buy-emerald-diamond", "c-buy-goatilev", "c-buy-moodys", "c-buy-lenders", "c-brg-takeover", "c-brg-investigations", "c-brg-board-control", "c-brg-revenue", "c-brg-financial-crisis", "c-brg-convexum", "c-brg-sale-offers", "c-brg-information-dispute", "c-brg-schmidt", "c-brg-objection", "c-ctl-foreclosure-2023", "c-ctl-press-2023", "c-ctl-simonds-2023", "c-ctl-us-investors-2025", "c-ctl-founders-out", "c-ctl-debt-purchase", "c-ctl-friedman-appointment", "c-ctl-transparency-2025", "c-ctl-friedman-statements", "c-lux-distributor", "c-lux-sales-hub", "c-lux-seven-entities", "c-wa-complaint", "c-wa-default", "c-wa-motion-dismiss", "c-wa-ninth-circuit", "c-wa-supreme-court", "c-wa-liability", "c-wa-verdict", "c-wa-remittitur", "c-wa-injunction", "c-wa-appeals", "c-wa-contempt", "c-wa-us-use-argument", "c-wa-declarants", "c-us-apple", "c-us-apple-outcome", "c-us-dada-filing", "c-us-dada-2024", "c-us-dada-appeal", "c-us-dada-2026", "c-us-khashoggi", "c-us-khashoggi-structure", "c-oc-boye-madrid", "c-oc-spain-high-court", "c-oc-uk-criminal-complaint", "c-oc-france", "c-oc-thailand-bahrain", "c-oc-israel-abdulaziz", "c-oc-israel-employee", "c-oc-malekar", "c-exp-deca-regime", "c-exp-mod-2021", "c-exp-lobbying", "c-exp-entity-list", "c-exp-entity-list-current", "c-exp-csl", "c-exp-delisting-efforts", "c-exp-congress-letter", "c-exp-transparency", "c-exp-lux-no-licence", "c-exp-lux-2026", "c-exp-bulgaria-cyprus", "c-exp-bulgaria-entities", "c-exp-circles-licences-2026", "c-exp-ngo-letter-2019", "c-cus-sovereign", "c-cus-ghana", "c-cus-eu-22", "c-cus-poland", "c-cus-hungary", "c-cus-germany", "c-cus-luxembourg", "c-cus-denials", "c-cus-spain", "c-cus-estonia-greece", "c-cus-saudi-uae", "c-cus-morocco", "c-cus-panama", "c-cus-attribution-14", "c-cus-cyprus", "c-cus-ability", "c-ppl-founders", "c-ppl-hulio-ceo", "c-ppl-hulio-dream", "c-ppl-hulio-black-cube", "c-ppl-gorev", "c-ppl-asher-levy", "c-ppl-shohat", "c-ppl-somekh-dumont", "c-ppl-triangle-holders-2021", "c-ppl-bec", "c-ppl-bash", "c-rel-westbridge", "c-rel-westbridge-sales", "c-rel-westbridge-ownership", "c-rel-convexum", "c-rel-pfos", "c-rel-footprint", "c-rel-mubadala" ], "badges": [ { "label": "WhatsApp suit: liability, jury verdict and permanent injunction (2025; punitive award reduced, on appeal)", "claim_ids": [ "c-wa-liability", "c-wa-verdict", "c-wa-remittitur", "c-wa-injunction", "c-wa-appeals" ], "category": "CIVIL_LITIGATION", "code": "A1", "subject_id": "nso" }, { "label": "Apple suit (2021; voluntarily dismissed by Apple in 2024)", "claim_ids": [ "c-us-apple", "c-us-apple-outcome" ], "category": "CIVIL_LITIGATION", "code": "A2", "subject_id": "nso" }, { "label": "El Faro journalists' suit (2022; dismissed for lack of personal jurisdiction in 2026)", "claim_ids": [ "c-us-dada-filing", "c-us-dada-2026" ], "category": "CIVIL_LITIGATION", "code": "A3", "subject_id": "nso" }, { "label": "Hanan Elatr Khashoggi's suit (2023; dismissed)", "claim_ids": [ "c-us-khashoggi" ], "category": "CIVIL_LITIGATION", "code": "A4", "subject_id": "nso" }, { "label": "US Entity List designation (November 2021; in force in 2026)", "claim_ids": [ "c-exp-entity-list", "c-exp-entity-list-current" ], "category": "SANCTIONS", "code": "A5", "subject_id": "nso" }, { "label": "Criminal complaint filed in the UK by four individuals (September 2024; no outcome recorded)", "claim_ids": [ "c-oc-uk-criminal-complaint" ], "category": "CRIMINAL_PROCEEDINGS", "code": "A8", "subject_id": "nso" }, { "label": "Reported financial difficulties after 2021 (party statement and press)", "claim_ids": [ "c-brg-financial-crisis", "c-brg-revenue" ], "category": "FINANCIAL_DISTRESS", "code": "A12", "subject_id": "nso" }, { "label": "Suits filed in Israel (2018), Madrid (2022) and Thailand (2022)", "claim_ids": [ "c-oc-israel-abdulaziz", "c-oc-boye-madrid", "c-oc-thailand-bahrain" ], "category": "CIVIL_LITIGATION", "code": "A14", "subject_id": "nso" } ], "subtype": "company", "jurisdiction": "il" }, { "id": "ngtp", "name": "NGTP Ltd", "type": "organization", "role": "", "period": "", "group": "group_companies", "claim_ids": [ "c-id-ngtp-sesame", "c-id-ngtp-sesame-register" ], "badges": [], "subtype": "company", "jurisdiction": "il" }, { "id": "sesame", "name": "S. Sesame Technology Ltd", "type": "organization", "role": "", "period": "", "group": "group_companies", "claim_ids": [ "c-id-ngtp-sesame", "c-id-ngtp-sesame-register" ], "badges": [], "subtype": "company", "jurisdiction": "il" }, { "id": "goatilev", "name": "Goatilev Ltd.", "type": "organization", "role": "", "period": "", "group": "group_companies", "claim_ids": [ "c-buy-emerald-diamond", "c-buy-goatilev" ], "badges": [], "subtype": "company", "jurisdiction": "il" }, { "id": "convexum", "name": "Convexum Ltd.", "type": "organization", "role": "", "period": "", "group": "group_companies", "claim_ids": [ "c-brg-convexum", "c-brg-sale-offers", "c-exp-bulgaria-cyprus", "c-rel-convexum" ], "badges": [], "subtype": "company", "jurisdiction": "il" }, { "id": "pfos", "name": "PFOS Technologies Limited", "type": "organization", "role": "", "period": "", "group": "group_companies", "claim_ids": [ "c-rel-pfos" ], "badges": [], "subtype": "company", "jurisdiction": "gb" }, { "id": "westbridge", "name": "Westbridge Technologies, Inc.", "type": "organization", "role": "", "period": "", "group": "group_companies", "claim_ids": [ "c-buy-chain-april-2019", "c-lux-osy-loans-out", "c-lux-pledges", "c-lux-newco-forbearance", "c-wa-westbridge-motion", "c-us-khashoggi-structure", "c-rel-westbridge", "c-rel-westbridge-sales", "c-rel-westbridge-ownership" ], "badges": [], "subtype": "company", "jurisdiction": "us" }, { "id": "shapes1", "name": "Shapes 1 BV", "type": "organization", "role": "", "period": "", "group": "historical", "claim_ids": [ "c-rel-footprint" ], "badges": [], "subtype": "shell", "jurisdiction": "nl" }, { "id": "shapes2", "name": "Shapes 2 BV", "type": "organization", "role": "", "period": "", "group": "historical", "claim_ids": [ "c-rel-footprint" ], "badges": [], "subtype": "shell", "jurisdiction": "nl" }, { "id": "circles", "name": "Circles", "type": "group", "role": "", "period": "", "group": "counterparties", "claim_ids": [ "c-str-triangle-board-2019", "c-str-circles", "c-str-iota", "c-str-pega-merger", "c-exp-bulgaria-entities", "c-exp-circles-licences-2026" ], "badges": [], "subtype": "company" }, { "id": "iota", "name": "IOTA Holdings Ltd.", "type": "organization", "role": "", "period": "", "group": "group_companies", "claim_ids": [ "c-str-iota", "c-buy-chain-april-2019", "c-lux-iota-note", "c-lux-pledges", "c-exp-bulgaria-entities" ], "badges": [], "subtype": "shell", "jurisdiction": "cy" }, { "id": "osy", "name": "OSY Technologies S.à r.l.", "type": "organization", "role": "", "period": "", "group": "group_companies", "claim_ids": [ "c-str-osy-agreement", "c-str-qcyber-into-chain", "c-str-fs-note", "c-str-chain-fp", "c-str-osy-incorporation", "c-str-triangle-square2", "c-str-qcyber-return-2019", "c-str-price", "c-str-circles", "c-str-iota", "c-tax-repayments", "c-tax-findings", "c-tax-acquirer-doubt", "c-tax-outcome", "c-buy-chain-april-2019", "c-buy-register-2019", "c-buy-fara-chain", "c-buy-boards-april-2019", "c-buy-novalpina-role", "c-ctl-foreclosure-2023", "c-ctl-newco-pledge-2023", "c-ctl-lavie-mandates-2023", "c-ctl-debt-purchase", "c-ctl-osy-oct-2025", "c-ctl-lux-press-2026", "c-ctl-friedman-appointment", "c-lux-qcl-identity", "c-lux-trademarks", "c-lux-osy-identity", "c-lux-osy-managers", "c-lux-dividends-loan", "c-lux-osy-finances", "c-lux-osy-aggregator", "c-lux-iota-note", "c-lux-osy-loans-out", "c-lux-pledges", "c-lux-newco-finances", "c-lux-newco-aggregator", "c-lux-seven-entities", "c-wa-complaint", "c-wa-motion-dismiss", "c-us-apple", "c-oc-boye-madrid", "c-oc-barcelona-2025", "c-exp-lobbying", "c-exp-bulgaria-entities", "c-ppl-gorev", "c-ppl-anthony-levy", "c-ppl-bec", "c-ppl-flynn", "c-rel-westbridge-ownership" ], "badges": [ { "label": "Negative equity in the 2021-2024 accounts", "claim_ids": [ "c-lux-osy-finances", "c-lux-osy-aggregator" ], "category": "FINANCIAL_DISTRESS", "code": "A13", "subject_id": "osy" } ], "subtype": "company", "jurisdiction": "lu" }, { "id": "qcyber-lux", "name": "Q Cyber Technologies S.à r.l.", "type": "organization", "role": "", "period": "", "group": "group_companies", "claim_ids": [ "c-buy-chain-april-2019", "c-ctl-lavie-mandates-2023", "c-ctl-debt-purchase", "c-ctl-qcl-oct-2025", "c-ctl-lux-press-2026", "c-lux-qcl-identity", "c-lux-trademarks", "c-lux-distributor", "c-lux-qcl-results", "c-lux-dividends-loan", "c-lux-seven-entities", "c-oc-boye-madrid", "c-oc-barcelona-2025", "c-oc-uk-criminal-complaint", "c-exp-lux-no-licence", "c-exp-circles-licences-2026", "c-ppl-gorev", "c-ppl-anthony-levy", "c-ppl-somekh-dumont", "c-ppl-de-maigret" ], "badges": [ { "label": "Criminal complaint filed in the UK by four individuals (September 2024; no outcome recorded)", "claim_ids": [ "c-oc-uk-criminal-complaint" ], "category": "CRIMINAL_PROCEEDINGS", "code": "A8", "subject_id": "qcyber-lux" } ], "subtype": "company", "jurisdiction": "lu" }, { "id": "square2", "name": "Square 2 S.à r.l.", "type": "organization", "role": "", "period": "", "group": "group_companies", "claim_ids": [ "c-str-triangle-square2", "c-buy-chain-april-2019", "c-buy-register-2019", "c-buy-fara-chain", "c-buy-boards-april-2019", "c-buy-triangle-reroute", "c-lux-uk-branches", "c-lux-seven-entities" ], "badges": [ { "label": "Winding-up orders against the UK establishment (May 2024)", "claim_ids": [ "c-lux-uk-branches" ], "category": "FINANCIAL_DISTRESS", "code": "A11", "subject_id": "square2" } ], "subtype": "shell", "jurisdiction": "lu" }, { "id": "triangle", "name": "Triangle Holdings S.A.", "type": "organization", "role": "", "period": "", "group": "group_companies", "claim_ids": [ "c-str-osy-agreement", "c-str-qcyber-into-chain", "c-str-chain-fp", "c-str-fp-confirmation", "c-str-triangle-square2", "c-str-triangle-dec2014", "c-str-triangle-subscribers", "c-str-triangle-split", "c-str-triangle-board-2014", "c-str-triangle-board-2019", "c-buy-fp-exit", "c-buy-chain-april-2019", "c-buy-fara-chain", "c-buy-triangle-articles", "c-buy-boards-april-2019", "c-buy-triangle-reroute", "c-buy-triangle-board-dec-2019", "c-buy-novalpina-role", "c-brg-board-control", "c-brg-triangle-directors", "c-brg-convexum", "c-brg-schmidt", "c-brg-triangle-uk-2023", "c-lux-triangle-identity", "c-lux-uk-branches", "c-lux-seven-entities", "c-ppl-triangle-holders-2021", "c-rel-westbridge-ownership" ], "badges": [ { "label": "Winding-up orders against the UK establishment (May 2024)", "claim_ids": [ "c-lux-uk-branches" ], "category": "FINANCIAL_DISTRESS", "code": "A11", "subject_id": "triangle" } ], "subtype": "company", "jurisdiction": "lu" }, { "id": "northpole-holdco", "name": "NorthPole Holdco S.à r.l.", "type": "organization", "role": "", "period": "", "group": "historical", "claim_ids": [ "c-buy-chain-april-2019", "c-buy-register-2019", "c-buy-fara-chain", "c-buy-holdco-luxco", "c-buy-holdco-register", "c-buy-tracking-shares", "c-buy-triangle-articles", "c-buy-triangle-reroute" ], "badges": [], "subtype": "shell", "jurisdiction": "lu" }, { "id": "northpole-bidco", "name": "NorthPole Bidco S.à r.l.", "type": "organization", "role": "", "period": "", "group": "group_companies", "claim_ids": [ "c-buy-chain-april-2019", "c-buy-register-2019", "c-buy-triangle-articles", "c-buy-emerald-diamond", "c-buy-goatilev", "c-lux-seven-entities" ], "badges": [], "subtype": "shell", "jurisdiction": "lu" }, { "id": "northpole-newco", "name": "NorthPole Newco S.à r.l.", "type": "organization", "role": "", "period": "", "group": "group_companies", "claim_ids": [ "c-buy-chain-april-2019", "c-buy-register-2019", "c-buy-emerald-diamond", "c-buy-loan", "c-buy-moodys", "c-buy-lenders", "c-brg-makarenko-register", "c-ctl-foreclosure-2023", "c-ctl-dufresne-register", "c-ctl-newco-pledge-2023", "c-ctl-lavie-mandates-2023", "c-ctl-debt-purchase", "c-ctl-newco-oct-2025", "c-ctl-pledge-dec-2025", "c-ctl-sale-back-dec-2025", "c-ctl-lux-press-2026", "c-lux-osy-finances", "c-lux-pledges", "c-lux-newco-finances", "c-lux-newco-forbearance", "c-lux-newco-aggregator", "c-lux-seven-entities", "c-ppl-anthony-levy", "c-ppl-somekh-dumont" ], "badges": [ { "label": "Loan defaults, forbearance (2021) and enforcement of the share pledge by the lenders (2023)", "claim_ids": [ "c-buy-moodys", "c-lux-newco-forbearance", "c-ctl-foreclosure-2023" ], "category": "FINANCIAL_DISTRESS", "code": "A10", "subject_id": "northpole-newco" } ], "subtype": "company", "jurisdiction": "lu" }, { "id": "emerald", "name": "Emerald LIE", "type": "organization", "role": "", "period": "", "group": "historical", "claim_ids": [ "c-buy-emerald-diamond", "c-ppl-somekh-dumont" ], "badges": [], "subtype": "shell" }, { "id": "diamond", "name": "Diamond LIE", "type": "organization", "role": "", "period": "", "group": "historical", "claim_ids": [ "c-buy-emerald-diamond", "c-ctl-foreclosure-2023", "c-ctl-dufresne-register", "c-ctl-lavie-mandates-2023", "c-ppl-somekh-dumont" ], "badges": [], "subtype": "shell" }, { "id": "dufresne", "name": "Dufresne Holding S.à r.l.", "type": "organization", "role": "", "period": "", "group": "group_companies", "claim_ids": [ "c-ctl-foreclosure-2023", "c-ctl-dufresne-register", "c-ctl-lavie-mandates-2023", "c-ctl-press-2023", "c-ctl-simonds-2023", "c-ctl-newco-oct-2025", "c-lux-seven-entities" ], "badges": [], "subtype": "shell", "jurisdiction": "lu" }, { "id": "osy-holdings", "name": "OSY Holdings Ltd.", "type": "organization", "role": "", "period": "", "group": "historical", "claim_ids": [ "c-str-fp-confirmation", "c-str-osy-incorporation", "c-str-triangle-square2", "c-str-triangle-dec2014", "c-str-triangle-split", "c-buy-fp-exit", "c-buy-boards-april-2019", "c-ppl-triangle-holders-2021", "c-rel-westbridge-ownership" ], "badges": [], "subtype": "shell", "jurisdiction": "ky" }, { "id": "hippocrene", "name": "Hippocrene Ventures LLC", "type": "organization", "role": "", "period": "", "group": "historical", "claim_ids": [ "c-ctl-pledge-dec-2025", "c-ctl-sale-back-dec-2025", "c-ctl-lux-press-2026" ], "badges": [], "subtype": "company", "jurisdiction": "us" }, { "id": "francisco", "name": "Francisco Partners", "type": "organization", "role": "", "period": "", "group": "historical", "claim_ids": [ "c-str-osy-agreement", "c-str-chain-fp", "c-str-fp-confirmation", "c-str-triangle-square2", "c-str-triangle-split", "c-str-price", "c-str-blackstone-2017", "c-str-circles", "c-str-pega-merger", "c-tax-lavie-testimony", "c-tax-2019-sale", "c-buy-announcement", "c-buy-complaint-account", "c-buy-fp-exit", "c-buy-terms", "c-buy-lenders", "c-ctl-press-2023", "c-exp-ngo-letter-2019", "c-ppl-gorev", "c-ppl-bec", "c-ppl-bash", "c-ppl-flynn", "c-ppl-francisco", "c-rel-westbridge", "c-rel-westbridge-ownership" ], "badges": [], "subtype": "company", "jurisdiction": "us" }, { "id": "novalpina", "name": "Novalpina Capital", "type": "organization", "role": "", "period": "", "group": "historical", "claim_ids": [ "c-buy-announcement", "c-buy-terms", "c-buy-chain-april-2019", "c-buy-triangle-reroute", "c-buy-novalpina-role", "c-buy-lenders", "c-brg-takeover", "c-brg-board-control", "c-brg-convexum", "c-brg-luxembourg-suits", "c-brg-schmidt", "c-brg-qcyber-suit-background", "c-brg-objection", "c-oc-uk-criminal-complaint", "c-exp-deca-regime", "c-exp-bulgaria-cyprus", "c-exp-ngo-letter-2019", "c-ppl-asher-levy", "c-ppl-bec", "c-rel-westbridge" ], "badges": [ { "label": "Criminal complaint filed in the UK by four individuals (September 2024; no outcome recorded)", "claim_ids": [ "c-oc-uk-criminal-complaint" ], "category": "CRIMINAL_PROCEEDINGS", "code": "A8", "subject_id": "novalpina" } ], "subtype": "company" }, { "id": "noal", "name": "NOAL SCSp", "type": "organization", "role": "", "period": "", "group": "historical", "claim_ids": [ "c-buy-terms", "c-buy-fara-chain", "c-buy-holdco-luxco", "c-buy-fund-lps", "c-buy-tracking-shares", "c-brg-takeover", "c-brg-investigations", "c-brg-board-control", "c-brg-financial-crisis", "c-brg-luxembourg-suits", "c-brg-fund-suits", "c-ctl-foreclosure-2023", "c-rel-mubadala" ], "badges": [], "subtype": "other", "jurisdiction": "lu" }, { "id": "novalpina-gp", "name": "Novalpina Capital Partners I GP S.à r.l.", "type": "organization", "role": "", "period": "", "group": "historical", "claim_ids": [ "c-buy-fara-chain", "c-buy-holdco-luxco", "c-buy-fund-lps", "c-brg-takeover" ], "badges": [], "subtype": "company", "jurisdiction": "lu" }, { "id": "treo-gp", "name": "Treo GP", "type": "organization", "role": "", "period": "", "group": "historical", "claim_ids": [ "c-brg-takeover", "c-brg-financial-crisis", "c-brg-luxembourg-suits", "c-brg-fund-suits", "c-ctl-foreclosure-2023", "c-cus-saudi-uae" ], "badges": [], "subtype": "company" }, { "id": "novalpina-group", "name": "Novalpina Capital Group S.à r.l.", "type": "organization", "role": "", "period": "", "group": "historical", "claim_ids": [ "c-buy-holdco-luxco", "c-brg-schmidt" ], "badges": [], "subtype": "company", "jurisdiction": "lu" }, { "id": "novalpina-luxco", "name": "Novalpina Capital Partners I LuxCo S.à r.l.", "type": "organization", "role": "", "period": "", "group": "historical", "claim_ids": [ "c-buy-fara-chain", "c-buy-holdco-luxco", "c-buy-holdco-register", "c-buy-tracking-shares" ], "badges": [], "subtype": "shell", "jurisdiction": "lu" }, { "id": "brg", "name": "Berkeley Research Group (BRG)", "type": "organization", "role": "", "period": "", "group": "historical", "claim_ids": [ "c-brg-takeover", "c-brg-investigations", "c-brg-board-control", "c-brg-convexum", "c-brg-sale-offers", "c-brg-information-dispute", "c-brg-luxembourg-suits", "c-brg-qcyber-suit", "c-brg-qcyber-suit-background", "c-ctl-foreclosure-2023", "c-ppl-asher-levy" ], "badges": [], "subtype": "company" }, { "id": "oregon", "name": "Oregon Public Employees Retirement System", "type": "organization", "role": "", "period": "", "group": "counterparties", "claim_ids": [ "c-buy-fund-lps", "c-brg-takeover", "c-brg-board-control" ], "badges": [], "subtype": "other", "jurisdiction": "us" }, { "id": "alaska", "name": "Alaska Permanent Fund Corp.", "type": "organization", "role": "", "period": "", "group": "counterparties", "claim_ids": [ "c-buy-fund-lps", "c-brg-board-control" ], "badges": [], "subtype": "other", "jurisdiction": "us" }, { "id": "south-yorkshire", "name": "South Yorkshire Pensions Authority", "type": "organization", "role": "", "period": "", "group": "counterparties", "claim_ids": [ "c-buy-fund-lps" ], "badges": [], "subtype": "other", "jurisdiction": "gb" }, { "id": "east-riding", "name": "East Riding Pension Fund", "type": "organization", "role": "", "period": "", "group": "counterparties", "claim_ids": [ "c-buy-fund-lps" ], "badges": [], "subtype": "other", "jurisdiction": "gb" }, { "id": "centerbridge", "name": "Centerbridge Partners", "type": "organization", "role": "", "period": "", "group": "counterparties", "claim_ids": [ "c-brg-board-control" ], "badges": [], "subtype": "company" }, { "id": "mubadala", "name": "Mubadala Capital", "type": "organization", "role": "", "period": "", "group": "counterparties", "claim_ids": [ "c-rel-mubadala" ], "badges": [], "subtype": "company" }, { "id": "esop", "name": "ESOP Management and Trust Services Ltd.", "type": "organization", "role": "", "period": "", "group": "historical", "claim_ids": [ "c-str-triangle-subscribers", "c-str-triangle-split" ], "badges": [], "subtype": "company", "jurisdiction": "il" }, { "id": "global-seven", "name": "Global Seven Group LP", "type": "organization", "role": "", "period": "", "group": "historical", "claim_ids": [ "c-str-triangle-subscribers", "c-ppl-triangle-holders-2021" ], "badges": [], "subtype": "other", "jurisdiction": "vg" }, { "id": "simonds", "name": "Robert Bruce Simonds Jr.", "type": "person", "role": "", "period": "", "group": "historical", "claim_ids": [ "c-ctl-dufresne-register", "c-ctl-simonds-2023", "c-ctl-us-investors-2025", "c-ctl-founders-out", "c-ppl-simonds" ], "badges": [], "subtype": "person" }, { "id": "schremer", "name": "Ohad Shazar Shalem Schremer", "type": "person", "role": "", "period": "", "group": "leadership", "claim_ids": [ "c-ctl-debt-purchase", "c-ctl-newco-oct-2025", "c-ctl-osy-oct-2025", "c-ctl-qcl-oct-2025", "c-ctl-pledge-dec-2025", "c-ctl-sale-back-dec-2025", "c-ctl-lux-press-2026" ], "badges": [], "subtype": "person" }, { "id": "lavie", "name": "Omri Lavie", "type": "person", "role": "", "period": "", "group": "leadership", "claim_ids": [ "c-str-triangle-subscribers", "c-str-triangle-board-2014", "c-tax-lavie-testimony", "c-buy-announcement", "c-buy-triangle-articles", "c-buy-boards-april-2019", "c-buy-triangle-board-dec-2019", "c-brg-qcyber-suit", "c-brg-qcyber-suit-background", "c-brg-triangle-uk-2023", "c-ctl-foreclosure-2023", "c-ctl-dufresne-register", "c-ctl-newco-pledge-2023", "c-ctl-lavie-mandates-2023", "c-ctl-press-2023", "c-ctl-us-investors-2025", "c-ctl-founders-out", "c-ctl-debt-purchase", "c-ctl-newco-oct-2025", "c-ctl-osy-oct-2025", "c-ctl-qcl-oct-2025", "c-ctl-lux-press-2026", "c-ctl-transparency-2025", "c-lux-osy-managers", "c-us-khashoggi-structure", "c-oc-boye-madrid", "c-oc-barcelona-2025", "c-ppl-founders", "c-ppl-lavie-other", "c-ppl-somekh-dumont", "c-rel-westbridge" ], "badges": [ { "label": "Placed under investigation by a Barcelona court (March 2025, as reported)", "claim_ids": [ "c-oc-barcelona-2025" ], "category": "CRIMINAL_PROCEEDINGS", "code": "A7", "subject_id": "lavie" } ], "subtype": "person" }, { "id": "hulio", "name": "Shalev Hulio", "type": "person", "role": "", "period": "", "group": "leadership", "claim_ids": [ "c-str-triangle-subscribers", "c-str-triangle-board-2014", "c-buy-announcement", "c-buy-terms", "c-buy-triangle-articles", "c-buy-boards-april-2019", "c-buy-triangle-board-dec-2019", "c-brg-sale-offers", "c-brg-qcyber-suit", "c-brg-qcyber-suit-background", "c-brg-objection", "c-brg-triangle-uk-2023", "c-ctl-founders-out", "c-lux-qcl-identity", "c-wa-default", "c-oc-boye-madrid", "c-oc-barcelona-2025", "c-cus-spain", "c-cus-panama", "c-ppl-founders", "c-ppl-hulio-ceo", "c-ppl-hulio-dream", "c-ppl-hulio-black-cube", "c-ppl-lavie-other", "c-ppl-shohat", "c-ppl-somekh-dumont" ], "badges": [ { "label": "Placed under investigation by a Barcelona court (March 2025, as reported)", "claim_ids": [ "c-oc-barcelona-2025" ], "category": "CRIMINAL_PROCEEDINGS", "code": "A7", "subject_id": "hulio" }, { "label": "Alleged by the fund's side in the 2023 Tel Aviv case to remain involved in management after resigning (contested)", "claim_ids": [ "c-brg-objection" ], "category": "CIVIL_LITIGATION", "code": "A15", "subject_id": "hulio" }, { "label": "Reported use of a diplomatic passport on a 2013 trip to Panama (denied)", "claim_ids": [ "c-cus-panama" ], "category": "ADVERSE_MEDIA", "code": "A16", "subject_id": "hulio" }, { "label": "Admitted hiring the private intelligence firm Black Cube in Cyprus (inquiry report)", "claim_ids": [ "c-ppl-hulio-black-cube" ], "category": "ADVERSE_MEDIA", "code": "A17", "subject_id": "hulio" } ], "subtype": "person" }, { "id": "karmi", "name": "Niv Karmi", "type": "person", "role": "", "period": "", "group": "historical", "claim_ids": [ "c-ctl-founders-out", "c-oc-boye-madrid", "c-ppl-founders", "c-ppl-karmi" ], "badges": [], "subtype": "person" }, { "id": "shohat", "name": "Yaron Shohat", "type": "person", "role": "", "period": "", "group": "leadership", "claim_ids": [ "c-id-same-ceo", "c-brg-qcyber-suit", "c-brg-objection", "c-ctl-transparency-2025", "c-wa-injunction", "c-wa-declarants", "c-us-dada-filing", "c-us-dada-2026", "c-ppl-hulio-ceo", "c-ppl-shohat" ], "badges": [], "subtype": "person" }, { "id": "friedman", "name": "David M. Friedman", "type": "person", "role": "", "period": "", "group": "leadership", "claim_ids": [ "c-ctl-debt-purchase", "c-ctl-friedman-appointment", "c-ctl-transparency-2025", "c-ctl-friedman-statements", "c-lux-osy-managers", "c-exp-congress-letter", "c-ppl-friedman" ], "badges": [], "subtype": "person" }, { "id": "anthony-levy", "name": "Anthony Michael Levy", "type": "person", "role": "", "period": "", "group": "leadership", "claim_ids": [ "c-brg-makarenko-register", "c-ctl-newco-pledge-2023", "c-ctl-lavie-mandates-2023", "c-ctl-osy-oct-2025", "c-ctl-qcl-oct-2025", "c-lux-osy-managers", "c-ppl-anthony-levy" ], "badges": [], "subtype": "person" }, { "id": "asher-levy", "name": "Asher Levy", "type": "person", "role": "", "period": "", "group": "historical", "claim_ids": [ "c-buy-triangle-board-dec-2019", "c-brg-board-control", "c-lux-osy-managers", "c-ppl-asher-levy", "c-ppl-somekh-dumont" ], "badges": [], "subtype": "person" }, { "id": "somekh", "name": "Yuval Somekh", "type": "person", "role": "", "period": "", "group": "leadership", "claim_ids": [ "c-buy-boards-april-2019", "c-lux-qcl-identity", "c-lux-osy-managers", "c-oc-barcelona-2025", "c-ppl-somekh-dumont" ], "badges": [ { "label": "Placed under investigation by a Barcelona court (March 2025, as reported)", "claim_ids": [ "c-oc-barcelona-2025" ], "category": "CRIMINAL_PROCEEDINGS", "code": "A7", "subject_id": "somekh" } ], "subtype": "person" }, { "id": "de-maigret", "name": "Charline de Maigret", "type": "person", "role": "", "period": "", "group": "other", "claim_ids": [ "c-lux-qcl-identity", "c-ppl-de-maigret" ], "badges": [], "subtype": "person" }, { "id": "dumont", "name": "Gaëtan Dumont", "type": "person", "role": "", "period": "", "group": "other", "claim_ids": [ "c-buy-holdco-register", "c-brg-makarenko-register", "c-ppl-somekh-dumont" ], "badges": [], "subtype": "person" }, { "id": "idisis", "name": "Yifa Idisis", "type": "person", "role": "", "period": "", "group": "leadership", "claim_ids": [ "c-str-qcyber-director-nso", "c-str-qcyber-return-2019", "c-wa-declarants" ], "badges": [], "subtype": "person" }, { "id": "sunray", "name": "Shmuel Sunray", "type": "person", "role": "", "period": "", "group": "leadership", "claim_ids": [ "c-exp-fara" ], "badges": [], "subtype": "person" }, { "id": "gorev", "name": "Eran Gorev", "type": "person", "role": "", "period": "", "group": "historical", "claim_ids": [ "c-str-triangle-square2", "c-str-triangle-subscribers", "c-str-triangle-board-2019", "c-tax-lavie-testimony", "c-buy-fp-exit", "c-buy-boards-april-2019", "c-lux-qcl-identity", "c-ppl-gorev" ], "badges": [], "subtype": "person" }, { "id": "kevin-wilson", "name": "Kevin Wilson", "type": "person", "role": "", "period": "", "group": "historical", "claim_ids": [ "c-buy-boards-april-2019", "c-lux-qcl-identity", "c-ppl-triangle-holders-2021" ], "badges": [], "subtype": "person" }, { "id": "eddy-shalev", "name": "Eddy Shalev", "type": "person", "role": "", "period": "", "group": "historical", "claim_ids": [ "c-str-triangle-subscribers", "c-ppl-founders", "c-rel-convexum" ], "badges": [], "subtype": "person" }, { "id": "voronovitsky", "name": "Alexei Voronovitsky", "type": "person", "role": "", "period": "", "group": "historical", "claim_ids": [ "c-str-triangle-split", "c-ppl-triangle-holders-2021" ], "badges": [], "subtype": "person" }, { "id": "goldman", "name": "Boaz Goldman", "type": "person", "role": "", "period": "", "group": "historical", "claim_ids": [ "c-str-triangle-board-2014", "c-str-triangle-board-2019", "c-str-circles" ], "badges": [], "subtype": "person" }, { "id": "kowal", "name": "Andrew Kowal", "type": "person", "role": "", "period": "", "group": "historical", "claim_ids": [ "c-str-triangle-board-2014", "c-str-triangle-board-2019", "c-buy-fp-exit" ], "badges": [], "subtype": "person" }, { "id": "murphy", "name": "Jonathan Murphy", "type": "person", "role": "", "period": "", "group": "historical", "claim_ids": [ "c-str-triangle-board-2014", "c-str-triangle-board-2019" ], "badges": [], "subtype": "person" }, { "id": "spetzler", "name": "Matthew Spetzler", "type": "person", "role": "", "period": "", "group": "historical", "claim_ids": [ "c-str-triangle-board-2014", "c-str-triangle-board-2019", "c-buy-fp-exit" ], "badges": [], "subtype": "person" }, { "id": "peel", "name": "Stephen Peel", "type": "person", "role": "", "period": "", "group": "historical", "claim_ids": [ "c-buy-holdco-luxco", "c-buy-boards-april-2019", "c-buy-triangle-board-dec-2019", "c-brg-fund-suits", "c-lux-osy-managers" ], "badges": [], "subtype": "person" }, { "id": "kowski", "name": "Stefan Kowski", "type": "person", "role": "", "period": "", "group": "historical", "claim_ids": [ "c-buy-holdco-luxco", "c-buy-boards-april-2019", "c-buy-triangle-board-dec-2019", "c-brg-luxembourg-suits", "c-brg-fund-suits", "c-lux-osy-managers" ], "badges": [ { "label": "Fund's criminal complaint for abuse of powers in Luxembourg (May 2022; under investigation)", "claim_ids": [ "c-brg-luxembourg-suits" ], "category": "CRIMINAL_PROCEEDINGS", "code": "A9", "subject_id": "kowski" } ], "subtype": "person" }, { "id": "lueken", "name": "Bastian Lueken", "type": "person", "role": "", "period": "", "group": "historical", "claim_ids": [ "c-buy-holdco-luxco", "c-brg-luxembourg-suits", "c-brg-fund-suits" ], "badges": [ { "label": "Fund's criminal complaint for abuse of powers in Luxembourg (May 2022; under investigation)", "claim_ids": [ "c-brg-luxembourg-suits" ], "category": "CRIMINAL_PROCEEDINGS", "code": "A9", "subject_id": "lueken" } ], "subtype": "person" }, { "id": "schmidt", "name": "Gerhard Schmidt", "type": "person", "role": "", "period": "", "group": "historical", "claim_ids": [ "c-buy-boards-april-2019", "c-buy-triangle-board-dec-2019", "c-brg-luxembourg-suits", "c-brg-schmidt", "c-lux-osy-managers" ], "badges": [ { "label": "Fund's criminal complaint for abuse of powers in Luxembourg (May 2022; under investigation)", "claim_ids": [ "c-brg-luxembourg-suits" ], "category": "CRIMINAL_PROCEEDINGS", "code": "A9", "subject_id": "schmidt" } ], "subtype": "person" }, { "id": "oconnor", "name": "Finbarr O'Connor", "type": "person", "role": "", "period": "", "group": "historical", "claim_ids": [ "c-brg-board-control", "c-brg-triangle-directors", "c-brg-triangle-uk-2023" ], "badges": [], "subtype": "person" }, { "id": "berkowitz", "name": "Howard Berkowitz", "type": "person", "role": "", "period": "", "group": "historical", "claim_ids": [ "c-brg-triangle-directors", "c-brg-triangle-uk-2023" ], "badges": [], "subtype": "person" }, { "id": "farrell", "name": "Gavin Farrell", "type": "person", "role": "", "period": "", "group": "historical", "claim_ids": [ "c-brg-triangle-directors", "c-brg-triangle-uk-2023" ], "badges": [], "subtype": "person" }, { "id": "dunn", "name": "Jeffrey Dunn", "type": "person", "role": "", "period": "", "group": "historical", "claim_ids": [ "c-brg-triangle-directors", "c-brg-triangle-uk-2023" ], "badges": [], "subtype": "person" }, { "id": "makarenko", "name": "Tamara Makarenko", "type": "person", "role": "", "period": "", "group": "historical", "claim_ids": [ "c-buy-holdco-register", "c-brg-qcyber-suit", "c-brg-qcyber-suit-background", "c-brg-makarenko-register", "c-brg-triangle-uk-2023" ], "badges": [], "subtype": "person" }, { "id": "ward", "name": "James Ward", "type": "person", "role": "", "period": "", "group": "historical", "claim_ids": [ "c-buy-holdco-register", "c-brg-triangle-uk-2023" ], "badges": [], "subtype": "person" }, { "id": "bornstein", "name": "Asher Alan Bornstein", "type": "person", "role": "", "period": "", "group": "historical", "claim_ids": [ "c-brg-qcyber-suit", "c-brg-qcyber-suit-background", "c-brg-makarenko-register" ], "badges": [], "subtype": "person" }, { "id": "divittorio", "name": "Terry DiVittorio", "type": "person", "role": "", "period": "", "group": "other", "claim_ids": [ "c-wa-westbridge-motion", "c-rel-westbridge" ], "badges": [], "subtype": "person" }, { "id": "flynn", "name": "Michael Flynn", "type": "person", "role": "", "period": "", "group": "other", "claim_ids": [ "c-exp-lobbying", "c-ppl-flynn" ], "badges": [], "subtype": "person" }, { "id": "bash", "name": "Jeremy Bash", "type": "person", "role": "", "period": "", "group": "other", "claim_ids": [ "c-ppl-bash" ], "badges": [], "subtype": "person" }, { "id": "shiri-dolev", "name": "Shiri Dolev", "type": "person", "role": "", "period": "", "group": "leadership", "claim_ids": [ "c-ppl-hulio-dream" ], "badges": [], "subtype": "person" }, { "id": "gil-dolev", "name": "Gil Dolev", "type": "person", "role": "", "period": "", "group": "other", "claim_ids": [ "c-ppl-hulio-dream" ], "badges": [], "subtype": "person" }, { "id": "kurz", "name": "Sebastian Kurz", "type": "person", "role": "", "period": "", "group": "other", "claim_ids": [ "c-ppl-hulio-dream" ], "badges": [], "subtype": "person" }, { "id": "founders-group", "name": "Founders Group", "type": "organization", "role": "", "period": "", "group": "other", "claim_ids": [ "c-ppl-hulio-ceo", "c-ppl-lavie-other" ], "badges": [], "subtype": "company" }, { "id": "orchestra", "name": "Orchestra Group", "type": "organization", "role": "", "period": "", "group": "other", "claim_ids": [ "c-ppl-lavie-other" ], "badges": [], "subtype": "company" }, { "id": "dream", "name": "Dream Security", "type": "organization", "role": "", "period": "", "group": "other", "claim_ids": [ "c-ppl-hulio-dream" ], "badges": [], "subtype": "company" }, { "id": "polus", "name": "POLUS Tech. (Switzerland) Ltd", "type": "organization", "role": "", "period": "", "group": "other", "claim_ids": [ "c-ppl-karmi" ], "badges": [], "subtype": "company", "jurisdiction": "ch" }, { "id": "therian", "name": "Therian Labs Technologies AG", "type": "organization", "role": "", "period": "", "group": "other", "claim_ids": [ "c-ppl-karmi" ], "badges": [], "subtype": "company", "jurisdiction": "ch" }, { "id": "stx", "name": "STX Entertainment", "type": "organization", "role": "", "period": "", "group": "other", "claim_ids": [ "c-ctl-simonds-2023", "c-ppl-simonds" ], "badges": [], "subtype": "company" }, { "id": "ability", "name": "Ability Ltd", "type": "organization", "role": "", "period": "", "group": "counterparties", "claim_ids": [ "c-cus-ability" ], "badges": [], "subtype": "company" }, { "id": "kfar-saba", "name": "Kfar Saba Assessing Officer", "type": "organization", "role": "", "period": "", "group": "counterparties", "claim_ids": [ "c-tax-appeal", "c-tax-assessing-position", "c-tax-findings", "c-tax-acquirer-doubt", "c-tax-outcome" ], "badges": [], "subtype": "other", "jurisdiction": "il" }, { "id": "whatsapp", "name": "WhatsApp Inc.", "type": "organization", "role": "", "period": "", "group": "counterparties", "claim_ids": [ "c-wa-complaint", "c-wa-default", "c-wa-motion-dismiss", "c-wa-ninth-circuit", "c-wa-supreme-court", "c-wa-liability", "c-wa-verdict", "c-wa-remittitur", "c-wa-injunction", "c-wa-appeals", "c-wa-contempt", "c-wa-westbridge-motion", "c-exp-mercury-press" ], "badges": [], "subtype": "company", "jurisdiction": "us" }, { "id": "facebook", "name": "Facebook, Inc.", "type": "organization", "role": "", "period": "", "group": "counterparties", "claim_ids": [ "c-wa-complaint", "c-wa-default", "c-wa-ninth-circuit", "c-wa-verdict", "c-wa-remittitur", "c-wa-contempt", "c-wa-westbridge-motion" ], "badges": [], "subtype": "company", "jurisdiction": "us" }, { "id": "apple", "name": "Apple Inc.", "type": "organization", "role": "", "period": "", "group": "counterparties", "claim_ids": [ "c-us-apple", "c-us-apple-outcome", "c-us-dada-filing" ], "badges": [], "subtype": "company", "jurisdiction": "us" }, { "id": "dada", "name": "Carlos Dada", "type": "person", "role": "", "period": "", "group": "counterparties", "claim_ids": [ "c-us-dada-filing", "c-us-dada-2024", "c-us-dada-appeal", "c-us-dada-2026" ], "badges": [], "subtype": "person" }, { "id": "elatr", "name": "Hanan Elatr Khashoggi", "type": "person", "role": "", "period": "", "group": "counterparties", "claim_ids": [ "c-us-khashoggi", "c-us-khashoggi-structure" ], "badges": [], "subtype": "person" }, { "id": "deca", "name": "Defense Exports Control Agency (DECA)", "type": "organization", "role": "", "period": "", "group": "other", "claim_ids": [ "c-brg-information-dispute", "c-ctl-us-investors-2025", "c-oc-malekar", "c-exp-deca-regime", "c-exp-deca-2021", "c-exp-mod-2021", "c-exp-fara" ], "badges": [], "subtype": "other", "jurisdiction": "il" }, { "id": "bis", "name": "Bureau of Industry and Security", "type": "organization", "role": "", "period": "", "group": "other", "claim_ids": [ "c-exp-entity-list", "c-exp-entity-list-current", "c-exp-csl", "c-exp-delisting-efforts", "c-exp-congress-letter" ], "badges": [], "subtype": "other", "jurisdiction": "us" }, { "id": "bulgaria-ministry", "name": "Ministry of Economy and Industry of Bulgaria", "type": "organization", "role": "", "period": "", "group": "other", "claim_ids": [ "c-exp-bulgaria-redacted" ], "badges": [], "subtype": "other", "jurisdiction": "bg" }, { "id": "mercury", "name": "Mercury Public Affairs, LLC", "type": "organization", "role": "", "period": "", "group": "counterparties", "claim_ids": [ "c-buy-fara-chain", "c-exp-fara", "c-exp-mercury-press", "c-exp-lobbying" ], "badges": [], "subtype": "company", "jurisdiction": "us" }, { "id": "arnold-porter", "name": "Arnold & Porter", "type": "organization", "role": "", "period": "", "group": "counterparties", "claim_ids": [ "c-exp-lobbying" ], "badges": [], "subtype": "company" }, { "id": "beacon", "name": "Beacon Global Strategies", "type": "organization", "role": "", "period": "", "group": "counterparties", "claim_ids": [ "c-ppl-bash" ], "badges": [], "subtype": "company" }, { "id": "black-cube", "name": "Black Cube", "type": "organization", "role": "", "period": "", "group": "counterparties", "claim_ids": [ "c-ppl-hulio-black-cube" ], "badges": [], "subtype": "company" }, { "id": "weil", "name": "Weil, Gotshal & Manges LLP", "type": "organization", "role": "", "period": "", "group": "counterparties", "claim_ids": [ "c-brg-fund-suits", "c-brg-schmidt" ], "badges": [], "subtype": "company" }, { "id": "wilmington", "name": "Wilmington Trust (London) Limited", "type": "organization", "role": "", "period": "", "group": "counterparties", "claim_ids": [ "c-ctl-newco-pledge-2023", "c-lux-pledges", "c-lux-newco-forbearance" ], "badges": [], "subtype": "company" }, { "id": "jefferies", "name": "Jefferies Structured Credit LLC", "type": "organization", "role": "", "period": "", "group": "counterparties", "claim_ids": [ "c-lux-newco-forbearance" ], "badges": [], "subtype": "company" }, { "id": "credit-suisse", "name": "Credit Suisse", "type": "organization", "role": "", "period": "", "group": "counterparties", "claim_ids": [ "c-buy-lenders", "c-ctl-press-2023" ], "badges": [], "subtype": "company" }, { "id": "senator", "name": "Senator Investment Group", "type": "organization", "role": "", "period": "", "group": "counterparties", "claim_ids": [ "c-buy-lenders", "c-ctl-press-2023" ], "badges": [], "subtype": "company" }, { "id": "birch-grove", "name": "Birch Grove Capital", "type": "organization", "role": "", "period": "", "group": "counterparties", "claim_ids": [ "c-buy-lenders", "c-ctl-press-2023" ], "badges": [], "subtype": "company" }, { "id": "gideon", "name": "Gideon Cyber Systems LLC", "type": "organization", "role": "", "period": "", "group": "counterparties", "claim_ids": [ "c-lux-osy-loans-out" ], "badges": [], "subtype": "company" }, { "id": "infraloks", "name": "Infraloks Development Limited", "type": "organization", "role": "", "period": "", "group": "counterparties", "claim_ids": [ "c-cus-ghana" ], "badges": [], "subtype": "company", "jurisdiction": "gh" }, { "id": "ghana-nca", "name": "National Communication Authority of Ghana", "type": "organization", "role": "", "period": "", "group": "counterparties", "claim_ids": [ "c-cus-ghana" ], "badges": [], "subtype": "other", "jurisdiction": "gh" }, { "id": "cba", "name": "Central Anti-Corruption Bureau (CBA)", "type": "organization", "role": "", "period": "", "group": "counterparties", "claim_ids": [ "c-cus-poland" ], "badges": [], "subtype": "other", "jurisdiction": "pl" }, { "id": "matic", "name": "Matic Sp. z o.o.", "type": "organization", "role": "", "period": "", "group": "counterparties", "claim_ids": [ "c-cus-poland" ], "badges": [], "subtype": "company", "jurisdiction": "pl" }, { "id": "hungary-moi", "name": "Ministry of the Interior of Hungary", "type": "organization", "role": "", "period": "", "group": "counterparties", "claim_ids": [ "c-cus-hungary" ], "badges": [], "subtype": "other", "jurisdiction": "hu" }, { "id": "comm-tech", "name": "Communication Technologies Ltd", "type": "organization", "role": "", "period": "", "group": "counterparties", "claim_ids": [ "c-cus-hungary" ], "badges": [], "subtype": "company" }, { "id": "bka", "name": "Bundeskriminalamt (BKA)", "type": "organization", "role": "", "period": "", "group": "counterparties", "claim_ids": [ "c-cus-germany" ], "badges": [], "subtype": "other", "jurisdiction": "de" }, { "id": "lux-gov", "name": "Government of Luxembourg", "type": "organization", "role": "", "period": "", "group": "counterparties", "claim_ids": [ "c-exp-lux-no-licence", "c-exp-lux-2026", "c-cus-luxembourg" ], "badges": [], "subtype": "jurisdiction", "jurisdiction": "lu" }, { "id": "panama", "name": "Government of Panama", "type": "organization", "role": "", "period": "", "group": "counterparties", "claim_ids": [ "c-cus-panama" ], "badges": [], "subtype": "jurisdiction", "jurisdiction": "pa" }, { "id": "fssys", "name": "FSSYS Maroc", "type": "organization", "role": "", "period": "", "group": "counterparties", "claim_ids": [ "c-cus-morocco" ], "badges": [], "subtype": "company", "jurisdiction": "ma" }, { "id": "fbi", "name": "Federal Bureau of Investigation", "type": "organization", "role": "", "period": "", "group": "counterparties", "claim_ids": [ "c-wa-us-use-argument" ], "badges": [], "subtype": "other", "jurisdiction": "us" }, { "id": "djibouti", "name": "Government of Djibouti", "type": "organization", "role": "", "period": "", "group": "counterparties", "claim_ids": [ "c-wa-us-use-argument" ], "badges": [], "subtype": "jurisdiction", "jurisdiction": "dj" }, { "id": "bahrain", "name": "Kingdom of Bahrain", "type": "other", "role": "", "period": "", "group": "counterparties", "claim_ids": [ "c-wa-ninth-circuit" ], "badges": [], "subtype": "jurisdiction", "jurisdiction": "bh" }, { "id": "uae", "name": "United Arab Emirates", "type": "other", "role": "", "period": "", "group": "counterparties", "claim_ids": [ "c-wa-ninth-circuit" ], "badges": [], "subtype": "jurisdiction", "jurisdiction": "ae" }, { "id": "mexico", "name": "Mexico", "type": "other", "role": "", "period": "", "group": "counterparties", "claim_ids": [ "c-wa-ninth-circuit" ], "badges": [], "subtype": "jurisdiction", "jurisdiction": "mx" } ], "edges": [ { "id": "r-osy-qcyber", "from": "osy", "to": "qcyber", "role": "Sole shareholder (all 100,000 ordinary shares) and parent company", "period": "From 17 March 2014; named as parent in filings to 2022 and in the 2026 tax judgment", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-str-qcyber-into-chain", "c-str-fs-note", "c-str-osy-incorporation", "c-str-qcyber-return-2019", "c-wa-motion-dismiss", "c-us-apple", "c-buy-fara-chain", "c-exp-lobbying", "c-str-iota" ], "kind": "owns" }, { "id": "r-osy-qcyber-director", "from": "osy", "to": "qcyber", "role": "Corporate director", "period": "From 17 March 2014; as of the annual report signed in June 2019", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-str-qcyber-return-2019", "c-str-osy-incorporation" ], "kind": "directs" }, { "id": "r-qcyber-nso", "from": "qcyber", "to": "nso", "role": "Shareholder and parent company: 70% of NSO from 19 March 2014 and all shares from late 2014, other than shares NSO holds in itself", "period": "From 19 March 2014; still described as parent in court records of 2023-2026", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-str-qcyber-into-chain", "c-str-fs-note", "c-str-nso-shareholders-2019", "c-str-treasury-shares", "c-id-website-2019", "c-id-courts-collective", "c-us-khashoggi-structure", "c-tax-findings", "c-tax-acquirer-doubt", "c-str-pega-merger", "c-wa-complaint" ], "kind": "owns" }, { "id": "r-qcyber-nso-director", "from": "qcyber", "to": "nso", "role": "Corporate director", "period": "From 19 March 2014; as of the annual report updated to 7 January 2019", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-str-qcyber-director-nso", "c-wa-complaint" ], "kind": "directs" }, { "id": "r-nso-qcyber-funds", "from": "nso", "to": "qcyber", "role": "Declared a dividend of about $38.4 million (2016) and made loans whose funds repaid Q Cyber's acquisition loans from OSY", "period": "2014-2018", "status": "documented", "direction": "directed", "role_group": "business", "temporal_status": "historical", "claim_ids": [ "c-tax-repayments" ], "kind": "pays" }, { "id": "r-osy-qcyber-loans", "from": "osy", "to": "qcyber", "role": "Lender of the loans that financed the 2014 acquisition of NSO, repaid 2014-2018", "period": "2014-2018", "status": "documented", "direction": "directed", "role_group": "business", "temporal_status": "historical", "claim_ids": [ "c-tax-repayments", "c-tax-findings" ], "kind": "business" }, { "id": "r-qcyber-nso-address", "from": "qcyber", "to": "nso", "role": "Same registered address: 22 Galgalei Haplada, Herzliya in January 2019; Ramat HaSharon in the current register copies", "period": "As of January 2019 and in the 2025 register copies", "status": "documented", "direction": "undirected", "role_group": "infrastructure", "temporal_status": "unknown", "claim_ids": [ "c-id-address-2019", "c-id-shared-address" ], "kind": "other" }, { "id": "r-qcyber-nso-codefendants", "from": "qcyber", "to": "nso", "role": "Co-defendant in the US suits brought by WhatsApp and Facebook (2019), Apple (2021), El Faro journalists (2022) and Hanan Elatr Khashoggi (2023)", "period": "From October 2019; the WhatsApp judgment was on appeal in 2026", "status": "documented", "direction": "undirected", "role_group": "legal", "temporal_status": "current", "claim_ids": [ "c-wa-complaint", "c-wa-default", "c-wa-ninth-circuit", "c-wa-appeals", "c-wa-verdict", "c-wa-injunction", "c-wa-liability", "c-wa-us-use-argument", "c-cus-sovereign", "c-us-apple", "c-us-apple-outcome", "c-us-dada-filing", "c-us-dada-2024", "c-us-dada-appeal", "c-us-dada-2026", "c-us-khashoggi", "c-id-courts-collective" ], "kind": "legal" }, { "id": "r-qcyber-ngtp", "from": "qcyber", "to": "ngtp", "role": "Sole shareholder", "period": "From incorporation on 20 June 2019", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-id-ngtp-sesame", "c-id-ngtp-sesame-register" ], "kind": "owns" }, { "id": "r-qcyber-sesame", "from": "qcyber", "to": "sesame", "role": "Sole shareholder", "period": "From incorporation on 5 September 2019", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-id-ngtp-sesame", "c-id-ngtp-sesame-register" ], "kind": "owns" }, { "id": "r-ngtp-qcyber-address", "from": "ngtp", "to": "qcyber", "role": "Same registered address (HaAluf Yitzhak Hofi 1, Ramat HaSharon)", "period": "In the 2025 register copies", "status": "documented", "direction": "undirected", "role_group": "infrastructure", "temporal_status": "unknown", "claim_ids": [ "c-id-ngtp-sesame-register" ], "kind": "other" }, { "id": "r-idisis-qcyber", "from": "idisis", "to": "qcyber", "role": "Financial director; declarant for the defendants in the WhatsApp case", "period": "As of the 2019 annual report; declaration of March 2025", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-str-qcyber-return-2019", "c-wa-declarants" ], "kind": "employs" }, { "id": "r-idisis-nso", "from": "idisis", "to": "nso", "role": "Financial director; declarant for the defendants in the WhatsApp case", "period": "As of the 2019 annual report; declaration of March 2025", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-str-qcyber-director-nso", "c-wa-declarants" ], "kind": "employs" }, { "id": "r-sunray-qcyber", "from": "sunray", "to": "qcyber", "role": "General legal counsel (signed the Mercury agreement)", "period": "December 2019", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-exp-fara" ], "kind": "employs" }, { "id": "r-shohat-qcyber", "from": "shohat", "to": "qcyber", "role": "Chief executive (at the same time chief executive of NSO)", "period": "Reported in January 2023; stepped down by January 2026", "status": "reported", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-id-same-ceo", "c-brg-objection", "c-ppl-shohat" ], "kind": "employs" }, { "id": "r-gorev-qcyber", "from": "gorev", "to": "qcyber", "role": "Managed the company on Francisco Partners' behalf shortly after it was set up (Lavie's testimony)", "period": "2014", "status": "reported", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-tax-lavie-testimony" ], "kind": "employs" }, { "id": "r-lavie-qcyber", "from": "lavie", "to": "qcyber", "role": "Controlling owner through the chain of companies and sole shareholder, as described in the July 2026 tax judgment", "period": "As described in July 2026; Luxembourg notices record other shareholders of NorthPole Newco from October 2025", "status": "reported", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-tax-lavie-testimony" ], "kind": "other" }, { "id": "r-francisco-qcyber", "from": "francisco", "to": "qcyber", "role": "Indirect owner through its fund and the Luxembourg chain until the 2019 sale", "period": "2014-2019", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "historical", "claim_ids": [ "c-tax-2019-sale", "c-str-pega-merger", "c-tax-lavie-testimony" ], "kind": "other" }, { "id": "r-deca-qcyber", "from": "deca", "to": "qcyber", "role": "Export regulator: the Israeli Ministry of Defense may deny sales of its technology offerings (as stated in the FARA filing)", "period": "As of December 2019", "status": "documented", "direction": "directed", "role_group": "legal", "temporal_status": "unknown", "claim_ids": [ "c-exp-fara" ], "kind": "legal" }, { "id": "r-qcyber-mercury", "from": "qcyber", "to": "mercury", "role": "Client (foreign principal) under a $1.2 million agreement for crisis communications, media and government relations", "period": "15 December 2019 - 30 November 2020 (FARA filing); lobbying reported for 2019-2021", "status": "documented", "direction": "directed", "role_group": "business", "temporal_status": "historical", "claim_ids": [ "c-exp-fara", "c-exp-mercury-press", "c-exp-lobbying", "c-buy-fara-chain" ], "kind": "business" }, { "id": "r-qcyber-arnold", "from": "qcyber", "to": "arnold-porter", "role": "Client of Arnold & Porter in the lobbying campaign (as compiled by the press; timing unknown)", "period": "Timing not stated", "status": "reported", "direction": "directed", "role_group": "business", "temporal_status": "unknown", "claim_ids": [ "c-exp-lobbying" ], "kind": "business" }, { "id": "r-qcyber-kfarsaba", "from": "qcyber", "to": "kfar-saba", "role": "Appellant against withholding-tax assessments (TA 59924-03-22)", "period": "Filed March 2022; dismissed 28 July 2026", "status": "documented", "direction": "directed", "role_group": "legal", "temporal_status": "historical", "claim_ids": [ "c-tax-appeal", "c-tax-assessing-position", "c-tax-findings", "c-tax-outcome" ], "kind": "legal" }, { "id": "r-whatsapp-qcyber", "from": "whatsapp", "to": "qcyber", "role": "Plaintiff suing it in the Northern District of California (filed 29 October 2019)", "period": "From October 2019; judgment of 12 November 2025 on appeal", "status": "documented", "direction": "directed", "role_group": "legal", "temporal_status": "current", "claim_ids": [ "c-wa-complaint", "c-wa-default", "c-wa-ninth-circuit", "c-wa-liability", "c-wa-verdict", "c-wa-remittitur", "c-wa-injunction", "c-wa-appeals", "c-wa-contempt", "c-wa-supreme-court" ], "kind": "legal" }, { "id": "r-whatsapp-nso", "from": "whatsapp", "to": "nso", "role": "Plaintiff suing it in the Northern District of California (filed 29 October 2019)", "period": "From October 2019; judgment of 12 November 2025 on appeal", "status": "documented", "direction": "directed", "role_group": "legal", "temporal_status": "current", "claim_ids": [ "c-wa-complaint", "c-wa-default", "c-wa-ninth-circuit", "c-wa-liability", "c-wa-verdict", "c-wa-remittitur", "c-wa-injunction", "c-wa-appeals", "c-wa-contempt", "c-wa-supreme-court" ], "kind": "legal" }, { "id": "r-facebook-qcyber", "from": "facebook", "to": "qcyber", "role": "Co-plaintiff (Facebook, Inc., later Meta Platforms) in the US suit against", "period": "From October 2019", "status": "documented", "direction": "directed", "role_group": "legal", "temporal_status": "current", "claim_ids": [ "c-wa-complaint", "c-wa-default", "c-wa-ninth-circuit", "c-wa-verdict", "c-wa-remittitur", "c-wa-contempt" ], "kind": "legal" }, { "id": "r-facebook-nso", "from": "facebook", "to": "nso", "role": "Co-plaintiff (Facebook, Inc., later Meta Platforms) in the US suit against", "period": "From October 2019", "status": "documented", "direction": "directed", "role_group": "legal", "temporal_status": "current", "claim_ids": [ "c-wa-complaint", "c-wa-default", "c-wa-ninth-circuit", "c-wa-verdict", "c-wa-remittitur", "c-wa-contempt" ], "kind": "legal" }, { "id": "r-apple-qcyber", "from": "apple", "to": "qcyber", "role": "Plaintiff in the US suit against (3:21-cv-09078), later voluntarily dismissed", "period": "23 November 2021 - November 2024", "status": "documented", "direction": "directed", "role_group": "legal", "temporal_status": "historical", "claim_ids": [ "c-us-apple", "c-us-apple-outcome" ], "kind": "legal" }, { "id": "r-apple-nso", "from": "apple", "to": "nso", "role": "Plaintiff in the US suit against (3:21-cv-09078), later voluntarily dismissed", "period": "23 November 2021 - November 2024", "status": "documented", "direction": "directed", "role_group": "legal", "temporal_status": "historical", "claim_ids": [ "c-us-apple", "c-us-apple-outcome" ], "kind": "legal" }, { "id": "r-dada-qcyber", "from": "dada", "to": "qcyber", "role": "Lead plaintiff (El Faro journalists) in the US suit against (3:22-cv-07513)", "period": "From 30 November 2022; dismissed 30 September 2026", "status": "documented", "direction": "directed", "role_group": "legal", "temporal_status": "unknown", "claim_ids": [ "c-us-dada-filing", "c-us-dada-2024", "c-us-dada-appeal", "c-us-dada-2026" ], "kind": "legal" }, { "id": "r-dada-nso", "from": "dada", "to": "nso", "role": "Lead plaintiff (El Faro journalists) in the US suit against (3:22-cv-07513)", "period": "From 30 November 2022; dismissed 30 September 2026", "status": "documented", "direction": "directed", "role_group": "legal", "temporal_status": "unknown", "claim_ids": [ "c-us-dada-filing", "c-us-dada-2024", "c-us-dada-appeal", "c-us-dada-2026" ], "kind": "legal" }, { "id": "r-elatr-qcyber", "from": "elatr", "to": "qcyber", "role": "Plaintiff in the US suit against (E.D. Va. 1:23-cv-779)", "period": "Filed 15 June 2023; dismissed 26 October 2023", "status": "documented", "direction": "directed", "role_group": "legal", "temporal_status": "historical", "claim_ids": [ "c-us-khashoggi" ], "kind": "legal" }, { "id": "r-elatr-nso", "from": "elatr", "to": "nso", "role": "Plaintiff in the US suit against (E.D. Va. 1:23-cv-779)", "period": "Filed 15 June 2023; dismissed 26 October 2023", "status": "documented", "direction": "directed", "role_group": "legal", "temporal_status": "historical", "claim_ids": [ "c-us-khashoggi" ], "kind": "legal" }, { "id": "r-qcyber-brg", "from": "qcyber", "to": "brg", "role": "Plaintiff seeking declarations on the validity of its board appointments against", "period": "January 2023", "status": "documented", "direction": "directed", "role_group": "legal", "temporal_status": "historical", "claim_ids": [ "c-brg-qcyber-suit", "c-brg-qcyber-suit-background" ], "kind": "legal" }, { "id": "r-qcyber-hulio", "from": "qcyber", "to": "hulio", "role": "Plaintiff in the January 2023 board-validity suit against (Hulio as minority shareholder)", "period": "January 2023", "status": "documented", "direction": "directed", "role_group": "legal", "temporal_status": "historical", "claim_ids": [ "c-brg-qcyber-suit", "c-brg-qcyber-suit-background", "c-brg-objection" ], "kind": "legal" }, { "id": "r-qcyber-lavie", "from": "qcyber", "to": "lavie", "role": "Plaintiff in the January 2023 board-validity suit against (Lavie as minority shareholder)", "period": "January 2023", "status": "documented", "direction": "directed", "role_group": "legal", "temporal_status": "historical", "claim_ids": [ "c-brg-qcyber-suit", "c-brg-qcyber-suit-background" ], "kind": "legal" }, { "id": "r-qcyber-novalpina", "from": "qcyber", "to": "novalpina", "role": "Plaintiff in the January 2023 board-validity suit against the controlling fund's side", "period": "January 2023", "status": "documented", "direction": "directed", "role_group": "legal", "temporal_status": "historical", "claim_ids": [ "c-brg-objection", "c-brg-qcyber-suit-background" ], "kind": "legal" }, { "id": "r-makarenko-qcyber", "from": "makarenko", "to": "qcyber", "role": "Director named by BRG (validity of the appointment disputed in the January 2023 suit)", "period": "From December 2022", "status": "reported", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-brg-qcyber-suit", "c-brg-qcyber-suit-background" ], "kind": "directs" }, { "id": "r-bornstein-qcyber", "from": "bornstein", "to": "qcyber", "role": "Director named by BRG (validity of the appointment disputed in the January 2023 suit)", "period": "From December 2022", "status": "reported", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-brg-qcyber-suit", "c-brg-qcyber-suit-background" ], "kind": "directs" }, { "id": "r-osy-nso-2014", "from": "osy", "to": "nso", "role": "Acquirer of all rights in NSO under the agreement of 5 February 2014 (70% for $70 million cash; 30% by exchange for Triangle shares)", "period": "5 February 2014", "status": "documented", "direction": "directed", "role_group": "business", "temporal_status": "historical", "claim_ids": [ "c-str-osy-agreement", "c-str-price" ], "kind": "business" }, { "id": "r-triangle-nso-2014", "from": "triangle", "to": "nso", "role": "Issued its shares in exchange for the remaining 30% of NSO's shares", "period": "30 November - 1 December 2014", "status": "documented", "direction": "directed", "role_group": "business", "temporal_status": "historical", "claim_ids": [ "c-str-osy-agreement", "c-str-qcyber-into-chain" ], "kind": "business" }, { "id": "r-francisco-nso", "from": "francisco", "to": "nso", "role": "Controlling owner through its fund Francisco Partners III (70% acquired in 2014, held indirectly through OSY Holdings and Triangle)", "period": "March 2014 - 18 March 2019", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "historical", "claim_ids": [ "c-str-price", "c-str-fp-confirmation", "c-buy-announcement", "c-str-blackstone-2017", "c-buy-fp-exit", "c-buy-complaint-account", "c-tax-2019-sale", "c-str-pega-merger" ], "kind": "owns" }, { "id": "r-francisco-osyholdings", "from": "francisco", "to": "osy-holdings", "role": "Sole owner through its fund Francisco Partners III", "period": "March 2014 - 18 March 2019; dissolution under way in 2021", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "historical", "claim_ids": [ "c-str-fp-confirmation", "c-buy-fp-exit", "c-rel-westbridge-ownership" ], "kind": "owns" }, { "id": "r-francisco-triangle", "from": "francisco", "to": "triangle", "role": "Indirect controlling shareholder through OSY Holdings", "period": "March 2014 - 18 March 2019", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "historical", "claim_ids": [ "c-str-fp-confirmation", "c-buy-fp-exit", "c-rel-westbridge-ownership" ], "kind": "other" }, { "id": "r-francisco-osy", "from": "francisco", "to": "osy", "role": "Indirect owner through a chain of companies headed by Triangle Holdings", "period": "2014 - March 2019", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "historical", "claim_ids": [ "c-str-chain-fp" ], "kind": "other" }, { "id": "r-osyholdings-osy", "from": "osy-holdings", "to": "osy", "role": "Sole shareholder", "period": "From incorporation on 3 February 2014 until the transfer to Square 2 in November 2014", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "historical", "claim_ids": [ "c-str-osy-incorporation", "c-str-triangle-square2" ], "kind": "owns" }, { "id": "r-osyholdings-triangle", "from": "osy-holdings", "to": "triangle", "role": "Sole shareholder from incorporation, then 64.5% after the December 2014 capital increase", "period": "21 November 2014 - 18 March 2019", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "historical", "claim_ids": [ "c-str-triangle-dec2014", "c-str-triangle-split", "c-str-triangle-square2", "c-str-fp-confirmation", "c-buy-fp-exit" ], "kind": "owns" }, { "id": "r-triangle-osy", "from": "triangle", "to": "osy", "role": "Indirect parent through Square 2, at the head of the ownership chain under Francisco Partners", "period": "From late 2014", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-str-chain-fp", "c-str-triangle-square2" ], "kind": "other" }, { "id": "r-triangle-osy-address", "from": "triangle", "to": "osy", "role": "Same registered address (44 rue de la Vallée, Luxembourg)", "period": "As reported in April 2026", "status": "documented", "direction": "undirected", "role_group": "infrastructure", "temporal_status": "unknown", "claim_ids": [ "c-lux-seven-entities" ], "kind": "other" }, { "id": "r-triangle-square2", "from": "triangle", "to": "square2", "role": "Shareholder: sole shareholder from November 2014, about 31.4% after April 2019, sole shareholder again from 30 December 2019", "period": "From 21 November 2014", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-str-triangle-square2", "c-buy-chain-april-2019", "c-buy-triangle-reroute", "c-buy-fara-chain", "c-lux-uk-branches" ], "kind": "owns" }, { "id": "r-square2-osy", "from": "square2", "to": "osy", "role": "Sole shareholder", "period": "28 November 2014 - 6 May 2019", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "historical", "claim_ids": [ "c-str-triangle-square2", "c-buy-register-2019" ], "kind": "owns" }, { "id": "r-qcyber-circles", "from": "qcyber", "to": "circles", "role": "Reported holding company under which Circles and NSO were combined (inquiry report relying on the 2021 NGO report)", "period": "From 2014, as reported", "status": "reported", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-str-pega-merger" ], "kind": "owns" }, { "id": "r-osy-circles", "from": "osy", "to": "circles", "role": "Acquirer of the Circles group of companies", "period": "From 1 December 2014", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-str-circles" ], "kind": "owns" }, { "id": "r-francisco-circles", "from": "francisco", "to": "circles", "role": "Acquirer (through OSY) of the Circles group, reportedly for about $130 million", "period": "2014", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "historical", "claim_ids": [ "c-str-circles", "c-str-pega-merger" ], "kind": "owns" }, { "id": "r-goldman-circles", "from": "goldman", "to": "circles", "role": "Co-founder", "period": "From 2010", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-str-circles" ], "kind": "other" }, { "id": "r-osy-iota", "from": "osy", "to": "iota", "role": "Owner (acquired in 2014; shares pledged to the collateral agent in May 2022)", "period": "From 2014", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-str-iota", "c-lux-pledges", "c-buy-chain-april-2019", "c-exp-bulgaria-entities" ], "kind": "owns" }, { "id": "r-osy-iota-note", "from": "osy", "to": "iota", "role": "Holder of IOTA's 2014 promissory note (principal USD 116.1 million at the end of 2024)", "period": "From 2015", "status": "documented", "direction": "directed", "role_group": "business", "temporal_status": "unknown", "claim_ids": [ "c-lux-iota-note" ], "kind": "business" }, { "id": "r-nso-pfos", "from": "nso", "to": "pfos", "role": "Sole shareholder (as stated in the 2021 NGO report)", "period": "9 May 2013 - dissolution on 30 November 2021", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "historical", "claim_ids": [ "c-rel-pfos" ], "kind": "owns" }, { "id": "r-nso-shapes1", "from": "nso", "to": "shapes1", "role": "Dutch financial holding company of the group, later liquidated", "period": "November 2014 - December 2016", "status": "documented", "direction": "undirected", "role_group": "associations", "temporal_status": "historical", "claim_ids": [ "c-rel-footprint" ], "kind": "other" }, { "id": "r-nso-shapes2", "from": "nso", "to": "shapes2", "role": "Dutch financial holding company of the group, later liquidated", "period": "November 2014 - December 2016", "status": "documented", "direction": "undirected", "role_group": "associations", "temporal_status": "historical", "claim_ids": [ "c-rel-footprint" ], "kind": "other" }, { "id": "r-lavie-triangle", "from": "lavie", "to": "triangle", "role": "Shareholder: 67,263 class D shares (9%) subscribed with 50 NSO shares", "period": "From 1 December 2014", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-str-triangle-subscribers" ], "kind": "owns" }, { "id": "r-hulio-triangle", "from": "hulio", "to": "triangle", "role": "Shareholder: 67,263 class D shares (9%) subscribed with 50 NSO shares", "period": "From 1 December 2014", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-str-triangle-subscribers" ], "kind": "owns" }, { "id": "r-eshalev-triangle", "from": "eddy-shalev", "to": "triangle", "role": "Shareholder: 13,444 class D shares (1.8%)", "period": "From 1 December 2014", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-str-triangle-subscribers" ], "kind": "owns" }, { "id": "r-esop-triangle", "from": "esop", "to": "triangle", "role": "Shareholder on behalf of employees: 20,767 class A shares (2.8%), bought back by Triangle in 2019", "period": "1 December 2014 - 18 February 2019", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "historical", "claim_ids": [ "c-str-triangle-subscribers", "c-str-triangle-split" ], "kind": "owns" }, { "id": "r-g7-triangle", "from": "global-seven", "to": "triangle", "role": "Shareholder: 89,458 class D shares (12%); no interest by 2021 according to NSO Group", "period": "From 1 December 2014; none by 2021", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "historical", "claim_ids": [ "c-str-triangle-subscribers", "c-ppl-triangle-holders-2021" ], "kind": "owns" }, { "id": "r-gorev-triangle", "from": "gorev", "to": "triangle", "role": "Shareholder: 6,336 class D shares (0.8%), sold on 18 March 2019", "period": "1 December 2014 - 18 March 2019", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "historical", "claim_ids": [ "c-str-triangle-subscribers", "c-buy-fp-exit" ], "kind": "owns" }, { "id": "r-voronovitsky-triangle", "from": "voronovitsky", "to": "triangle", "role": "Shareholder (0.1%); no longer a shareholder by 2021 according to NSO Group", "period": "From December 2014; none by 2021", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "historical", "claim_ids": [ "c-str-triangle-split", "c-ppl-triangle-holders-2021" ], "kind": "owns" }, { "id": "r-wilson-triangle", "from": "kevin-wilson", "to": "triangle", "role": "Shareholder (former employee)", "period": "As stated by NSO Group in 2021", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-ppl-triangle-holders-2021" ], "kind": "owns" }, { "id": "r-gorev-triangle-dir", "from": "gorev", "to": "triangle", "role": "Sole director, then class A director", "period": "21 November 2014 - 1 April 2019", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-str-triangle-square2", "c-str-triangle-board-2019" ], "kind": "directs" }, { "id": "r-lavie-triangle-dir", "from": "lavie", "to": "triangle", "role": "Director (class B from 2019)", "period": "From 1 December 2014; on the UK record with an appointment date of 1 August 2023", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-str-triangle-board-2014", "c-buy-triangle-board-dec-2019", "c-brg-triangle-uk-2023" ], "kind": "directs" }, { "id": "r-hulio-triangle-dir", "from": "hulio", "to": "triangle", "role": "Director (class B from 2019)", "period": "From 1 December 2014; on the UK record with an appointment date of 1 August 2023", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-str-triangle-board-2014", "c-buy-triangle-board-dec-2019", "c-brg-triangle-uk-2023" ], "kind": "directs" }, { "id": "r-goldman-triangle", "from": "goldman", "to": "triangle", "role": "Director", "period": "1 December 2014 - 1 April 2019", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-str-triangle-board-2014", "c-str-triangle-board-2019" ], "kind": "directs" }, { "id": "r-kowal-triangle", "from": "kowal", "to": "triangle", "role": "Director (class A)", "period": "1 December 2014 - 1 April 2019", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-str-triangle-board-2014", "c-str-triangle-board-2019" ], "kind": "directs" }, { "id": "r-murphy-triangle", "from": "murphy", "to": "triangle", "role": "Director (class A)", "period": "1 December 2014 - 1 April 2019", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-str-triangle-board-2014", "c-str-triangle-board-2019" ], "kind": "directs" }, { "id": "r-spetzler-triangle", "from": "spetzler", "to": "triangle", "role": "Director (class A)", "period": "1 December 2014 - 1 April 2019", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-str-triangle-board-2014", "c-str-triangle-board-2019" ], "kind": "directs" }, { "id": "r-lavie-triangle-nominate", "from": "lavie", "to": "triangle", "role": "Right to nominate class B directors under the articles", "period": "From 17 April 2019", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-buy-triangle-articles" ], "kind": "other" }, { "id": "r-hulio-triangle-nominate", "from": "hulio", "to": "triangle", "role": "Right to nominate class B directors under the articles", "period": "From 17 April 2019", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-buy-triangle-articles" ], "kind": "other" }, { "id": "r-holdco-triangle-nominate", "from": "northpole-holdco", "to": "triangle", "role": "Right to nominate class A directors (via NorthPole Bidco) under the articles", "period": "From 17 April 2019", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-buy-triangle-articles" ], "kind": "other" }, { "id": "r-holdco-triangle", "from": "northpole-holdco", "to": "triangle", "role": "Shareholder: about 59.8% of the class A shares, received for its Square 2 stake", "period": "From 30 December 2019", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-buy-triangle-reroute" ], "kind": "owns" }, { "id": "r-kowski-triangle", "from": "kowski", "to": "triangle", "role": "Class A director", "period": "From 30 December 2019", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-buy-triangle-board-dec-2019" ], "kind": "directs" }, { "id": "r-peel-triangle", "from": "peel", "to": "triangle", "role": "Class A director", "period": "From 30 December 2019", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-buy-triangle-board-dec-2019" ], "kind": "directs" }, { "id": "r-schmidt-triangle", "from": "schmidt", "to": "triangle", "role": "Class A director; reported member of the board of the holding company overseeing NSO", "period": "From 30 December 2019", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-buy-triangle-board-dec-2019", "c-brg-schmidt" ], "kind": "directs" }, { "id": "r-asherlevy-triangle", "from": "asher-levy", "to": "triangle", "role": "Class A director and chairman", "period": "27 April 2020 - January 2022", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-buy-triangle-board-dec-2019", "c-brg-board-control" ], "kind": "directs" }, { "id": "r-oconnor-triangle", "from": "oconnor", "to": "triangle", "role": "Class A director and chairman nominated by BRG", "period": "From 4 October 2021; on the UK record with an appointment date of 1 August 2023", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-brg-triangle-directors", "c-brg-board-control", "c-brg-triangle-uk-2023" ], "kind": "directs" }, { "id": "r-berkowitz-triangle", "from": "berkowitz", "to": "triangle", "role": "Class A director", "period": "From 4 October 2021; on the UK record with an appointment date of 1 August 2023", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-brg-triangle-directors", "c-brg-triangle-uk-2023" ], "kind": "directs" }, { "id": "r-farrell-triangle", "from": "farrell", "to": "triangle", "role": "Class A director", "period": "From 14 January 2022; on the UK record with an appointment date of 1 August 2023", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-brg-triangle-directors", "c-brg-triangle-uk-2023" ], "kind": "directs" }, { "id": "r-dunn-triangle", "from": "dunn", "to": "triangle", "role": "Class A director", "period": "From 14 January 2022; on the UK record with an appointment date of 1 August 2023", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-brg-triangle-directors", "c-brg-triangle-uk-2023" ], "kind": "directs" }, { "id": "r-makarenko-triangle", "from": "makarenko", "to": "triangle", "role": "Director (UK overseas-company record)", "period": "Appointment date shown as 1 August 2023", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-brg-triangle-uk-2023" ], "kind": "directs" }, { "id": "r-ward-triangle", "from": "ward", "to": "triangle", "role": "Director (UK overseas-company record)", "period": "Appointment date shown as 1 August 2023", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-brg-triangle-uk-2023" ], "kind": "directs" }, { "id": "r-triangle-convexum", "from": "triangle", "to": "convexum", "role": "Reported to control Convexum in practice", "period": "As reported in January 2022", "status": "reported", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-brg-convexum" ], "kind": "other" }, { "id": "r-novalpina-nso", "from": "novalpina", "to": "nso", "role": "Private equity manager whose fund acquired about 70% of NSO in the 2019 buyout, as equity partner of the founders and management", "period": "February 2019 until the fund's management passed to BRG in 2021", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "historical", "claim_ids": [ "c-buy-announcement", "c-buy-terms", "c-exp-ngo-letter-2019", "c-buy-novalpina-role", "c-buy-triangle-reroute" ], "kind": "owns" }, { "id": "r-noal-nso", "from": "noal", "to": "nso", "role": "Fund holding the indirect majority stake (about 70%) acquired in 2019, until the lenders enforced their pledge", "period": "2019 - February 2023", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "historical", "claim_ids": [ "c-buy-terms", "c-ctl-foreclosure-2023", "c-brg-board-control", "c-brg-takeover", "c-rel-mubadala" ], "kind": "owns" }, { "id": "r-hulio-nso", "from": "hulio", "to": "nso", "role": "Shareholder: led the 2019 buyout with Lavie; with management held about 30%; no longer a shareholder after October 2025", "period": "2019 - October 2025", "status": "reported", "direction": "directed", "role_group": "ownership", "temporal_status": "historical", "claim_ids": [ "c-buy-announcement", "c-buy-terms", "c-ctl-founders-out" ], "kind": "owns" }, { "id": "r-lavie-nso", "from": "lavie", "to": "nso", "role": "Shareholder: led the 2019 buyout with Hulio; reported from 2023 as owner through Dufresne Holding; no longer a shareholder after October 2025", "period": "2019 - October 2025", "status": "reported", "direction": "directed", "role_group": "ownership", "temporal_status": "historical", "claim_ids": [ "c-buy-announcement", "c-ctl-us-investors-2025", "c-ctl-founders-out", "c-ctl-press-2023" ], "kind": "owns" }, { "id": "r-novalpina-osy", "from": "novalpina", "to": "osy", "role": "Appointed members of the group board as shareholder (NSO Group's 2021 statement)", "period": "From 2019", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "historical", "claim_ids": [ "c-buy-novalpina-role" ], "kind": "other" }, { "id": "r-novalpina-triangle", "from": "novalpina", "to": "triangle", "role": "Appointed members of the group board as shareholder (NSO Group's 2021 statement)", "period": "From 2019", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "historical", "claim_ids": [ "c-buy-novalpina-role" ], "kind": "other" }, { "id": "r-novalpina-holdco", "from": "novalpina", "to": "northpole-holdco", "role": "NorthPole Holdco was the investment vehicle of Novalpina's fund for NSO", "period": "From 2018", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-buy-chain-april-2019", "c-buy-triangle-reroute" ], "kind": "owns" }, { "id": "r-noal-luxco", "from": "noal", "to": "novalpina-luxco", "role": "Owner: the fund channelled its investments through LuxCo", "period": "From November 2017", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-buy-holdco-luxco", "c-buy-tracking-shares" ], "kind": "owns" }, { "id": "r-luxco-holdco", "from": "novalpina-luxco", "to": "northpole-holdco", "role": "Sole shareholder", "period": "From 30 November 2018", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-buy-holdco-luxco", "c-buy-holdco-register", "c-buy-fara-chain" ], "kind": "owns" }, { "id": "r-holdco-square2", "from": "northpole-holdco", "to": "square2", "role": "Shareholder (68.6%)", "period": "11 April 2019 - 30 December 2019 (register: 27 January 2020)", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "historical", "claim_ids": [ "c-buy-chain-april-2019", "c-buy-register-2019", "c-buy-triangle-reroute", "c-buy-fara-chain" ], "kind": "owns" }, { "id": "r-square2-bidco", "from": "square2", "to": "northpole-bidco", "role": "Sole shareholder", "period": "From April 2019", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-buy-chain-april-2019" ], "kind": "owns" }, { "id": "r-bidco-newco", "from": "northpole-bidco", "to": "northpole-newco", "role": "Sole shareholder", "period": "15 April 2019 - 30 November 2020", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "historical", "claim_ids": [ "c-buy-register-2019", "c-buy-chain-april-2019", "c-buy-emerald-diamond" ], "kind": "owns" }, { "id": "r-bidco-goatilev", "from": "northpole-bidco", "to": "goatilev", "role": "Sole shareholder (acquired on 5 February 2020; contributed to Emerald LIE on 30 November 2020)", "period": "5 February - 30 November 2020", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "historical", "claim_ids": [ "c-buy-goatilev", "c-buy-emerald-diamond" ], "kind": "owns" }, { "id": "r-bidco-emerald", "from": "northpole-bidco", "to": "emerald", "role": "Holder of 350,000,000 new preferred B shares received for contributing NorthPole Newco and Goatilev", "period": "From 30 November 2020", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-buy-emerald-diamond" ], "kind": "owns" }, { "id": "r-emerald-diamond", "from": "emerald", "to": "diamond", "role": "Contributed the NorthPole Newco and Goatilev shares to Diamond LIE", "period": "30 November 2020", "status": "documented", "direction": "directed", "role_group": "business", "temporal_status": "historical", "claim_ids": [ "c-buy-emerald-diamond" ], "kind": "other" }, { "id": "r-emerald-newco", "from": "emerald", "to": "northpole-newco", "role": "Shareholder (transitional)", "period": "30 November 2020 (register: 15-17 December 2020)", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "historical", "claim_ids": [ "c-buy-emerald-diamond" ], "kind": "owns" }, { "id": "r-diamond-newco", "from": "diamond", "to": "northpole-newco", "role": "Sole shareholder (shares pledged to the lenders)", "period": "30 November 2020 - 24 February 2023", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "historical", "claim_ids": [ "c-buy-emerald-diamond", "c-ctl-dufresne-register", "c-ctl-foreclosure-2023", "c-ctl-lavie-mandates-2023" ], "kind": "owns" }, { "id": "r-newco-osy", "from": "northpole-newco", "to": "osy", "role": "Sole shareholder (shares pledged to the lenders' collateral agent)", "period": "From 6 May 2019; as of the 2024 accounts", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-buy-register-2019", "c-buy-chain-april-2019", "c-ctl-newco-pledge-2023", "c-lux-osy-finances", "c-lux-newco-aggregator", "c-lux-pledges", "c-lux-newco-finances" ], "kind": "owns" }, { "id": "r-newco-osy-loan", "from": "northpole-newco", "to": "osy", "role": "Lender of an on-loan of the 2019 term-loan proceeds (USD 114.5 million outstanding at the end of 2024)", "period": "From 18 March 2019", "status": "documented", "direction": "directed", "role_group": "business", "temporal_status": "unknown", "claim_ids": [ "c-lux-osy-finances" ], "kind": "business" }, { "id": "r-newco-wilmington", "from": "northpole-newco", "to": "wilmington", "role": "Borrower and pledgor of all OSY shares to the collateral agent for the lenders", "period": "From 8 April 2019", "status": "documented", "direction": "directed", "role_group": "business", "temporal_status": "unknown", "claim_ids": [ "c-lux-pledges", "c-lux-newco-forbearance", "c-ctl-newco-pledge-2023" ], "kind": "business" }, { "id": "r-osy-wilmington", "from": "osy", "to": "wilmington", "role": "Pledgor of its interests in Westbridge, IOTA and an affiliate to the collateral agent", "period": "From 8 April 2019 and 17 May 2022", "status": "documented", "direction": "directed", "role_group": "business", "temporal_status": "unknown", "claim_ids": [ "c-lux-pledges" ], "kind": "business" }, { "id": "r-newco-westbridge", "from": "northpole-newco", "to": "westbridge", "role": "Co-borrowers under the forbearance agreement of 31 December 2021", "period": "From 31 December 2021", "status": "documented", "direction": "undirected", "role_group": "associations", "temporal_status": "unknown", "claim_ids": [ "c-lux-newco-forbearance" ], "kind": "business" }, { "id": "r-newco-jefferies", "from": "northpole-newco", "to": "jefferies", "role": "Counterparty to a currency swap terminated in January 2022", "period": "Until January 2022", "status": "documented", "direction": "directed", "role_group": "business", "temporal_status": "historical", "claim_ids": [ "c-lux-newco-forbearance" ], "kind": "business" }, { "id": "r-cs-newco", "from": "credit-suisse", "to": "northpole-newco", "role": "Reported lender in the syndicate of the 2019 leveraged loan", "period": "As reported in March 2022", "status": "reported", "direction": "directed", "role_group": "business", "temporal_status": "unknown", "claim_ids": [ "c-buy-lenders" ], "kind": "business" }, { "id": "r-senator-newco", "from": "senator", "to": "northpole-newco", "role": "Reported lender in the syndicate of the 2019 leveraged loan", "period": "As reported in March 2022", "status": "reported", "direction": "directed", "role_group": "business", "temporal_status": "unknown", "claim_ids": [ "c-buy-lenders" ], "kind": "business" }, { "id": "r-birchgrove-newco", "from": "birch-grove", "to": "northpole-newco", "role": "Reported lender in the syndicate of the 2019 leveraged loan", "period": "As reported in March 2022", "status": "reported", "direction": "directed", "role_group": "business", "temporal_status": "unknown", "claim_ids": [ "c-buy-lenders" ], "kind": "business" }, { "id": "r-peel-novgroup", "from": "peel", "to": "novalpina-group", "role": "Co-owner", "period": "As described in the 2021 NGO report", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-buy-holdco-luxco" ], "kind": "owns" }, { "id": "r-kowski-novgroup", "from": "kowski", "to": "novalpina-group", "role": "Co-owner", "period": "As described in the 2021 NGO report", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-buy-holdco-luxco" ], "kind": "owns" }, { "id": "r-lueken-novgroup", "from": "lueken", "to": "novalpina-group", "role": "Co-owner", "period": "As described in the 2021 NGO report", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-buy-holdco-luxco" ], "kind": "owns" }, { "id": "r-novgroup-novgp", "from": "novalpina-group", "to": "novalpina-gp", "role": "Ultimate owner", "period": "As described in the 2021 NGO report", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-buy-holdco-luxco" ], "kind": "owns" }, { "id": "r-novalpina-noal", "from": "novalpina", "to": "noal", "role": "Sponsor and manager of the fund until its investors removed Novalpina as general partner", "period": "2017 - July/August 2021", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "historical", "claim_ids": [ "c-brg-takeover", "c-buy-terms" ], "kind": "other" }, { "id": "r-novgp-noal", "from": "novalpina-gp", "to": "noal", "role": "General partner", "period": "2017 - 27 August 2021", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "historical", "claim_ids": [ "c-buy-fund-lps", "c-brg-takeover", "c-buy-holdco-luxco" ], "kind": "other" }, { "id": "r-kowski-noal", "from": "kowski", "to": "noal", "role": "Co-founder of the fund", "period": "2017", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-buy-holdco-luxco" ], "kind": "other" }, { "id": "r-lueken-noal", "from": "lueken", "to": "noal", "role": "Co-founder of the fund", "period": "2017", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-buy-holdco-luxco" ], "kind": "other" }, { "id": "r-peel-noal", "from": "peel", "to": "noal", "role": "Co-founder of the fund", "period": "2017", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-buy-holdco-luxco" ], "kind": "other" }, { "id": "r-oregon-noal", "from": "oregon", "to": "noal", "role": "Limited partner (18% of commitments); led the investors who moved the fund to BRG", "period": "From 2017", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-buy-fund-lps", "c-brg-takeover", "c-brg-board-control" ], "kind": "owns" }, { "id": "r-alaska-noal", "from": "alaska", "to": "noal", "role": "Limited partner (5.1% of commitments)", "period": "From 2017", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-buy-fund-lps", "c-brg-board-control" ], "kind": "owns" }, { "id": "r-southyorks-noal", "from": "south-yorkshire", "to": "noal", "role": "Limited partner (2.7% of commitments)", "period": "From 2017", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-buy-fund-lps" ], "kind": "owns" }, { "id": "r-eastriding-noal", "from": "east-riding", "to": "noal", "role": "Limited partner (1.4% of commitments)", "period": "From 2017", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-buy-fund-lps" ], "kind": "owns" }, { "id": "r-centerbridge-noal", "from": "centerbridge", "to": "noal", "role": "Limited partner", "period": "As reported in 2022", "status": "reported", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-brg-board-control" ], "kind": "owns" }, { "id": "r-mubadala-noal", "from": "mubadala", "to": "noal", "role": "Reported to be one of the largest investors in the fund", "period": "From 2019, as reported in April 2022", "status": "reported", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-rel-mubadala" ], "kind": "owns" }, { "id": "r-brg-novalpina", "from": "brg", "to": "novalpina", "role": "Replaced Novalpina as manager of the fund holding the NSO stake", "period": "From July-August 2021", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "historical", "claim_ids": [ "c-brg-takeover", "c-brg-board-control" ], "kind": "other" }, { "id": "r-brg-noal", "from": "brg", "to": "noal", "role": "Manager of the fund, through its affiliated general partner", "period": "From 27 August 2021", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-brg-takeover", "c-brg-investigations", "c-brg-board-control" ], "kind": "other" }, { "id": "r-treo-noal", "from": "treo-gp", "to": "noal", "role": "General partner", "period": "From 27 August 2021; still general partner in June 2025", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-brg-takeover", "c-brg-fund-suits", "c-brg-financial-crisis" ], "kind": "other" }, { "id": "r-brg-nso", "from": "brg", "to": "nso", "role": "Manager of the fund holding the majority stake; appointed directors to NSO's board", "period": "27 August 2021 - February 2023", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "historical", "claim_ids": [ "c-brg-investigations", "c-brg-board-control", "c-ctl-foreclosure-2023", "c-brg-convexum" ], "kind": "other" }, { "id": "r-brg-nso-dispute", "from": "brg", "to": "nso", "role": "Party to the 2022 Tel Aviv court dispute with NSO's management and lenders over information and a sale", "period": "2022", "status": "documented", "direction": "directed", "role_group": "legal", "temporal_status": "historical", "claim_ids": [ "c-brg-information-dispute", "c-brg-convexum" ], "kind": "legal" }, { "id": "r-brg-convexum", "from": "brg", "to": "convexum", "role": "Applicant for the appointment of a temporary trustee, granted by the Tel Aviv District Court", "period": "January 2022", "status": "documented", "direction": "directed", "role_group": "legal", "temporal_status": "historical", "claim_ids": [ "c-brg-convexum" ], "kind": "legal" }, { "id": "r-oconnor-brg", "from": "oconnor", "to": "brg", "role": "Partner", "period": "As reported in 2022", "status": "reported", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-brg-board-control" ], "kind": "employs" }, { "id": "r-novalpina-brg", "from": "novalpina", "to": "brg", "role": "Novalpina's former general partners sued BRG in Luxembourg seeking reinstatement (demands dismissed)", "period": "April 2022", "status": "documented", "direction": "directed", "role_group": "legal", "temporal_status": "historical", "claim_ids": [ "c-brg-luxembourg-suits" ], "kind": "legal" }, { "id": "r-noal-novalpina", "from": "noal", "to": "novalpina", "role": "The fund and its vehicles brought proceedings against Novalpina in Luxembourg (veto-right dispute and criminal complaint)", "period": "2022", "status": "documented", "direction": "directed", "role_group": "legal", "temporal_status": "historical", "claim_ids": [ "c-brg-luxembourg-suits" ], "kind": "legal" }, { "id": "r-kowski-novalpina", "from": "kowski", "to": "novalpina", "role": "Ultimate controller and beneficiary of the Novalpina group (the fund's general partner's statement)", "period": "As stated in November 2022", "status": "reported", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-brg-luxembourg-suits" ], "kind": "other" }, { "id": "r-lueken-novalpina", "from": "lueken", "to": "novalpina", "role": "Ultimate controller and beneficiary of the Novalpina group (the fund's general partner's statement)", "period": "As stated in November 2022", "status": "reported", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-brg-luxembourg-suits" ], "kind": "other" }, { "id": "r-schmidt-novalpina", "from": "schmidt", "to": "novalpina", "role": "Investor (EUR 5 million in 2017), chairman and adviser on the NSO deal, as reported; former director of its ultimate parent", "period": "From 2017", "status": "reported", "direction": "directed", "role_group": "business", "temporal_status": "unknown", "claim_ids": [ "c-brg-schmidt", "c-brg-luxembourg-suits" ], "kind": "other" }, { "id": "r-schmidt-novgroup", "from": "schmidt", "to": "novalpina-group", "role": "Non-executive chairman and director (as reported)", "period": "As reported in 2025", "status": "reported", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-brg-schmidt" ], "kind": "directs" }, { "id": "r-schmidt-weil", "from": "schmidt", "to": "weil", "role": "Partner", "period": "As reported in 2025", "status": "reported", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-brg-schmidt" ], "kind": "employs" }, { "id": "r-noal-kowski", "from": "noal", "to": "kowski", "role": "Criminal complaint (May 2022) and English damages claim for conspiracy against Novalpina's founders", "period": "From 2022", "status": "documented", "direction": "directed", "role_group": "legal", "temporal_status": "unknown", "claim_ids": [ "c-brg-luxembourg-suits", "c-brg-fund-suits" ], "kind": "legal" }, { "id": "r-noal-lueken", "from": "noal", "to": "lueken", "role": "Criminal complaint (May 2022) and English damages claim for conspiracy against Novalpina's founders", "period": "From 2022", "status": "documented", "direction": "directed", "role_group": "legal", "temporal_status": "unknown", "claim_ids": [ "c-brg-luxembourg-suits", "c-brg-fund-suits" ], "kind": "legal" }, { "id": "r-noal-peel", "from": "noal", "to": "peel", "role": "English damages claim for conspiracy against Novalpina's founders", "period": "Pending in March 2025", "status": "documented", "direction": "directed", "role_group": "legal", "temporal_status": "unknown", "claim_ids": [ "c-brg-fund-suits" ], "kind": "legal" }, { "id": "r-noal-schmidt", "from": "noal", "to": "schmidt", "role": "Criminal complaint with civil-party joinder for abuse of powers", "period": "From 6 May 2022", "status": "documented", "direction": "directed", "role_group": "legal", "temporal_status": "unknown", "claim_ids": [ "c-brg-luxembourg-suits" ], "kind": "legal" }, { "id": "r-noal-weil", "from": "noal", "to": "weil", "role": "Discovery applicant (through its general partner) against, in New York (1:25-mc-00133)", "period": "March 2025", "status": "documented", "direction": "directed", "role_group": "legal", "temporal_status": "unknown", "claim_ids": [ "c-brg-fund-suits" ], "kind": "legal" }, { "id": "r-dufresne-newco", "from": "dufresne", "to": "northpole-newco", "role": "Sole shareholder (100%)", "period": "24 February 2023 - 8 October 2025", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "historical", "claim_ids": [ "c-ctl-dufresne-register", "c-ctl-foreclosure-2023", "c-ctl-newco-oct-2025", "c-ctl-lavie-mandates-2023" ], "kind": "owns" }, { "id": "r-dufresne-nso", "from": "dufresne", "to": "nso", "role": "Indirect controlling shareholder through NorthPole Newco (as reported by the press)", "period": "February 2023 - October 2025", "status": "reported", "direction": "directed", "role_group": "ownership", "temporal_status": "historical", "claim_ids": [ "c-ctl-press-2023", "c-ctl-foreclosure-2023", "c-ctl-simonds-2023" ], "kind": "owns" }, { "id": "r-lavie-dufresne", "from": "lavie", "to": "dufresne", "role": "Sole shareholder (partner)", "period": "From registration on 27 January 2023; listed in 2023 and 2024", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-ctl-dufresne-register", "c-ctl-foreclosure-2023", "c-ctl-press-2023" ], "kind": "owns" }, { "id": "r-lavie-dufresne-mgr", "from": "lavie", "to": "dufresne", "role": "Manager", "period": "From 27 January 2023; listed again in a publication of 17 August 2026", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "current", "claim_ids": [ "c-ctl-dufresne-register", "c-ctl-lavie-mandates-2023" ], "kind": "directs" }, { "id": "r-simonds-dufresne", "from": "simonds", "to": "dufresne", "role": "Manager (member of the holding company's board)", "period": "16 March - 17 August 2023", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-ctl-dufresne-register", "c-ctl-simonds-2023" ], "kind": "directs" }, { "id": "r-lavie-newco", "from": "lavie", "to": "northpole-newco", "role": "Manager", "period": "From 17-24 February 2023 until 8 October 2025 (published 7 November 2025)", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-ctl-dufresne-register", "c-ctl-newco-pledge-2023", "c-ctl-lavie-mandates-2023", "c-ctl-newco-oct-2025", "c-ctl-lux-press-2026" ], "kind": "directs" }, { "id": "r-alevy-newco", "from": "anthony-levy", "to": "northpole-newco", "role": "Manager", "period": "December 2021 - January 2023, and from 15 March 2023", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-ppl-anthony-levy", "c-brg-makarenko-register", "c-ctl-newco-pledge-2023", "c-ctl-lavie-mandates-2023" ], "kind": "directs" }, { "id": "r-makarenko-newco", "from": "makarenko", "to": "northpole-newco", "role": "Manager", "period": "22 December 2021 - 4 January 2022, and from 29 December 2022", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-brg-makarenko-register" ], "kind": "directs" }, { "id": "r-bornstein-newco", "from": "bornstein", "to": "northpole-newco", "role": "Manager", "period": "From 29 December 2022", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-brg-makarenko-register" ], "kind": "directs" }, { "id": "r-dumont-newco", "from": "dumont", "to": "northpole-newco", "role": "Manager", "period": "Until 22 December 2021", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-brg-makarenko-register" ], "kind": "directs" }, { "id": "r-somekh-newco", "from": "somekh", "to": "northpole-newco", "role": "Manager", "period": "As described in register summaries", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-ppl-somekh-dumont" ], "kind": "directs" }, { "id": "r-dumont-holdco", "from": "dumont", "to": "northpole-holdco", "role": "Manager", "period": "30 November 2018 - 1 March 2022 (with interruptions in 2021)", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-buy-holdco-register" ], "kind": "directs" }, { "id": "r-makarenko-holdco", "from": "makarenko", "to": "northpole-holdco", "role": "Manager", "period": "From 24 February 2022", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-buy-holdco-register" ], "kind": "directs" }, { "id": "r-ward-holdco", "from": "ward", "to": "northpole-holdco", "role": "Manager", "period": "From 20 October 2022", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-buy-holdco-register" ], "kind": "directs" }, { "id": "r-dumont-emerald", "from": "dumont", "to": "emerald", "role": "Type A manager", "period": "From 30 November 2020", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-ppl-somekh-dumont" ], "kind": "directs" }, { "id": "r-dumont-diamond", "from": "dumont", "to": "diamond", "role": "Type A manager", "period": "From 30 November 2020", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-ppl-somekh-dumont" ], "kind": "directs" }, { "id": "r-somekh-emerald", "from": "somekh", "to": "emerald", "role": "Manager", "period": "As described in register summaries", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-ppl-somekh-dumont" ], "kind": "directs" }, { "id": "r-somekh-diamond", "from": "somekh", "to": "diamond", "role": "Manager", "period": "As described in register summaries", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-ppl-somekh-dumont" ], "kind": "directs" }, { "id": "r-schremer-newco", "from": "schremer", "to": "northpole-newco", "role": "Sole shareholder (100%)", "period": "8 October - 8 December 2025, and again from 30 December 2025", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-ctl-newco-oct-2025", "c-ctl-pledge-dec-2025", "c-ctl-sale-back-dec-2025", "c-ctl-lux-press-2026" ], "kind": "owns" }, { "id": "r-hippocrene-newco", "from": "hippocrene", "to": "northpole-newco", "role": "Sole shareholder (100%) after realising a pledge over Schremer's shares; sold them back to him", "period": "8 - 30 December 2025", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "historical", "claim_ids": [ "c-ctl-pledge-dec-2025", "c-ctl-sale-back-dec-2025", "c-ctl-lux-press-2026" ], "kind": "owns" }, { "id": "r-schremer-newco-mgr", "from": "schremer", "to": "northpole-newco", "role": "Manager", "period": "From 8 October 2025", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-ctl-newco-oct-2025", "c-ctl-debt-purchase" ], "kind": "directs" }, { "id": "r-schremer-osy", "from": "schremer", "to": "osy", "role": "Manager", "period": "From 8 October 2025", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-ctl-osy-oct-2025", "c-ctl-debt-purchase" ], "kind": "directs" }, { "id": "r-schremer-qcl", "from": "schremer", "to": "qcyber-lux", "role": "Manager", "period": "From 8 October 2025", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-ctl-qcl-oct-2025", "c-ctl-debt-purchase" ], "kind": "directs" }, { "id": "r-simonds-nso", "from": "simonds", "to": "nso", "role": "Reported head of the US investor group that acquired a controlling stake", "period": "From October 2025", "status": "reported", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-ctl-us-investors-2025", "c-ctl-founders-out" ], "kind": "other" }, { "id": "r-friedman-nso", "from": "friedman", "to": "nso", "role": "Reported as NSO's executive chairman (chairman of its holding company)", "period": "From November 2025", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-ctl-transparency-2025", "c-ctl-friedman-statements", "c-ctl-debt-purchase", "c-exp-congress-letter", "c-ctl-friedman-appointment" ], "kind": "directs" }, { "id": "r-friedman-osy", "from": "friedman", "to": "osy", "role": "Manager and member of the executive board", "period": "From 15 December 2025 (notice of 30 December 2025)", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-ctl-friedman-appointment", "c-lux-osy-managers" ], "kind": "directs" }, { "id": "r-lavie-nso-chair", "from": "lavie", "to": "nso", "role": "Executive chairman (co-founder); removed after the October 2025 change of control", "period": "Until October-November 2025", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-ctl-us-investors-2025", "c-ctl-transparency-2025", "c-ctl-debt-purchase" ], "kind": "directs" }, { "id": "r-gorev-osy", "from": "gorev", "to": "osy", "role": "Manager", "period": "16 December 2014 - 12 April 2019", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-buy-boards-april-2019", "c-ppl-gorev" ], "kind": "directs" }, { "id": "r-wilson-osy", "from": "kevin-wilson", "to": "osy", "role": "Manager", "period": "27 November 2015 - 12 April 2019", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-buy-boards-april-2019" ], "kind": "directs" }, { "id": "r-peel-osy", "from": "peel", "to": "osy", "role": "Class A manager", "period": "1 April 2019 - 13 September 2021", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-buy-boards-april-2019", "c-lux-osy-managers" ], "kind": "directs" }, { "id": "r-schmidt-osy", "from": "schmidt", "to": "osy", "role": "Class A manager", "period": "1 April 2019 - 25 August 2021", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-buy-boards-april-2019", "c-lux-osy-managers" ], "kind": "directs" }, { "id": "r-kowski-osy", "from": "kowski", "to": "osy", "role": "Class A manager", "period": "1 April 2019 - 20 September 2021", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-buy-boards-april-2019", "c-lux-osy-managers" ], "kind": "directs" }, { "id": "r-hulio-osy", "from": "hulio", "to": "osy", "role": "Class B manager", "period": "From 1 April 2019 (NGO report)", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-buy-boards-april-2019", "c-oc-barcelona-2025" ], "kind": "directs" }, { "id": "r-lavie-osy", "from": "lavie", "to": "osy", "role": "Manager (class B from April 2019; manager again from February 2023)", "period": "1 April 2019 onwards; February 2023 - removal published 30 October 2025", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-buy-boards-april-2019", "c-ctl-newco-pledge-2023", "c-lux-osy-managers", "c-ctl-lavie-mandates-2023", "c-ctl-osy-oct-2025", "c-ctl-lux-press-2026" ], "kind": "directs" }, { "id": "r-somekh-osy", "from": "somekh", "to": "osy", "role": "Manager", "period": "Until 4 November 2021", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-lux-osy-managers" ], "kind": "directs" }, { "id": "r-asherlevy-osy", "from": "asher-levy", "to": "osy", "role": "Manager", "period": "17 September 2020 - 4 January 2022", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-lux-osy-managers" ], "kind": "directs" }, { "id": "r-alevy-osy", "from": "anthony-levy", "to": "osy", "role": "Manager", "period": "From December 2021 and from 15 March 2023; named again in October 2025", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-lux-osy-managers", "c-ctl-newco-pledge-2023", "c-ctl-osy-oct-2025", "c-ppl-anthony-levy", "c-ctl-lavie-mandates-2023" ], "kind": "directs" }, { "id": "r-flynn-osy", "from": "flynn", "to": "osy", "role": "Advisory board member (paid $40,280 in 2016)", "period": "2016", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-ppl-flynn" ], "kind": "directs" }, { "id": "r-osy-qcl", "from": "osy", "to": "qcyber-lux", "role": "Shareholder (sole partner); receives its dividends", "period": "From registration on 8 January 2016", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-lux-qcl-identity", "c-lux-trademarks", "c-lux-dividends-loan", "c-buy-chain-april-2019" ], "kind": "owns" }, { "id": "r-qcl-osy-loan", "from": "qcyber-lux", "to": "osy", "role": "Lender of a short-term facility of up to USD 300 million (USD 163.7 million owed at the end of 2024)", "period": "Extended in June 2023 to 30 June 2025", "status": "documented", "direction": "directed", "role_group": "business", "temporal_status": "unknown", "claim_ids": [ "c-lux-dividends-loan" ], "kind": "business" }, { "id": "r-gorev-qcl", "from": "gorev", "to": "qcyber-lux", "role": "Manager", "period": "8 January 2016 - 2019", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-lux-qcl-identity", "c-ppl-gorev" ], "kind": "directs" }, { "id": "r-wilson-qcl", "from": "kevin-wilson", "to": "qcyber-lux", "role": "Manager", "period": "8 January 2016 - 2019", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-lux-qcl-identity" ], "kind": "directs" }, { "id": "r-somekh-qcl", "from": "somekh", "to": "qcyber-lux", "role": "Manager", "period": "From 8 January 2016", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-lux-qcl-identity", "c-ppl-somekh-dumont" ], "kind": "directs" }, { "id": "r-demaigret-qcl", "from": "de-maigret", "to": "qcyber-lux", "role": "Manager", "period": "From 20 August 2019", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-lux-qcl-identity", "c-ppl-de-maigret" ], "kind": "directs" }, { "id": "r-hulio-qcl", "from": "hulio", "to": "qcyber-lux", "role": "Manager (recorded as \"Shalev Holy\")", "period": "From 20 August 2019", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-lux-qcl-identity", "c-oc-barcelona-2025" ], "kind": "directs" }, { "id": "r-lavie-qcl", "from": "lavie", "to": "qcyber-lux", "role": "Manager", "period": "From 23 February 2023 until removal published 28 October 2025", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-ctl-lavie-mandates-2023", "c-ctl-qcl-oct-2025", "c-ctl-lux-press-2026", "c-oc-barcelona-2025" ], "kind": "directs" }, { "id": "r-alevy-qcl", "from": "anthony-levy", "to": "qcyber-lux", "role": "Manager (from 15 March 2023) and delegate for day-to-day management (from 5 June 2023)", "period": "From 15 March 2023", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-ctl-qcl-oct-2025", "c-ppl-anthony-levy", "c-ctl-lavie-mandates-2023" ], "kind": "directs" }, { "id": "r-qcl-nso", "from": "qcyber-lux", "to": "nso", "role": "Commercial distributor of the group's products: signs contracts, invoices and collects payment from customers (NSO Group's description)", "period": "From 2016", "status": "reported", "direction": "directed", "role_group": "business", "temporal_status": "unknown", "claim_ids": [ "c-lux-distributor" ], "kind": "business" }, { "id": "r-osy-westbridge", "from": "osy", "to": "westbridge", "role": "Holder of the equity interests (pledged to the lenders' collateral agent since 8 April 2019)", "period": "From 2019", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-lux-pledges", "c-rel-westbridge-ownership", "c-buy-chain-april-2019" ], "kind": "owns" }, { "id": "r-osy-westbridge-loan", "from": "osy", "to": "westbridge", "role": "Lender (facility with principal USD 1.59 million at the end of 2024)", "period": "As of the 2024 accounts", "status": "documented", "direction": "directed", "role_group": "business", "temporal_status": "unknown", "claim_ids": [ "c-lux-osy-loans-out" ], "kind": "business" }, { "id": "r-osy-gideon", "from": "osy", "to": "gideon", "role": "Lender under a revolving credit facility of up to USD 2 million", "period": "From 31 August 2021", "status": "documented", "direction": "directed", "role_group": "business", "temporal_status": "unknown", "claim_ids": [ "c-lux-osy-loans-out" ], "kind": "business" }, { "id": "r-lavie-square2", "from": "lavie", "to": "square2", "role": "Class B manager", "period": "From 1 April 2019", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-buy-boards-april-2019" ], "kind": "directs" }, { "id": "r-hulio-square2", "from": "hulio", "to": "square2", "role": "Class B manager", "period": "From 1 April 2019", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-buy-boards-april-2019" ], "kind": "directs" }, { "id": "r-somekh-square2", "from": "somekh", "to": "square2", "role": "Class B manager", "period": "From 1 April 2019", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-buy-boards-april-2019" ], "kind": "directs" }, { "id": "r-peel-square2", "from": "peel", "to": "square2", "role": "Class A manager", "period": "From 1 April 2019", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-buy-boards-april-2019" ], "kind": "directs" }, { "id": "r-kowski-square2", "from": "kowski", "to": "square2", "role": "Class A manager", "period": "From 1 April 2019", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-buy-boards-april-2019" ], "kind": "directs" }, { "id": "r-schmidt-square2", "from": "schmidt", "to": "square2", "role": "Class A manager", "period": "From 1 April 2019", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-buy-boards-april-2019" ], "kind": "directs" }, { "id": "r-hulio-nso-founder", "from": "hulio", "to": "nso", "role": "Co-founder", "period": "2009-2010", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-ppl-founders", "c-ppl-hulio-ceo", "c-cus-panama" ], "kind": "other" }, { "id": "r-lavie-nso-founder", "from": "lavie", "to": "nso", "role": "Co-founder", "period": "2010", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-ppl-founders", "c-tax-lavie-testimony" ], "kind": "other" }, { "id": "r-karmi-nso-founder", "from": "karmi", "to": "nso", "role": "Co-founder; left the company early and no longer affiliated by 2021", "period": "2010", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-ppl-founders", "c-ctl-founders-out" ], "kind": "other" }, { "id": "r-eshalev-nso", "from": "eddy-shalev", "to": "nso", "role": "Initial investor", "period": "From the founding period", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "historical", "claim_ids": [ "c-ppl-founders", "c-rel-convexum" ], "kind": "owns" }, { "id": "r-hulio-nso-ceo", "from": "hulio", "to": "nso", "role": "Vice-president of marketing, then chief executive (from March 2016)", "period": "December 2009 - August 2022", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-ppl-hulio-ceo", "c-buy-announcement", "c-cus-spain", "c-cus-panama", "c-ppl-shohat" ], "kind": "employs" }, { "id": "r-hulio-nso-influence", "from": "hulio", "to": "nso", "role": "Alleged by respondents in the 2023 Tel Aviv case to remain involved in decision-making through the chief executive after resigning", "period": "Alleged in January 2023", "status": "reported", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-brg-objection" ], "kind": "other" }, { "id": "r-lavie-nso-alleged", "from": "lavie", "to": "nso", "role": "Alleged in the Khashoggi complaint to run NSO and Q Cyber in all respects", "period": "Alleged in 2023", "status": "reported", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-us-khashoggi-structure" ], "kind": "other" }, { "id": "r-gorev-nso", "from": "gorev", "to": "nso", "role": "Chairman", "period": "2014-2019", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-ppl-gorev", "c-str-triangle-square2" ], "kind": "directs" }, { "id": "r-asherlevy-nso", "from": "asher-levy", "to": "nso", "role": "Executive chairman", "period": "1 April 2020 - January 2022", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-ppl-asher-levy", "c-buy-triangle-board-dec-2019", "c-brg-board-control" ], "kind": "directs" }, { "id": "r-shohat-nso", "from": "shohat", "to": "nso", "role": "Chief executive", "period": "August 2022 - stepped down by January 2026", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-ppl-shohat", "c-ppl-hulio-ceo", "c-wa-injunction", "c-wa-declarants", "c-ctl-transparency-2025", "c-brg-objection" ], "kind": "employs" }, { "id": "r-shohat-nso-coo", "from": "shohat", "to": "nso", "role": "Chief operating officer", "period": "Before August 2022", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-ppl-shohat" ], "kind": "employs" }, { "id": "r-shiridolev-nso", "from": "shiri-dolev", "to": "nso", "role": "President of NSO Group", "period": "As described in 2023", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-ppl-hulio-dream" ], "kind": "employs" }, { "id": "r-bash-nso", "from": "bash", "to": "nso", "role": "Reported member of NSO's business ethics committee", "period": "Under Francisco Partners' ownership", "status": "reported", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-ppl-bash" ], "kind": "directs" }, { "id": "r-nso-beacon", "from": "nso", "to": "beacon", "role": "Client of Beacon Global Strategies (advisory work through Francisco Partners, later ended)", "period": "Under Francisco Partners' ownership", "status": "reported", "direction": "directed", "role_group": "business", "temporal_status": "historical", "claim_ids": [ "c-ppl-bash" ], "kind": "business" }, { "id": "r-bash-beacon", "from": "bash", "to": "beacon", "role": "Co-founder and managing director", "period": "From 2013", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-ppl-bash" ], "kind": "other" }, { "id": "r-nso-convexum", "from": "nso", "to": "convexum", "role": "Owner (acquired in February 2020 for $60 million); later reported to be controlled in practice by Triangle and separated after a court dispute", "period": "From February 2020", "status": "documented", "direction": "directed", "role_group": "ownership", "temporal_status": "unknown", "claim_ids": [ "c-rel-convexum", "c-brg-convexum" ], "kind": "owns" }, { "id": "r-westbridge-nso", "from": "westbridge", "to": "nso", "role": "US marketing and sales affiliate (called NSO's US sales arm in the WhatsApp complaint; the defendants say it is an affiliate under the same ultimate parent, not NSO's subsidiary)", "period": "Reported 2016-2023", "status": "documented", "direction": "directed", "role_group": "associations", "temporal_status": "unknown", "claim_ids": [ "c-rel-westbridge-sales", "c-us-khashoggi-structure", "c-rel-westbridge-ownership" ], "kind": "business" }, { "id": "r-westbridge-qcyber", "from": "westbridge", "to": "qcyber", "role": "Described as the US affiliate of Q Cyber Technologies (former president's profile cited in the 2021 report)", "period": "As reported in 2021", "status": "reported", "direction": "directed", "role_group": "associations", "temporal_status": "unknown", "claim_ids": [ "c-rel-westbridge" ], "kind": "business" }, { "id": "r-lavie-westbridge", "from": "lavie", "to": "westbridge", "role": "President or vice-president named in corporate documents", "period": "From 2014 (as described in the 2021 report)", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-rel-westbridge" ], "kind": "directs" }, { "id": "r-divittorio-westbridge", "from": "divittorio", "to": "westbridge", "role": "Former president", "period": "Before 2021", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-rel-westbridge", "c-wa-westbridge-motion" ], "kind": "employs" }, { "id": "r-francisco-westbridge", "from": "francisco", "to": "westbridge", "role": "Indirect majority owner until 2019 as described by the report and a company brochure; Francisco Partners says it never held a direct interest and its indirect interest ended on 18 March 2019", "period": "Until 18 March 2019", "status": "reported", "direction": "directed", "role_group": "ownership", "temporal_status": "historical", "claim_ids": [ "c-rel-westbridge", "c-rel-westbridge-ownership" ], "kind": "other" }, { "id": "r-westbridge-whatsapp", "from": "westbridge", "to": "whatsapp", "role": "Third party moving for clarification in the WhatsApp case, opposed by the plaintiffs", "period": "In the WhatsApp case", "status": "documented", "direction": "directed", "role_group": "legal", "temporal_status": "unknown", "claim_ids": [ "c-wa-westbridge-motion" ], "kind": "legal" }, { "id": "r-deca-nso", "from": "deca", "to": "nso", "role": "Licensing authority for NSO's marketing and exports (defence export licences)", "period": "Ongoing; described in 2019-2025 records", "status": "documented", "direction": "directed", "role_group": "legal", "temporal_status": "current", "claim_ids": [ "c-exp-deca-regime", "c-exp-mod-2021", "c-oc-malekar", "c-brg-information-dispute", "c-ctl-us-investors-2025" ], "kind": "legal" }, { "id": "r-nso-deca-respondents", "from": "nso", "to": "deca", "role": "Co-respondents in the petition to revoke NSO's export licence (rejected on 12 July 2020)", "period": "2019-2020", "status": "documented", "direction": "undirected", "role_group": "legal", "temporal_status": "historical", "claim_ids": [ "c-oc-malekar" ], "kind": "legal" }, { "id": "r-bis-nso", "from": "bis", "to": "nso", "role": "Added \"NSO Group\" to the Entity List at the Herzliya address shared with Q Cyber, without a register number (licence requirement with a presumption of denial)", "period": "From November 2021; in force in the 2026 version", "status": "documented", "direction": "directed", "role_group": "legal", "temporal_status": "current", "claim_ids": [ "c-exp-entity-list", "c-exp-entity-list-current", "c-exp-csl", "c-exp-delisting-efforts", "c-exp-congress-letter" ], "kind": "legal" }, { "id": "r-circles-qcyber", "from": "circles", "to": "qcyber", "role": "Licensed Bulgarian exports to Q Cyber Technologies in Israel (licensing records 2018-2023, as reported)", "period": "2018-2023", "status": "reported", "direction": "directed", "role_group": "business", "temporal_status": "historical", "claim_ids": [ "c-exp-circles-licences-2026" ], "kind": "business" }, { "id": "r-circles-nso", "from": "circles", "to": "nso", "role": "Affiliated company (Sofia-based Circles BG); licensed exports to NSO Group in Israel (as reported)", "period": "2018-2023", "status": "reported", "direction": "undirected", "role_group": "associations", "temporal_status": "unknown", "claim_ids": [ "c-exp-circles-licences-2026" ], "kind": "other" }, { "id": "r-nso-infraloks", "from": "nso", "to": "infraloks", "role": "System provider to the Ghanaian reseller (agreement and service level agreement of 17 December 2015)", "period": "From 17 December 2015", "status": "documented", "direction": "directed", "role_group": "business", "temporal_status": "unknown", "claim_ids": [ "c-cus-ghana" ], "kind": "business" }, { "id": "r-nso-ghana", "from": "nso", "to": "ghana-nca", "role": "Provider of a Pegasus system for the end user through the reseller (agreement of 17 December 2015)", "period": "From 17 December 2015", "status": "documented", "direction": "directed", "role_group": "business", "temporal_status": "unknown", "claim_ids": [ "c-cus-ghana" ], "kind": "business" }, { "id": "r-infraloks-ghana", "from": "infraloks", "to": "ghana-nca", "role": "Reseller supplying the system to the end user", "period": "From 17 December 2015", "status": "documented", "direction": "directed", "role_group": "business", "temporal_status": "unknown", "claim_ids": [ "c-cus-ghana" ], "kind": "business" }, { "id": "r-nso-cba", "from": "nso", "to": "cba", "role": "Supplier of the spyware bought by the bureau in 2017 through an intermediary (purchase confirmed in January 2022)", "period": "2017", "status": "reported", "direction": "directed", "role_group": "business", "temporal_status": "historical", "claim_ids": [ "c-cus-poland" ], "kind": "business" }, { "id": "r-nso-matic", "from": "nso", "to": "matic", "role": "Supplier in a purchase made through Matic as intermediary", "period": "2017", "status": "reported", "direction": "directed", "role_group": "business", "temporal_status": "historical", "claim_ids": [ "c-cus-poland" ], "kind": "business" }, { "id": "r-matic-cba", "from": "matic", "to": "cba", "role": "Intermediary that invoiced the purchase of spyware for PLN 25 million", "period": "2017", "status": "reported", "direction": "directed", "role_group": "business", "temporal_status": "historical", "claim_ids": [ "c-cus-poland" ], "kind": "business" }, { "id": "r-nso-hungary", "from": "nso", "to": "hungary-moi", "role": "Supplier of Pegasus bought indirectly in 2017 for EUR 6 million", "period": "2017", "status": "reported", "direction": "directed", "role_group": "business", "temporal_status": "historical", "claim_ids": [ "c-cus-hungary" ], "kind": "business" }, { "id": "r-commtech-nso", "from": "comm-tech", "to": "nso", "role": "Intermediary in the Interior Ministry's purchase of Pegasus", "period": "2017", "status": "reported", "direction": "directed", "role_group": "business", "temporal_status": "historical", "claim_ids": [ "c-cus-hungary" ], "kind": "business" }, { "id": "r-nso-bka", "from": "nso", "to": "bka", "role": "Supplier of a modified version of Pegasus", "period": "Late 2020", "status": "reported", "direction": "directed", "role_group": "business", "temporal_status": "unknown", "claim_ids": [ "c-cus-germany" ], "kind": "business" }, { "id": "r-nso-luxgov", "from": "nso", "to": "lux-gov", "role": "Supplier of Pegasus (purchase and use confirmed by the Prime Minister in October 2021)", "period": "As confirmed in October 2021", "status": "reported", "direction": "directed", "role_group": "business", "temporal_status": "unknown", "claim_ids": [ "c-cus-luxembourg" ], "kind": "business" }, { "id": "r-nso-panama", "from": "nso", "to": "panama", "role": "Supplier of Pegasus under a 2012 contract (as reported)", "period": "2012", "status": "reported", "direction": "directed", "role_group": "business", "temporal_status": "historical", "claim_ids": [ "c-cus-panama" ], "kind": "business" }, { "id": "r-nso-fbi", "from": "nso", "to": "fbi", "role": "Licensed the use of Pegasus to the FBI in 2018 (as stated in court papers)", "period": "2018", "status": "reported", "direction": "directed", "role_group": "business", "temporal_status": "historical", "claim_ids": [ "c-wa-us-use-argument" ], "kind": "business" }, { "id": "r-nso-djibouti", "from": "nso", "to": "djibouti", "role": "Licensed Pegasus to Djibouti with CIA assistance (as stated in court papers)", "period": "2018", "status": "reported", "direction": "directed", "role_group": "business", "temporal_status": "historical", "claim_ids": [ "c-wa-us-use-argument" ], "kind": "business" }, { "id": "r-nso-bahrain", "from": "nso", "to": "bahrain", "role": "Customer, according to NSO's assertion recorded by the Ninth Circuit", "period": "As asserted in 2020-2021", "status": "reported", "direction": "directed", "role_group": "business", "temporal_status": "unknown", "claim_ids": [ "c-wa-ninth-circuit" ], "kind": "business" }, { "id": "r-nso-uae", "from": "nso", "to": "uae", "role": "Customer, according to NSO's assertion recorded by the Ninth Circuit", "period": "As asserted in 2020-2021", "status": "reported", "direction": "directed", "role_group": "business", "temporal_status": "unknown", "claim_ids": [ "c-wa-ninth-circuit" ], "kind": "business" }, { "id": "r-nso-mexico", "from": "nso", "to": "mexico", "role": "Customer, according to NSO's assertion recorded by the Ninth Circuit", "period": "As asserted in 2020-2021", "status": "reported", "direction": "directed", "role_group": "business", "temporal_status": "unknown", "claim_ids": [ "c-wa-ninth-circuit" ], "kind": "business" }, { "id": "r-nso-fssys", "from": "nso", "to": "fssys", "role": "Reported supplier to Morocco's DGST through the intermediary FSSYS Maroc", "period": "As reported in 2026", "status": "reported", "direction": "directed", "role_group": "business", "temporal_status": "unknown", "claim_ids": [ "c-cus-morocco" ], "kind": "business" }, { "id": "r-ability-nso", "from": "ability", "to": "nso", "role": "Cooperated on Pegasus, handling the network side of NSO's operations (inquiry report)", "period": "As described in 2023", "status": "reported", "direction": "directed", "role_group": "business", "temporal_status": "unknown", "claim_ids": [ "c-cus-ability" ], "kind": "business" }, { "id": "r-hulio-blackcube", "from": "hulio", "to": "black-cube", "role": "Hired Black Cube in at least one situation in Cyprus (admitted, per the inquiry report)", "period": "Before 2023", "status": "reported", "direction": "directed", "role_group": "business", "temporal_status": "historical", "claim_ids": [ "c-ppl-hulio-black-cube" ], "kind": "business" }, { "id": "r-gorev-francisco", "from": "gorev", "to": "francisco", "role": "Partner and president of Israel", "period": "From 2014", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "current", "claim_ids": [ "c-ppl-gorev", "c-buy-fp-exit", "c-tax-lavie-testimony" ], "kind": "employs" }, { "id": "r-hulio-founders", "from": "hulio", "to": "founders-group", "role": "Partner and chief executive", "period": "Partner from 2014; chief executive in 2017", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-ppl-hulio-ceo", "c-ppl-lavie-other" ], "kind": "employs" }, { "id": "r-lavie-founders", "from": "lavie", "to": "founders-group", "role": "Partner (investment firm of Lavie and Issac Zack)", "period": "As described in 2017", "status": "documented", "direction": "directed", "role_group": "associations", "temporal_status": "unknown", "claim_ids": [ "c-ppl-lavie-other" ], "kind": "other" }, { "id": "r-lavie-orchestra", "from": "lavie", "to": "orchestra", "role": "Co-founder and chief executive", "period": "From 2009", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-ppl-lavie-other" ], "kind": "other" }, { "id": "r-founders-orchestra", "from": "founders-group", "to": "orchestra", "role": "Financier", "period": "From 2017", "status": "documented", "direction": "directed", "role_group": "business", "temporal_status": "unknown", "claim_ids": [ "c-ppl-lavie-other" ], "kind": "business" }, { "id": "r-hulio-dream", "from": "hulio", "to": "dream", "role": "Co-founder and chief executive", "period": "From October 2022", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "current", "claim_ids": [ "c-ppl-hulio-dream" ], "kind": "other" }, { "id": "r-kurz-dream", "from": "kurz", "to": "dream", "role": "Co-founder", "period": "October 2022", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-ppl-hulio-dream" ], "kind": "other" }, { "id": "r-gildolev-dream", "from": "gil-dolev", "to": "dream", "role": "Co-founder", "period": "October 2022", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "historical", "claim_ids": [ "c-ppl-hulio-dream" ], "kind": "other" }, { "id": "r-hulio-kurz", "from": "hulio", "to": "kurz", "role": "Fellow co-founders of Dream Security", "period": "From October 2022", "status": "documented", "direction": "undirected", "role_group": "associations", "temporal_status": "unknown", "claim_ids": [ "c-ppl-hulio-dream" ], "kind": "other" }, { "id": "r-hulio-gildolev", "from": "hulio", "to": "gil-dolev", "role": "Fellow co-founders of Dream Security", "period": "From October 2022", "status": "documented", "direction": "undirected", "role_group": "associations", "temporal_status": "unknown", "claim_ids": [ "c-ppl-hulio-dream" ], "kind": "other" }, { "id": "r-dolev-siblings", "from": "gil-dolev", "to": "shiri-dolev", "role": "Siblings, as stated in the inquiry report", "period": "As stated in 2023", "status": "documented", "direction": "undirected", "role_group": "associations", "temporal_status": "unknown", "claim_ids": [ "c-ppl-hulio-dream" ], "kind": "family" }, { "id": "r-karmi-polus", "from": "karmi", "to": "polus", "role": "Founder (2016) and board member with signing authority", "period": "From 2016", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-ppl-karmi" ], "kind": "directs" }, { "id": "r-karmi-therian", "from": "karmi", "to": "therian", "role": "President of the board", "period": "From November-December 2020", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-ppl-karmi" ], "kind": "directs" }, { "id": "r-simonds-stx", "from": "simonds", "to": "stx", "role": "Founder and chairman", "period": "From 2014", "status": "documented", "direction": "directed", "role_group": "people", "temporal_status": "unknown", "claim_ids": [ "c-ppl-simonds", "c-ctl-simonds-2023" ], "kind": "other" } ], "history": [], "claims": [ { "id": "c-id-incorporation", "kind": "fact", "text": "Q Cyber Technologies Ltd is a private Israeli company, number 514971522. It was incorporated on 2 December 2013 as L.E.G.D. Company Ltd, and on 29 May 2016 the Israeli Registrar of Companies certified its change of name to Q Cyber Technologies Ltd.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-004" ], "entity_ids": [ "qcyber" ] }, { "id": "c-id-register", "kind": "fact", "text": "Copies of the Israeli companies register published by two Israeli company-information sites list Q Cyber Technologies Ltd as an active private limited company incorporated on 2 December 2013, with the stated purpose of engaging in any lawful business and a last annual report for 2025. One copy gives its address as Yael Man 1, Ramat HaSharon; the other gives its registered address as HaAluf Yitzhak Hofi 1, Ramat HaSharon.", "qualification": "Read from secondary copies of the register rather than the register itself; the two copies give different street addresses in Ramat HaSharon and neither records when the address changed.", "response": "", "outcome": "", "source_ids": [ "src-002", "src-003" ], "entity_ids": [ "qcyber" ] }, { "id": "c-id-address-2019", "kind": "fact", "text": "In its annual report to the Israeli Registrar of Companies updated to 7 January 2019, Q Cyber Technologies Ltd gave its address as 22 Galgalei Haplada, Herzliya, the same address that NSO Group Technologies Ltd gave in its own annual report updated to the same date.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-004" ], "entity_ids": [ "qcyber", "nso" ] }, { "id": "c-id-shared-address", "kind": "fact", "text": "The same register copies give NSO Group Technologies Ltd the same address as Q Cyber Technologies in each copy: Yael Man 1, Ramat HaSharon in one and HaAluf Yitzhak Hofi 1, Ramat HaSharon in the other, with a last annual report for 2025.", "qualification": "Secondary copies of the register; they show a shared address for the two companies, not which company occupies the premises.", "response": "", "outcome": "", "source_ids": [ "src-014", "src-113" ], "entity_ids": [ "nso", "qcyber" ] }, { "id": "c-id-nso", "kind": "fact", "text": "NSO Group Technologies Ltd (registered in Israel as N.S.O. Group Technologies Ltd, company number 514395409) was incorporated as a limited liability company on 25 January 2010.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-004" ], "entity_ids": [ "nso" ] }, { "id": "c-id-website-2019", "kind": "fact", "text": "According to the WhatsApp complaint, until at least June 2019 NSO Group's website stated that NSO Group was \"a Q Cyber Technologies company\"; the archived page filed as an exhibit reads \"NSO Group, a Q Cyber Technologies company\".", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-004", "src-069" ], "entity_ids": [ "nso", "qcyber" ] }, { "id": "c-id-group-role", "kind": "attributed", "text": "In 2021 correspondence with the authors of an NGO research report, NSO Group stated that NSO Group Technologies Ltd. and Q Cyber Technologies Ltd. develop, market and export Pegasus and related analytical products for governmental use, and provide sales, marketing and administrative support and oversight to their affiliates.", "qualification": "NSO Group's own description of the two companies' functions, quoted in the report.", "response": "", "outcome": "", "source_ids": [ "src-021" ], "entity_ids": [ "nso", "qcyber" ] }, { "id": "c-id-same-ceo", "kind": "attributed", "text": "Israeli business reporting said in January 2023 that the difference between Q Cyber Technologies, a company of the NSO group, and NSO itself might be purely symbolic, and in March 2023 that Q Cyber was in every respect identical to NSO, its chief executive Yaron Shohat also being chief executive of the NSO Group.", "qualification": "Characterisation by the publication when reporting Q Cyber's own lawsuit; no register record of Q Cyber's officers after 2019 was retained.", "response": "", "outcome": "According to press reports of January 2026, Shohat stepped down as chief executive after the 2025 change of ownership.", "source_ids": [ "src-011", "src-048", "src-080" ], "entity_ids": [ "qcyber", "nso", "shohat" ] }, { "id": "c-id-ngtp-sesame", "kind": "attributed", "text": "According to Israeli register records cited in a 2021 NGO research report, Q Cyber Technologies Ltd has been since 2019 the sole shareholder of two Israeli companies, NGTP Ltd (number 516043551, incorporated 20 June 2019) and S. Sesame Technology Ltd (number 516080850, incorporated 5 September 2019). NSO Group told the authors that both were inactive and had been created for potential future plans that had not materialised.", "qualification": "The shareholding is stated by the report from register records that were not themselves retained.", "response": "NSO Group: the two companies are inactive.", "outcome": "Copies of the Israeli register list both companies as active, with annual reports filed for 2025.", "source_ids": [ "src-021", "src-039", "src-040" ], "entity_ids": [ "qcyber", "ngtp", "sesame" ] }, { "id": "c-id-ngtp-sesame-register", "kind": "fact", "text": "Register copies list NGTP Ltd and S. Sesame Technology Ltd as active private companies with last annual reports for 2025. NGTP's registered address is HaAluf Yitzhak Hofi 1, Ramat HaSharon, the address shown for Q Cyber and NSO in the same source; S. Sesame Technology's registered address is in Neve Daniel.", "qualification": "Secondary copies of the register; they do not show shareholders or officers.", "response": "", "outcome": "", "source_ids": [ "src-039", "src-040" ], "entity_ids": [ "ngtp", "sesame", "qcyber" ] }, { "id": "c-id-courts-collective", "kind": "fact", "text": "United States courts hearing suits against both companies have treated them together: the Ninth Circuit's opinion of 8 November 2021 and the Northern District of California's orders of 8 March 2024 and 30 September 2026 refer to NSO Group Technologies and Q Cyber Technologies jointly as \"NSO\", and the Eastern District of Virginia's memorandum filed on 26 October 2023 describes NSO Group as a subsidiary of Q Cyber, a private company also incorporated in Israel.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-053", "src-058", "src-026", "src-067" ], "entity_ids": [ "qcyber", "nso" ] }, { "id": "c-str-osy-agreement", "kind": "fact", "text": "The Israeli Central District Court's judgment of 28 July 2026 records that on 5 February 2014 OSY Technologies S.à r.l. signed an agreement with NSO Group Technologies and its shareholders to acquire all rights in NSO in two stages: a cash payment of $70 million for 70% of the rights and, for the remaining 30%, an exchange of NSO shares for shares in Triangle Holdings, which made NSO's original shareholders partners in Francisco Partners' cyber business.", "qualification": "Findings of fact recited in the Central District Court's judgment of 28 July 2026 in Q Cyber's tax appeal.", "response": "", "outcome": "", "source_ids": [ "src-001" ], "entity_ids": [ "osy", "nso", "triangle", "francisco" ] }, { "id": "c-str-qcyber-into-chain", "kind": "fact", "text": "According to the same judgment, Q Cyber's shares were transferred to OSY Technologies on 17 March 2014, after which OSY is referred to as its parent company; on 19 March 2014 70% of NSO's shares were transferred from OSY to Q Cyber under a trust agreement, and on 30 November 2014 the remaining 30% of NSO's shares were exchanged for shares in Triangle Holdings.", "qualification": "Findings of fact recited in the Central District Court's judgment of 28 July 2026 in Q Cyber's tax appeal.", "response": "", "outcome": "", "source_ids": [ "src-001" ], "entity_ids": [ "qcyber", "osy", "nso", "triangle" ] }, { "id": "c-str-fs-note", "kind": "fact", "text": "Note 1 to Q Cyber's financial statements, quoted in the judgment, states that during 2014 the company acquired 100% of the shares of N.S.O. Group Technologies Ltd, its subsidiary, from its parent company OSY Technologies S.à r.l., incorporated in Luxembourg.", "qualification": "Quoted by the court from Q Cyber's financial statements, which were not themselves retained.", "response": "", "outcome": "", "source_ids": [ "src-001" ], "entity_ids": [ "qcyber", "nso", "osy" ] }, { "id": "c-str-chain-fp", "kind": "fact", "text": "The judgment describes OSY Technologies as a Luxembourg-resident company that Francisco Partners held not directly but through a chain of companies, headed under Francisco Partners by a foreign company, Triangle Holdings S.A.", "qualification": "Findings of fact recited in the Central District Court's judgment of 28 July 2026 in Q Cyber's tax appeal.", "response": "", "outcome": "", "source_ids": [ "src-001" ], "entity_ids": [ "osy", "francisco", "triangle" ] }, { "id": "c-str-fp-confirmation", "kind": "attributed", "text": "In 2021 correspondence with the authors of an NGO research report, Francisco Partners stated that from March 2014 to 18 March 2019 its fund Francisco Partners III owned an indirect controlling interest in NSO Group through OSY Holdings Ltd., a Cayman Islands vehicle wholly owned by the fund, which in turn owned a controlling interest in Triangle Holdings. It added that OSY Holdings had never exported products or services and had done nothing other than hold its Triangle interest.", "qualification": "Francisco Partners' own account. It calls OSY Holdings an exempted limited partnership, while the Triangle minutes of 1 December 2014 describe OSY Holdings Limited as an exempted company registered with the Cayman Islands Companies Register under number MC-284745.", "response": "", "outcome": "According to the same correspondence, OSY Holdings had no remaining assets or liabilities and was in the process of being dissolved under Cayman Islands law.", "source_ids": [ "src-021", "src-068" ], "entity_ids": [ "francisco", "osy-holdings", "triangle", "nso" ] }, { "id": "c-str-osy-incorporation", "kind": "attributed", "text": "According to Luxembourg and Cayman records cited in the 2021 NGO report, OSY Technologies S.à r.l. was incorporated on 3 February 2014 with OSY Holdings Ltd. (registered in the Cayman Islands on 30 January 2014) as its sole shareholder, and from March 2014 OSY Technologies was the sole shareholder and active director of L.E.G.D. Company, later Q Cyber Technologies Ltd.", "qualification": "Stated by the report from register records; OSY's own 2024 accounts confirm the incorporation date.", "response": "", "outcome": "", "source_ids": [ "src-021", "src-062" ], "entity_ids": [ "osy", "osy-holdings", "qcyber" ] }, { "id": "c-str-triangle-square2", "kind": "attributed", "text": "According to the 2021 NGO report, Triangle Holdings SA and Square 2 S.à r.l. were each incorporated in Luxembourg on 21 November 2014. OSY Holdings Limited became Triangle's sole shareholder, with Eran Gorev, a Francisco Partners director and newly appointed NSO chair, as its sole director; Triangle became Square 2's sole shareholder, and Square 2 took full ownership of OSY Technologies through share transfers from OSY Holdings. Luxembourg register publications summarised by a company-data aggregator record Square 2 as OSY's shareholder from 28 November 2014.", "qualification": "Ownership chain as stated by the report and an aggregator summary of Luxembourg register publications.", "response": "", "outcome": "", "source_ids": [ "src-021", "src-005" ], "entity_ids": [ "triangle", "square2", "osy-holdings", "osy", "gorev", "nso", "francisco" ] }, { "id": "c-str-triangle-dec2014", "kind": "fact", "text": "Minutes of an extraordinary general meeting of Triangle Holdings held on 1 December 2014, published in Luxembourg's official gazette, record that before the meeting OSY Holdings Limited, a Cayman Islands company, was the sole shareholder, and that the capital was increased from USD 48,038.80 to USD 74,548.10 by issuing new class A and class D shares.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-068" ], "entity_ids": [ "triangle", "osy-holdings" ] }, { "id": "c-str-triangle-subscribers", "kind": "fact", "text": "The new Triangle shares were subscribed on 1 December 2014 by Omri Lavie (67,263 class D shares, 9% of the capital) and Shalev Hulio, recorded as Shalev Holy (67,263 class D shares, 9%), each contributing 50 NSO shares; Eddy Shalev (13,444 class D shares, 1.8%) contributing 10 NSO shares; ESOP Management and Trust Services Ltd., an Israeli trust company (20,767 class A shares, 2.8%), contributing 20,767 NSO shares; and, for cash, Global Seven Group LP, a British Virgin Islands limited partnership (89,458 class D shares, 12%) and Eran Gorev (6,336 class D shares, 0.8%).", "qualification": "The minutes do not name Global Seven Group's general partner or beneficial owners.", "response": "", "outcome": "", "source_ids": [ "src-068" ], "entity_ids": [ "triangle", "lavie", "hulio", "eddy-shalev", "esop", "global-seven", "gorev", "nso" ] }, { "id": "c-str-triangle-split", "kind": "attributed", "text": "The 2021 NGO report summarises the outcome as the new shareholders holding about 35.5% of Triangle Holdings, including Alexei Voronovitsky (0.1%), and OSY Holdings Ltd., that is Francisco Partners, the remaining 64.5%; NSO Group told the authors that ESOP Management and Trust Services held shares and options on behalf of employees under the company's employee stock ownership plan, an entity required by the applicable tax rules.", "qualification": "Percentages as summarised by the report.", "response": "NSO Group explained the trust company's role as described.", "outcome": "According to the report, Triangle's board resolved on 18 February 2019 to buy back ESOP's shares, so that ESOP was no longer a Triangle shareholder.", "source_ids": [ "src-021" ], "entity_ids": [ "triangle", "osy-holdings", "francisco", "esop", "voronovitsky", "nso" ] }, { "id": "c-str-triangle-board-2014", "kind": "fact", "text": "By resolution of 1 December 2014 Triangle Holdings appointed as directors Alessandro Celli, Jonathan Murphy, Andrew Kowal and Matthew Spetzler, all with professional addresses at Francisco Partners' London or San Francisco offices, Frédéric Gardeur, Omri Lavie, Shalev Holy (Hulio) and Boaz Goldman; Andreas Koutsos was appointed observer.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-068" ], "entity_ids": [ "triangle", "murphy", "kowal", "spetzler", "lavie", "hulio", "goldman" ] }, { "id": "c-str-triangle-board-2019", "kind": "attributed", "text": "According to Triangle minutes summarised in the 2021 NGO report, Boaz Goldman of the Circles group sat on Triangle's board from December 2014, and on 1 April 2019 Triangle acknowledged the resignations of Boaz Goldman, Eran Gorev, Andrew Kowal, Jonathan Murphy and Matthew Spetzler as class A directors.", "qualification": "Summary of the minutes in the report.", "response": "", "outcome": "", "source_ids": [ "src-021" ], "entity_ids": [ "triangle", "goldman", "gorev", "kowal", "murphy", "spetzler", "circles" ] }, { "id": "c-str-qcyber-director-nso", "kind": "fact", "text": "NSO Group Technologies' annual report to the Israeli Registrar of Companies, updated to 7 January 2019, names Q Cyber Technologies Ltd as NSO's director from 19 March 2014 and a financial director named Idisis.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-004" ], "entity_ids": [ "nso", "qcyber", "idisis" ] }, { "id": "c-str-nso-shareholders-2019", "kind": "fact", "text": "The same annual report lists NSO's shareholders as Q Cyber Technologies Ltd, holding 118,263 ordinary shares, 8,936 ordinary A shares and 295,170 preferred A shares, and NSO Group Technologies Ltd itself, holding 67,453 ordinary shares.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-004" ], "entity_ids": [ "nso", "qcyber" ] }, { "id": "c-str-treasury-shares", "kind": "attributed", "text": "The 2021 NGO report noted that NSO Group Technologies held 67,453, or 36%, of its own allotted ordinary shares and that it was unclear which individuals exercised ownership of them. NSO Group replied that its shareholders are Q Cyber Technologies Ltd. and NSO Group Technologies Ltd. itself, that under Israeli law a company may hold its own shares, for example after a buyback, and that the full ownership rights of NSO Group Technologies Ltd. are therefore held by Q Cyber Technologies Ltd.", "qualification": "The report's observation and NSO Group's explanation; the buyback itself is not documented in the retained records.", "response": "NSO Group: the treasury shares result from a buyback, and Q Cyber holds the full ownership rights.", "outcome": "", "source_ids": [ "src-021" ], "entity_ids": [ "nso", "qcyber" ] }, { "id": "c-str-qcyber-return-2019", "kind": "fact", "text": "Q Cyber's own annual report, updated to 7 January 2019 and signed on 16 June 2019, lists OSY Technologies S.à r.l. (Luxembourg register number B184226) as its sole shareholder with all 100,000 ordinary shares, OSY as its director from 17 March 2014, and Yifa Idisis as financial director.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-004" ], "entity_ids": [ "qcyber", "osy", "idisis" ] }, { "id": "c-str-price", "kind": "attributed", "text": "Accounts of the 2014 price differ. The Israeli judgment records a $70 million cash payment for 70% of the rights in NSO; the 2021 NGO report states that Francisco Partners III acquired a 70% stake for $115 million in a deal announced in March 2014 and reportedly approved by Israel's Ministry of Defense; and a 2017 news report puts the purchase at $120 million.", "qualification": "Three figures from different sources; they may measure different components of the same transaction, and none of the retained records reconciles them.", "response": "", "outcome": "", "source_ids": [ "src-021", "src-104" ], "entity_ids": [ "francisco", "nso", "osy" ] }, { "id": "c-str-blackstone-2017", "kind": "attributed", "text": "A US business magazine reported in December 2017 that Francisco Partners, the private equity firm that owned NSO Group, had months earlier failed to sell part of the company to the New York-based Blackstone Group at a reported valuation of $1 billion, and that the deal collapsed amid reports that summer about the use of NSO's spyware in Mexico.", "qualification": "Press account; no other retained record describes the negotiations.", "response": "", "outcome": "The sale did not take place.", "source_ids": [ "src-119" ], "entity_ids": [ "francisco", "nso" ] }, { "id": "c-str-circles", "kind": "attributed", "text": "According to the judgment, in parallel with the NSO purchase Francisco Partners also acquired, through OSY on 1 December 2014, the foreign Circles group of companies, which was likewise active in the cyber field. The 2021 NGO report states that Circles was founded in 2010 by Tal Dilian, Boaz Goldman and Eric Banoun, is known for technology exploiting SS7 vulnerabilities for surveillance, and was acquired by Francisco Partners for $130 million in 2014; NSO Group told the authors that the Circles-linked entity CT-Circles Technologies Ltd. is not part of the NSO Group.", "qualification": "The founders, technology description and price are the report's account.", "response": "NSO Group: CT-Circles Technologies Ltd. is not part of the group.", "outcome": "", "source_ids": [ "src-001", "src-021" ], "entity_ids": [ "francisco", "osy", "circles", "goldman" ] }, { "id": "c-str-iota", "kind": "attributed", "text": "The 2021 NGO report, citing OSY's 2014 accounts, states that OSY Technologies also acquired IOTA Holdings Ltd., registered in Cyprus on 4 November 2014, the parent of CS-Circles Solutions Ltd., Global Hubcom Ltd. and MS Magnet Solutions Ltd.; CS-Circles Solutions owns Circles Bulgaria EOOD (incorporated in July 2017) and MS Magnet Solutions owns Magnet Bulgaria EOOD (incorporated in April 2014).", "qualification": "Group structure as described in the report.", "response": "", "outcome": "", "source_ids": [ "src-021" ], "entity_ids": [ "osy", "iota", "circles", "qcyber" ] }, { "id": "c-str-pega-merger", "kind": "attributed", "text": "A 2023 European Parliament inquiry report, relying on the 2021 NGO report, states that Circles Technologies was sold to Francisco Partners for just under $130 million and that Francisco Partners obtained 90% of NSO Group, with Circles and NSO merged under L.E.G.D Company Ltd., known as Q Cyber Technologies Ltd. since 29 March 2016.", "qualification": "The report's figures differ from the primary records: the Israeli name-change certificate is dated 29 May 2016, and the other accounts give Francisco Partners 70% of NSO rather than 90%.", "response": "", "outcome": "", "source_ids": [ "src-066" ], "entity_ids": [ "francisco", "circles", "nso", "qcyber" ] }, { "id": "c-tax-appeal", "kind": "fact", "text": "Q Cyber Technologies Ltd appealed to Israel's Central District Court in Lod (TA 59924-03-22, Judge Avi Gorman) against assessments of tax that the Kfar Saba Assessing Officer said it should have withheld for the tax years 2014–2015 and 2017–2018. The dispute was whether the sequence of steps taken to acquire an Israeli company, financed by loans from a foreign parent company and their repayment, was an artificial transaction under section 86 of the Income Tax Ordinance.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-001" ], "entity_ids": [ "qcyber", "kfar-saba" ] }, { "id": "c-tax-shelf", "kind": "fact", "text": "The judgment states that Q Cyber was incorporated on 2 December 2013 as a shelf company named L.E.G.D. Ltd and later renamed, and a 2026 review of the judgment by an Israeli law firm reports the court's finding that at the time of the acquisition Q Cyber was a shelf company with no employees, no substantive operations and no bank account.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-001", "src-116" ], "entity_ids": [ "qcyber" ] }, { "id": "c-tax-repayments", "kind": "fact", "text": "According to the judgment, between 2014 and 2018 Q Cyber repaid the loans from its parent OSY using loans and dividends it received from its subsidiary NSO; more than $86 million of the funds used to repay the loans actually passed directly from NSO to OSY, not through Q Cyber's bank account. The court also records that in 2016 NSO declared a dividend of about $38.4 million to Q Cyber, which stayed with NSO to repay Q Cyber's loans from NSO, and that the roughly $86 million Q Cyber paid to OSY repaid the loans taken to buy NSO's shares in 2014.", "qualification": "Findings recited in the Central District Court's judgment of 28 July 2026 in Q Cyber's tax appeal.", "response": "", "outcome": "", "source_ids": [ "src-001" ], "entity_ids": [ "qcyber", "osy", "nso" ] }, { "id": "c-tax-assessing-position", "kind": "attributed", "text": "The Assessing Officer argued that the purpose of the arrangement was to avoid tax on dividends and on the transfer of profits abroad, contrary to Israel's two-tier taxation under which dividends distributed to a foreign-resident company are taxable.", "qualification": "The parties' positions as summarised at the opening of the judgment.", "response": "Q Cyber argued that the transaction followed accepted practice, rested on substantive commercial reasons for creating and operating an Israeli company, and that the repayment of the loan to its foreign parent was not a dividend and not taxable.", "outcome": "On 28 July 2026 the court accepted the Assessing Officer's position and dismissed the appeal.", "source_ids": [ "src-001", "src-116" ], "entity_ids": [ "qcyber", "kfar-saba" ] }, { "id": "c-tax-findings", "kind": "fact", "text": "The court held that the arrangement was an artificial transaction: had NSO's profits been distributed directly to the Luxembourg company, the dividend would have borne 10% tax under the Israel–Luxembourg tax treaty, whereas interposing Q Cyber allowed the funds to move as loan repayments without that tax. It found that Q Cyber had not proved a fundamental commercial purpose other than tax: no contemporaneous evidence explained why the Israeli company was included, key representatives of the investment fund were not called as witnesses, and the commercial reasons put forward, including centralising marketing and distribution, finding further investments in Israel and defence-export regulation, were not shown to have shaped the structure when it was designed.", "qualification": "Summary of the court's reasoning in a law-firm review of the judgment; the reasoning is the court's.", "response": "", "outcome": "", "source_ids": [ "src-116" ], "entity_ids": [ "qcyber", "osy", "nso", "kfar-saba" ], "adverse_subject_ids": [ "qcyber" ] }, { "id": "c-tax-acquirer-doubt", "kind": "attributed", "text": "Relying on Q Cyber's own financial statements, the Assessing Officer raised substantial doubt as to whether Q Cyber was in fact the entity that acquired NSO, or whether the NSO shares were transferred to it only after an agreement had been signed for the Luxembourg company to acquire NSO directly.", "qualification": "The Assessing Officer's argument as reported in a review of the judgment, which the court took into account.", "response": "", "outcome": "", "source_ids": [ "src-116" ], "entity_ids": [ "qcyber", "nso", "osy", "kfar-saba" ] }, { "id": "c-tax-outcome", "kind": "fact", "text": "On 28 July 2026 the court dismissed the appeal, holding that the payments to the foreign parent company were to be taxed as dividends rather than treated as loan repayments, and ordered Q Cyber to pay the Assessing Officer's costs of NIS 40,000; it cancelled the penalty for failure to withhold tax at source, finding that the circumstances did not justify a finding of fraudulent or false conduct.", "qualification": "A district-court judgment; the retained records do not show whether it was appealed.", "response": "", "outcome": "", "source_ids": [ "src-001", "src-116" ], "entity_ids": [ "qcyber", "kfar-saba", "osy" ], "adverse_subject_ids": [ "qcyber" ] }, { "id": "c-tax-lavie-testimony", "kind": "attributed", "text": "Omri Lavie, a co-founder and shareholder of NSO, testified for Q Cyber; the judgment describes him as currently the controlling owner of Q Cyber through the chain of companies and, accepting the Assessing Officer's remark, as its sole shareholder with an interest in the outcome. The court described Eran Gorev, Francisco Partners' representative in Israel, as apparently a key figure among the Francisco Partners people who, Lavie testified, designed the transaction; according to Lavie, Gorev negotiated the purchase of the NSO shares and managed Q Cyber on Francisco's behalf shortly after it was set up. Gorev gave a statement to the Assessing Officer but was not called as a witness.", "qualification": "The court's description of the witness; the judgment does not date its \"currently\". Luxembourg register publications record that Lavie's holding company transferred NorthPole Newco to another person on 8 October 2025 and that in October 2025 Lavie left the boards of NorthPole Newco, OSY Technologies and Q Cyber Technologies S.à r.l.", "response": "", "outcome": "", "source_ids": [ "src-001" ], "entity_ids": [ "lavie", "qcyber", "nso", "gorev", "francisco" ] }, { "id": "c-tax-2019-sale", "kind": "fact", "text": "The parties told the court that in 2019 Francisco Partners sold its holdings in Q Cyber, and through it in NSO, and that the purchaser later sold them on to one of NSO's original shareholders.", "qualification": "Findings recited in the Central District Court's judgment of 28 July 2026 in Q Cyber's tax appeal.", "response": "", "outcome": "", "source_ids": [ "src-001" ], "entity_ids": [ "francisco", "qcyber", "nso" ] }, { "id": "c-buy-announcement", "kind": "attributed", "text": "A press release published by Novalpina Capital on 14 February 2019 announced that NSO Group's management team and founders were acquiring the company from the private equity firm Francisco Partners. The acquisition was led by co-founders Shalev Hulio and Omri Lavie with members of the senior executive team, with a significant number of employees participating, supported by Novalpina Capital as equity partner; Jefferies Group LLC advised and led the financing. The release said NSO had finished 2018 with revenues of $250 million and dozens of licensed customers.", "qualification": "The buyers' own announcement; the revenue figure is the company's.", "response": "", "outcome": "", "source_ids": [ "src-009" ], "entity_ids": [ "nso", "francisco", "hulio", "lavie", "novalpina" ] }, { "id": "c-buy-complaint-account", "kind": "attributed", "text": "The WhatsApp complaint of October 2019 states that between 2014 and February 2019 NSO Group obtained financing from a San Francisco-based private equity firm that ultimately purchased a controlling stake, and that in and around February 2019 NSO Group was reacquired by its founders.", "qualification": "Allegation in the plaintiffs' complaint, citing its exhibits.", "response": "", "outcome": "", "source_ids": [ "src-004" ], "entity_ids": [ "nso", "francisco" ] }, { "id": "c-buy-fp-exit", "kind": "attributed", "text": "Francisco Partners told the authors of the 2021 NGO report that on 18 March 2019 OSY Holdings disposed of 100% of its interest in Triangle Holdings and Eran Gorev also sold his entire interest in Triangle.", "qualification": "Francisco Partners' own account. A 2023 European Parliament report dates Francisco Partners' sale of its entire interest to Novalpina Capital to 14 February 2019, the date the deal was announced.", "response": "", "outcome": "According to Francisco Partners, after that date neither it, its fund, OSY Holdings nor any associated person, including Gorev, retained any ownership or economic interest in NSO Group, and Eran Gorev, Matt Spetzler and Andrew Kowal resigned their director roles.", "source_ids": [ "src-021", "src-066" ], "entity_ids": [ "francisco", "osy-holdings", "triangle", "gorev", "spetzler", "kowal", "nso" ] }, { "id": "c-buy-terms", "kind": "attributed", "text": "Accounts of the 2019 terms differ in scope. Israeli business reporting in 2022, based on Tel Aviv court documents, said the deal valued NSO at over $1 billion: Hulio and NSO's management held 30% and Novalpina acquired 70% in a leveraged deal comprising a direct investment of $290 million, $100 million in shares from Hulio and his associates and $400 million of bank loans placed in the holding company controlling NSO. A 2022 news agency report said Novalpina borrowed $500 million for the purchase and placed the debt in the holding company above NSO. The fund's general partner told a New York court in 2025 that the fund acquired the NSO Group for €218.5 million.", "qualification": "Press accounts and a party's court filing; they describe different components (enterprise value, equity cheque and borrowing) and are not reconciled in the retained records.", "response": "", "outcome": "", "source_ids": [ "src-115", "src-120", "src-106" ], "entity_ids": [ "nso", "novalpina", "hulio", "noal", "francisco" ] }, { "id": "c-buy-chain-april-2019", "kind": "attributed", "text": "According to the 2021 NGO report, after transactions in April 2019 Triangle Holdings owned 31.4% of Square 2 ($22 million of $70 million) and NorthPole Holdco S.à r.l., Novalpina's vehicle, owned 68.6% ($48 million); Square 2 owned 100% of NorthPole Bidco, which owned 100% of NorthPole Newco, which owned 100% of OSY Technologies, and OSY continued to own IOTA Holdings, Q Cyber Technologies S.à r.l., Q Cyber Technologies Ltd and Westbridge Technologies Inc.", "qualification": "Ownership chain as stated by the report from Luxembourg register publications.", "response": "", "outcome": "", "source_ids": [ "src-021" ], "entity_ids": [ "triangle", "square2", "northpole-holdco", "northpole-bidco", "northpole-newco", "osy", "iota", "qcyber-lux", "qcyber", "westbridge", "novalpina" ] }, { "id": "c-buy-register-2019", "kind": "attributed", "text": "Luxembourg register publications summarised by a company-data aggregator record that NorthPole Holdco became a shareholder of Square 2 on 11 April 2019 (capital $70.8 million), that NorthPole Newco, registered on 5 December 2018 as Eighteen Jasmine S.à r.l. and renamed on 31 January 2019, had NorthPole Bidco as its shareholder from 15 April 2019, and that NorthPole Newco replaced Square 2 as OSY's shareholder on 6 May 2019.", "qualification": "Aggregator summary of register publications; the underlying publications were not retained.", "response": "", "outcome": "", "source_ids": [ "src-018", "src-006", "src-005" ], "entity_ids": [ "northpole-holdco", "square2", "northpole-newco", "northpole-bidco", "osy" ] }, { "id": "c-buy-fara-chain", "kind": "fact", "text": "Exhibit A to Mercury Public Affairs' registration under the US Foreign Agents Registration Act, received by the Justice Department on 25 December 2019, states that its foreign principal Q Cyber Technologies Ltd is wholly owned by OSY Technologies S.a.r.l., which is wholly owned through multiple intermediate holding companies by Square 2 S.a.r.l.; that Square 2 is about 32% owned by Triangle Holding S.A. and about 68% by North Pole Holdco S.a.r.l.; that NorthPole is wholly owned by Novalpina Capital Partners I LuxCo S.a.r.l., which is 99% owned by Novalpina Capital, the ultimate parent; and that the ultimate parent's general partner is Novalpina Capital Partners I GP S.a.r.l.", "qualification": "The ultimate parent with a general partner is the fund then called Novalpina Capital Partners I SCSp.", "response": "", "outcome": "", "source_ids": [ "src-064" ], "entity_ids": [ "qcyber", "osy", "square2", "triangle", "northpole-holdco", "novalpina-luxco", "noal", "novalpina-gp", "mercury" ] }, { "id": "c-buy-holdco-luxco", "kind": "attributed", "text": "According to the 2021 NGO report, the Novalpina Capital Partners I SCSp fund channelled its investments through Novalpina Capital Partners I LuxCo S.à r.l. (incorporated 13 November 2017), and for NSO used NorthPole Holdco S.à r.l. (incorporated in July 2018 and renamed in January 2019), wholly owned by LuxCo; Novalpina Capital Group S.à r.l., owned by Stephen Peel, Stefan Kowski and Bastian Lueken, was the ultimate owner of the fund's general partner, Novalpina Capital Partners I GP S.à r.l. An English High Court judgment of 2025 likewise states that the fund, now NOAL SCSp, was set up in 2017 by Stefan Kowski, Bastian Lueken and Stephen Peel.", "qualification": "Structure as described by the report.", "response": "", "outcome": "", "source_ids": [ "src-021", "src-102", "src-075" ], "entity_ids": [ "noal", "novalpina-luxco", "northpole-holdco", "novalpina-group", "peel", "kowski", "lueken", "novalpina-gp" ] }, { "id": "c-buy-holdco-register", "kind": "attributed", "text": "Luxembourg register publications summarised by a company-data aggregator record that NorthPole Holdco S.à r.l. (register number B226434), originally Eighteen Scabiosa S.à r.l., had Novalpina Capital Partners I LuxCo S.à r.l. as its shareholder and Gaëtan Dumont, Allen Foley and Philip Zarb Mizzi as managers from 30 November 2018, with LuxCo again listed as shareholder in March and June 2019; that Stefano Pileri and Michael Elie Zini became managers in July 2021 and were replaced by Dumont and Foley in August 2021; and that Tamara Makarenko became a manager on 24 February 2022, Dumont and Foley left on 1 March 2022, and James Ward became a manager on 20 October 2022.", "qualification": "Aggregator summary of register publications.", "response": "", "outcome": "", "source_ids": [ "src-075" ], "entity_ids": [ "northpole-holdco", "novalpina-luxco", "dumont", "makarenko", "ward" ] }, { "id": "c-buy-fund-lps", "kind": "attributed", "text": "The 2021 NGO report states that the Luxembourg fund Novalpina Capital Partners I SCSp (registered 23 August 2017), used to buy the NSO stake, had commitments above its €1 billion target, and that its limited partners included the Oregon Public Employees Retirement System (18%), the Alaska Permanent Fund Corp. (5.1%), South Yorkshire Pensions Authority (2.7%) and East Riding Pension Fund (1.4%); its general partner was Novalpina Capital Partners I GP S.à r.l., incorporated 18 August 2017.", "qualification": "Percentages of commitments to the fund as reported, not stakes in NSO.", "response": "", "outcome": "", "source_ids": [ "src-021" ], "entity_ids": [ "noal", "oregon", "alaska", "south-yorkshire", "east-riding", "novalpina-gp" ] }, { "id": "c-buy-tracking-shares", "kind": "attributed", "text": "According to the 2021 NGO report, on 19 March 2019 the shareholders of Novalpina Capital Partners I LuxCo resolved that 893,750 class 2 tracking shares would track the investment in NorthPole Holdco, the NSO-linked holding company, and on 8 May 2019 the fund contributed those shares (valued at EUR 32,564,682) and a receivable of EUR 184,465,145, together EUR 217,029,827, to a new company, Novalpina Capital Partners I LuxCo North S.à r.l.", "qualification": "Figures from Luxembourg register minutes as summarised in the report.", "response": "", "outcome": "", "source_ids": [ "src-021" ], "entity_ids": [ "novalpina-luxco", "northpole-holdco", "noal", "nso" ] }, { "id": "c-buy-triangle-articles", "kind": "attributed", "text": "Triangle Holdings' articles of 17 April 2019, quoted in the 2021 NGO report, provide that directors nominated by Shalev Hulio and Omri Lavie are class B directors and those nominated by NorthPole Holdco via NorthPole Bidco are class A directors, and that class B directors may represent the company only if the board delegates its powers to them.", "qualification": "Quoted from the articles in the report.", "response": "", "outcome": "", "source_ids": [ "src-021" ], "entity_ids": [ "triangle", "hulio", "lavie", "northpole-holdco", "northpole-bidco" ] }, { "id": "c-buy-boards-april-2019", "kind": "attributed", "text": "At an extraordinary general meeting of Square 2 on 1 April 2019, according to the 2021 NGO report, Triangle Holdings resigned as sole manager and Stefan Kowski, Stephen Peel, Mickael Betito, Gerhard Schmidt, Zamir Dahbash and Günter Maximilian Schmid were appointed class A managers and Omri Lavie, Shalev Hulio and Yuval Somekh class B managers; at OSY Technologies OSY Holdings Ltd., Eran Gorev and Kevin Wilson were removed and the same class A managers and Lavie and Hulio as class B managers appointed. An aggregator summary of the register dates Gorev's and Wilson's exit from OSY's board to 12 April 2019.", "qualification": "Board changes as reported from register minutes and an aggregator summary.", "response": "", "outcome": "", "source_ids": [ "src-021", "src-005" ], "entity_ids": [ "square2", "triangle", "kowski", "peel", "schmidt", "lavie", "hulio", "somekh", "osy", "osy-holdings", "gorev", "kevin-wilson" ] }, { "id": "c-buy-triangle-reroute", "kind": "attributed", "text": "On 30 December 2019, according to Triangle's minutes summarised in the 2021 NGO report, NorthPole Holdco contributed all of its 484,808,020 Square 2 shares, 68.46% of Square 2's capital with a fair market value of USD 247,825,445, to Triangle Holdings in exchange for new class A, B and D shares, making Square 2 a wholly owned subsidiary of Triangle and Triangle the point of connection between Novalpina and NSO; NorthPole Holdco's stake came to about 59.8% of Triangle's class A shares. Register summaries show Triangle replacing NorthPole Holdco as Square 2's shareholder on 27 January 2020.", "qualification": "Figures from the minutes as summarised in the report and an aggregator.", "response": "", "outcome": "", "source_ids": [ "src-021", "src-018" ], "entity_ids": [ "northpole-holdco", "square2", "triangle", "novalpina", "nso" ] }, { "id": "c-buy-triangle-board-dec-2019", "kind": "attributed", "text": "The same day Triangle's shareholders appointed Novalpina executives Mickaël Betito, Stefan Kowski, Stephen Peel, Maximilian Schmid Günter and Gerhard Schmidt as class A directors and reclassified Shalev Hulio and Omri Lavie as class B directors; on 27 April 2020 Triangle appointed Asher Levy, named NSO's executive chairman in early April 2020, as a class A director.", "qualification": "Board changes as summarised in the 2021 NGO report.", "response": "", "outcome": "", "source_ids": [ "src-021" ], "entity_ids": [ "triangle", "kowski", "peel", "schmidt", "hulio", "lavie", "asher-levy", "nso" ] }, { "id": "c-buy-novalpina-role", "kind": "attributed", "text": "NSO Group told the report's authors in 2021 that Novalpina, as a shareholder, appointed members to the group boards of Triangle Holdings S.A. and OSY Technologies S.a.r.l. and their committees, which provided strategic direction.", "qualification": "NSO Group's description.", "response": "NSO Group: Novalpina was not involved in the group's day-to-day operations.", "outcome": "", "source_ids": [ "src-021" ], "entity_ids": [ "novalpina", "triangle", "osy", "nso" ] }, { "id": "c-buy-emerald-diamond", "kind": "attributed", "text": "According to the 2021 NGO report, on 30 November 2020 NorthPole Bidco contributed all its shares in Goatilev and NorthPole Newco to Emerald LIE for USD 326,800,326.27 in consideration for 350,000,000 new preferred B shares, and Emerald LIE contributed the same shares to Diamond LIE that day, inserting both companies between NorthPole Bidco and NorthPole Newco; NSO Group said Emerald and Diamond were created to grant stock options to management, directors and employees. Register summaries record Emerald LIE and then Diamond LIE as NorthPole Newco's shareholder from 15 and 17 December 2020.", "qualification": "Transaction terms from register minutes as summarised in the report.", "response": "NSO Group: the two companies exist to grant stock options.", "outcome": "Register summaries record that Diamond LIE ceased to be NorthPole Newco's shareholder in a publication of 24 February 2023, which records Dufresne Holding in its place; Israeli business reporting attributed that change to the lenders' exercise of their rights under the loan agreements.", "source_ids": [ "src-021", "src-006" ], "entity_ids": [ "northpole-bidco", "goatilev", "northpole-newco", "emerald", "diamond", "nso" ] }, { "id": "c-buy-goatilev", "kind": "attributed", "text": "On 5 February 2020 NorthPole Bidco acquired Goatilev Ltd., an Israeli shelf company that bought two Israeli companies in February and March 2020; according to the 2021 NGO report Goatilev is reported to have bought Wayout, a company focused on router compromise and interception of Internet of Things data.", "qualification": "The acquisition is quoted from NorthPole Bidco's accounts in the report; Wayout's description is the report's.", "response": "NSO Group confirmed that Wayout is an NSO Group company developing cyber security products for the IoT world for governmental use.", "outcome": "", "source_ids": [ "src-021" ], "entity_ids": [ "northpole-bidco", "goatilev", "nso" ] }, { "id": "c-buy-loan", "kind": "fact", "text": "NorthPole Newco's 2024 annual accounts state that on 3 March 2019 its then sole shareholder entered into a credit agreement for a term loan of up to USD 510,000,000 with a six-year maturity and a revolving facility of up to USD 30,000,000, and that under a joinder agreement of 8 April 2019 NorthPole Newco became the borrower and assumed the liability (the \"debt pushdown\"); the term loan bore interest at the alternate base rate plus an initial margin of 7.00%.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-061" ], "entity_ids": [ "northpole-newco" ] }, { "id": "c-buy-moodys", "kind": "attributed", "text": "In May 2021 Moody's downgraded NorthPole Newco S.à r.l., which it described as the top entity of the restricted group of NSO Group, from B2 to B3, together with its $300 million and €176.96 million senior secured term loans maturing in March 2025 and its $30 million revolving facility maturing in March 2024, with a negative outlook.", "qualification": "Rating agency announcement as republished by a human-rights resource centre on 25 May 2021.", "response": "", "outcome": "NorthPole Newco's accounts record a forbearance agreement of 31 December 2021 with the lenders after certain events of default.", "source_ids": [ "src-024", "src-061" ], "entity_ids": [ "northpole-newco", "nso" ], "adverse_subject_ids": [ "northpole-newco" ] }, { "id": "c-buy-lenders", "kind": "attributed", "text": "Israeli business reporting in March 2022 described the roughly $500 million debt from the leveraged loan taken to buy 70% of NSO from Francisco Partners in 2019 as owed entirely by the Luxembourg holding company NorthPole Newco, with estimated annual interest of $65 million; it reported that days after NSO's US blacklisting Moody's cut the rating to Caa2, that a senior source said NSO did not feel exposed because the Israeli company had given no surety for the loan, and that the lenders included three main groups, Credit Suisse and the US hedge funds Senator Investment and Birch Grove Capital, alongside BlackRock, Ellington and Jefferies.", "qualification": "Press account; the lender list is what the publication was told.", "response": "Birch Grove Capital said it was not commenting; Credit Suisse and Senator declined to comment.", "outcome": "", "source_ids": [ "src-115" ], "entity_ids": [ "northpole-newco", "nso", "novalpina", "credit-suisse", "senator", "birch-grove", "francisco" ] }, { "id": "c-brg-takeover", "kind": "attributed", "text": "In July 2021 British press reported that public investors in the private equity fund holding the majority stake in NSO Group, led by the Oregon public pension fund, were in talks to transfer management of the fund to the US consultancy Berkeley Research Group (BRG). According to the fund's general partner, the investors voted by 99% in July 2021 to remove Novalpina as general partner; an English High Court judgment of 2025 records that Treo GP replaced Novalpina Capital Partners 1 GP Sarl as general partner on 27 August 2021.", "qualification": "Press report and the fund's own statement; the date of replacement is recorded in the English judgment.", "response": "Novalpina and NSO declined to comment to the British press, and BRG did not immediately respond.", "outcome": "", "source_ids": [ "src-045", "src-097", "src-102" ], "entity_ids": [ "noal", "brg", "novalpina", "oregon", "treo-gp", "novalpina-gp", "nso" ] }, { "id": "c-brg-investigations", "kind": "attributed", "text": "A 2023 European Parliament inquiry report states that on 27 August 2021 BRG took over the private equity fund controlling NSO Group and launched investigations into the lawfulness of NSO's activities and its compliance with the US blacklisting, and that BRG's inquiries of May 2022 were obstructed by NSO Group's management.", "qualification": "The report's account, based on press and NGO sources.", "response": "", "outcome": "", "source_ids": [ "src-066" ], "entity_ids": [ "brg", "noal", "nso" ] }, { "id": "c-brg-board-control", "kind": "attributed", "text": "Israeli business reporting in 2022 said that the fund's limited partners, including Centerbridge Partners and the Oregon and Alaska pension funds, sought a manager to prepare the assets for sale; BRG joined NSO's board in September 2021 and by the end of that year controlled the board of Triangle Holdings, where chairman Asher Levy, nominated by Novalpina, was replaced by BRG partner Finbarr O'Connor. In January 2022 Levy told the press he had been appointed to represent Novalpina and was making way for BRG's appointee.", "qualification": "Press accounts.", "response": "Asher Levy said the end of his chairmanship was unrelated to reports about NSO: he had submitted his resignation when BRG took control in July 2021 and completed his term at the end of the year.", "outcome": "According to a March 2023 report, BRG's control ended when the new controlling owner replaced the directors down the chain, including those appointed by BRG.", "source_ids": [ "src-115", "src-114", "src-117", "src-011" ], "entity_ids": [ "noal", "centerbridge", "oregon", "alaska", "brg", "triangle", "asher-levy", "oconnor", "nso", "novalpina" ] }, { "id": "c-brg-triangle-directors", "kind": "fact", "text": "A notice published in Luxembourg's electronic register of companies and associations on 4 January 2023 lists Triangle Holdings' class A directors as Finbarr O'Connor and Howard Berkowitz, appointed on 4 October 2021 until the 2026 general meeting, and Gavin Farrell and Jeffrey Dunn, appointed on 14 January 2022 until the 2027 general meeting, all with an address care of a New York law firm.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-073" ], "entity_ids": [ "triangle", "oconnor", "berkowitz", "farrell", "dunn" ] }, { "id": "c-brg-revenue", "kind": "attributed", "text": "The European Parliament inquiry report, citing press, states that NSO reportedly had revenues of USD 243 million in 2020 but that after the Pegasus Project revelations the lawsuits by Apple and Meta, its US blacklisting, the tightening of Israel's export regime, inquiries in several countries and frictions within the private equity fund behind it led to a severe decline in profit, and that its debt reportedly reached 6.5 times its normal annual revenue at one point.", "qualification": "Figures reported by the press and relayed by the inquiry report; no NSO accounts were retained.", "response": "", "outcome": "", "source_ids": [ "src-066" ], "entity_ids": [ "nso" ], "adverse_subject_ids": [ "nso" ] }, { "id": "c-brg-financial-crisis", "kind": "attributed", "text": "In a 2025 petition to a New York federal court, the fund's general partner stated that in October 2021 NSO acknowledged its precarious financial position and asked for an immediate $10 million cash injection to meet payroll, and that a few days after the funding was provided, on 3 November 2021, NSO Group was put on the US Entity List.", "qualification": "Statement of a party in court papers.", "response": "", "outcome": "", "source_ids": [ "src-106" ], "entity_ids": [ "treo-gp", "nso", "noal" ], "adverse_subject_ids": [ "nso" ] }, { "id": "c-brg-convexum", "kind": "attributed", "text": "Israeli business reporting in January 2022 said that, at the request of NSO's controlling shareholder BRG, Judge Hagai Brenner of the Tel Aviv District Court appointed a lawyer as temporary trustee of the drone company Convexum, announced as acquired by NSO two years earlier for $60 million; it reported that Convexum had in practice been controlled by Triangle, owned 70% by Novalpina and 30% by NSO's management and employees, and that BRG's court papers put NSO's debts at $460 million and NSO was negotiating a sale to two US investment funds with bids of $1 billion to $1.2 billion. Reporting a year later said the long legal process ended with Convexum's separation from NSO, which NSO's management had opposed.", "qualification": "Press accounts of court filings; the debt figure is BRG's.", "response": "NSO's management opposed the separation of Convexum.", "outcome": "Convexum was separated from NSO after the proceedings, according to the January 2023 report.", "source_ids": [ "src-114", "src-060" ], "entity_ids": [ "brg", "convexum", "nso", "triangle", "novalpina" ] }, { "id": "c-brg-sale-offers", "kind": "attributed", "text": "According to court records described in Israeli business reporting in March 2022, the group around Shalev Hulio worked on selling NSO together with Convexum against BRG's position; one offer, from Integrity Partners, proposed injecting $300 million at a valuation of $1 billion to $1.5 billion, leaving the Hulio group 30%, focusing sales on Western democracies and repaying debt by 2029.", "qualification": "Press account of court records; the offer did not result in a transaction according to the later ownership record.", "response": "NSO Group called a January 2022 report of talks with Integrity Partners full of inaccuracies and half-truths, but confirmed it was in talks with US-based funds.", "outcome": "No such sale took place.", "source_ids": [ "src-115", "src-118" ], "entity_ids": [ "hulio", "nso", "convexum", "brg" ] }, { "id": "c-brg-information-dispute", "kind": "attributed", "text": "Court documents described in March 2022 reporting show NSO's management declining to give BRG full financial information, saying that disclosure to a foreign investor required approval from the Israeli Defence Ministry's export control body because some of the information was classified; the approval had reportedly not been received. In court papers reported in February 2022, BRG's lawyers said that since the Pegasus Project disclosures the only new potential customer bookings for Pegasus came from \"elevated risk customers\", while lawyers for NSO's lenders said BRG's approach had shut the company off from new customers and deepened its liquidity crisis.", "qualification": "Positions of the parties to the Tel Aviv proceedings as reported by the press.", "response": "A source familiar with NSO said BRG wanted the company to shut down or stop some of its activities with customers, which NSO said its legal obligations did not allow unless customers misused the system.", "outcome": "", "source_ids": [ "src-115", "src-120" ], "entity_ids": [ "nso", "brg", "deca" ] }, { "id": "c-brg-luxembourg-suits", "kind": "attributed", "text": "According to the European Parliament report, on 25 April 2022 two of Novalpina's former general partners sued BRG in Luxembourg seeking Novalpina's reinstatement as general partner and the suspension of BRG's decisions. A November 2022 press release of the fund's general partner said that on 6 May 2022 the fund and its vehicles had filed a criminal complaint with civil-party joinder against Stefan Kowski, Bastian Lueken and Gerhard Schmidt for abuse of powers, under investigation by an investigating judge.", "qualification": "Accounts of the report and of a party's press release; the complaint is an allegation and no outcome of the investigation is recorded in the retained documents.", "response": "", "outcome": "The court dismissed the former general partners' demands and BRG remained in charge of the fund; according to the general partner, a Luxembourg judge also rejected Novalpina's expedited attempt to confirm a veto right in November 2022.", "source_ids": [ "src-066", "src-097" ], "entity_ids": [ "novalpina", "brg", "noal", "treo-gp", "kowski", "lueken", "schmidt" ], "adverse_subject_ids": [ "kowski", "lueken", "schmidt" ] }, { "id": "c-brg-fund-suits", "kind": "attributed", "text": "In its March 2025 petition in the Southern District of New York (1:25-mc-00133), the general partner TREO NOAL GP said that the fund's investment in NSO Group is the subject of proceedings in the Commercial Court of England and Wales against Novalpina's founders claiming damages for conspiracy, among other things, and sought discovery from the law firm Weil, Gotshal & Manges for Luxembourg proceedings; US legal press reported in 2025 that the fund's 2021 financial difficulties and its founders' falling-out were the subject of litigation in Luxembourg.", "qualification": "Statements of a party and of the press; the claims are unadjudicated in the retained records.", "response": "The defendants filed defences to the English claim in January 2025, according to the petition's exhibit list.", "outcome": "", "source_ids": [ "src-105", "src-106" ], "entity_ids": [ "treo-gp", "noal", "kowski", "lueken", "peel", "weil" ] }, { "id": "c-brg-schmidt", "kind": "attributed", "text": "US legal press reported in October 2025, citing British business press and court documents, that Weil Gotshal partner Gerhard Schmidt invested €5 million in Novalpina Capital in 2017 without the usual fees and chaired it, advised Novalpina on the NSO deal and sat on the board of the holding company that oversaw NSO's operations; according to the court filing he \"would have been voting\" when NSO's oversight board took steps to renew Saudi Arabia's access to Pegasus after the murder of Jamal Khashoggi, access that two people familiar with the matter said was restored by mid-2019. In April 2019 a coalition of NGOs had written to Novalpina questioning the independence of Schmidt, reportedly non-executive chairman and director of Novalpina Capital Group S.à r.l., as part of its legal compliance team.", "qualification": "Press and NGO accounts; the voting statement comes from a party's court filing and the Saudi access account from unnamed sources.", "response": "NSO said in a statement that it complies fully with all applicable laws and regulations and sells its technologies exclusively to vetted intelligence and law enforcement agencies.", "outcome": "", "source_ids": [ "src-105", "src-108" ], "entity_ids": [ "schmidt", "novalpina", "novalpina-group", "triangle", "nso", "weil" ] }, { "id": "c-brg-qcyber-suit", "kind": "attributed", "text": "In January 2023 Q Cyber Technologies sued in the Tel Aviv District Court BRG, the parent companies, the syndicate of lenders and the founders Shalev Hulio and Omri Lavie, asking the court to declare who its board of directors is, whether the appointments of Tamara Makarenko and Asher Alan Bornstein, named by BRG, were valid, and whether a board decision of 29 December 2022 requiring the company to hand over information and documents was valid; it also sought urgent interim relief preserving the position before the new directors' appointment. Q Cyber said that it and its management took no position on the merits of the dispute between the defendants but faced serious consequences if they complied with decisions later found unlawful.", "qualification": "Account of Q Cyber's statement of claim in Israeli business reporting of January 2023; the case number is not given in the retained documents.", "response": "", "outcome": "A notice filed in the proceeding in February 2023 informed the court that the lenders had exercised their rights under the loan agreements; according to a March 2023 report, the new controlling owner then replaced the directors down the chain, including those appointed by BRG. No ruling on the claim is recorded in the retained documents.", "source_ids": [ "src-060", "src-011" ], "entity_ids": [ "qcyber", "brg", "hulio", "lavie", "makarenko", "bornstein", "shohat" ] }, { "id": "c-brg-qcyber-suit-background", "kind": "attributed", "text": "According to Q Cyber's claim, a Luxembourg court ruled in December 2022, in a dispute among Novalpina's directors, that acts of directors appointed by Novalpina between August and December 2021 were void, after which BRG moved to appoint Tamara Makarenko and Asher Alan Bornstein as directors of the group companies; on 16 December 2022 the minority shareholders Hulio and Lavie wrote that the new directors' decisions were invalid, and on 29 December the syndicate of lenders, which had lent the group about half a billion dollars, also questioned their legitimacy. The new directors held the board meeting on 29 December regardless and demanded commercially sensitive documents; Makarenko declined to produce the decision appointing her and relied on an opinion of English counsel.", "qualification": "Q Cyber's account in its claim as reported by the press; the Luxembourg ruling itself was not retained.", "response": "", "outcome": "", "source_ids": [ "src-060" ], "entity_ids": [ "qcyber", "novalpina", "brg", "makarenko", "bornstein", "hulio", "lavie" ] }, { "id": "c-brg-objection", "kind": "attributed", "text": "Responding to Q Cyber's interim relief request on 22 January 2023, some respondents, including the controlling fund's side and its appointed directors, asked the court to reject it, alleging bad faith. They argued that Shalev Hulio, although he formally resigned as chief executive in August 2022 and left the board, remained extensively involved in decision-making through the current chief executive Yaron Shohat, and that because management concealed its actions the company might be selling its products, described as offensive cyber weapons, to problematic or high-risk customers. They added that Hulio had attended the disputed board meeting without protest and voted on the proposals.", "qualification": "Allegations made by respondents in court papers, as reported by Israeli business press on 23 January 2023; not findings of the court.", "response": "NSO said in response: \"Our request for declaratory relief is our response.\"", "outcome": "", "source_ids": [ "src-048" ], "entity_ids": [ "qcyber", "hulio", "shohat", "nso", "novalpina" ], "adverse_subject_ids": [ "hulio" ] }, { "id": "c-brg-makarenko-register", "kind": "attributed", "text": "Luxembourg register publications summarised by a company-data aggregator record Tamara Makarenko as a manager of NorthPole Newco from 22 December 2021 (replacing Gaëtan Dumont and Allen Foley) until 4 January 2022, Anthony Levy as a manager from 24 December 2021, and Asher A. Bornstein and Tamara Makarenko as managers from 29 December 2022; on 20 January 2023 Anthony Levy left.", "qualification": "Aggregator summary of register publications.", "response": "", "outcome": "", "source_ids": [ "src-006" ], "entity_ids": [ "northpole-newco", "makarenko", "bornstein", "anthony-levy", "dumont" ] }, { "id": "c-brg-triangle-uk-2023", "kind": "fact", "text": "The UK Companies House record of Triangle Holdings S.A. as an overseas company (FC040779) lists eight active directors, each shown as appointed on 1 August 2023: Howard Samuel Berkowitz, Jeffrey Robert Dunn, Gavin Brian Farrell and Finbarr Timothy O'Connor, with a New York correspondence address; Tamara Makarenko and James Ward; and NSO's founders Shalev Holy (Hulio) and Omri Lavie.", "qualification": "The date is the appointment date in the UK overseas-company record; Luxembourg notices give earlier appointment dates for some of the same directors.", "response": "", "outcome": "", "source_ids": [ "src-124" ], "entity_ids": [ "triangle", "berkowitz", "dunn", "farrell", "oconnor", "makarenko", "ward", "hulio", "lavie" ] }, { "id": "c-ctl-foreclosure-2023", "kind": "attributed", "text": "Israeli business reporting on 1 March 2023 said that the syndicate of lenders that had lent about half a billion dollars for the buyback from Francisco Partners exercised its rights under the loan agreements: the shares of NSO's Luxembourg parent NorthPole, until then held by a holding company called Diamond and pledged to the lenders, were transferred directly to Dufresne Holdings, a holding company created in Luxembourg in January 2023. According to the Luxembourg register as of 10 February, Dufresne had one shareholder and one director, Omri Lavie, and the new controlling owner replaced the directors throughout the chain, including those appointed by BRG, pending the entry of a new group of investors.", "qualification": "Press account of a notice filed in Q Cyber's Tel Aviv proceedings and of the Luxembourg register; the report calls OSY NSO's Israeli parent, whereas the Israeli parent is Q Cyber.", "response": "NSO did not respond to the publication. A spokesperson for TREO NOAL GP, general partner of the fund, said the lenders, who had exercised effective control over NSO for the past 15 months, had seemingly organised a foreclosure after NSO failed to meet its financial obligations since 2021, that the fund had been denied basic corporate information including on compliance with US law and sales to elevated-risk customers, and that the fund's investment had been and remained valueless.", "outcome": "", "source_ids": [ "src-011" ], "entity_ids": [ "northpole-newco", "diamond", "dufresne", "lavie", "brg", "nso", "osy", "treo-gp", "noal" ], "adverse_subject_ids": [ "northpole-newco" ] }, { "id": "c-ctl-dufresne-register", "kind": "attributed", "text": "Luxembourg register publications summarised by a company-data aggregator record that Dufresne Holding S.à r.l. (register number B275054) was registered on 27 January 2023 with capital of €12,000 and Omri Lavie as manager and one shareholder; that a publication of 24 February 2023 records it in place of Diamond LIE as NorthPole Newco's shareholder; that a publication of 16 March 2023 lists Robert Bruce Simonds and Omri Lavie as its managers and one of 17 August 2023 records that Simonds ceased to be a manager; that Lavie was listed as manager and partner in 2023 and 2024; and that a publication of 17 August 2026 again lists Lavie as manager and member of the executive board, with one shareholder.", "qualification": "Aggregator summary of register publications; its dates are publication dates, and NorthPole Newco's accounts date the new shareholder's pledge and Lavie's appointment as manager to 17 February 2023.", "response": "", "outcome": "", "source_ids": [ "src-007", "src-006", "src-018", "src-035" ], "entity_ids": [ "dufresne", "lavie", "northpole-newco", "diamond", "simonds" ] }, { "id": "c-ctl-newco-pledge-2023", "kind": "fact", "text": "NorthPole Newco's 2024 accounts record that on 17 February 2023 all shares held by its new shareholder were pledged to Wilmington Trust (London) Limited as collateral agent, and that after the \"appropriation\" the lenders agreed on 16 March 2023 to the change of control of the company and its subsidiaries and extended a super-priority loan of USD 5,000,000; the accounts list Omri Lavie as a manager from 17 February 2023 and Anthony Levy from 15 March 2023, with the same two managers at OSY Technologies.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-061", "src-062" ], "entity_ids": [ "northpole-newco", "wilmington", "lavie", "anthony-levy", "osy" ] }, { "id": "c-ctl-lavie-mandates-2023", "kind": "attributed", "text": "A company-data aggregator's page for Omri Lavie, summarising Luxembourg register publications, lists him as a manager of OSY Technologies and Q Cyber Technologies S.à r.l. in publications of 23 February 2023 and of NorthPole Newco in one of 24 February 2023, which also records Dufresne Holding in place of Diamond LIE as NorthPole Newco's shareholder; in each company Anthony Levy appears beside him as a manager from March 2023, and publications of August 2024 still list both.", "qualification": "Aggregator summary of register publications.", "response": "", "outcome": "", "source_ids": [ "src-018" ], "entity_ids": [ "lavie", "osy", "qcyber-lux", "northpole-newco", "anthony-levy", "dufresne", "diamond" ] }, { "id": "c-ctl-press-2023", "kind": "attributed", "text": "Reporting in August 2023 stated that since February 2023 NSO's controlling shares had been held by Dufresne Holding in Luxembourg after NSO's creditors, including Credit Suisse, Senator Investment Group and Birch Grove Capital, took the shares and transferred them to a new holding company owned solely by founder Omri Lavie, and that the company still carried about half a billion dollars of debt from the buyback from Francisco Partners.", "qualification": "Press account.", "response": "", "outcome": "", "source_ids": [ "src-091" ], "entity_ids": [ "dufresne", "nso", "lavie", "credit-suisse", "senator", "birch-grove", "francisco" ] }, { "id": "c-ctl-simonds-2023", "kind": "attributed", "text": "According to Israeli business reporting, Hollywood producer Robert Simonds, founder of STX Entertainment, joined the board of the holding company shortly after the 2023 transfer, at the lenders' initiative to raise financing; he tried to acquire NSO in June 2023. The August 2023 report suggested he may have been forced out for lack of Israeli Defence Ministry approval, possibly because of business ties to China.", "qualification": "The reasons for his departure are the publication's speculation, not a recorded decision of the ministry.", "response": "", "outcome": "He left the board in August 2023 after five months, when the acquisition attempt had failed.", "source_ids": [ "src-013", "src-091" ], "entity_ids": [ "simonds", "dufresne", "nso", "stx" ] }, { "id": "c-ctl-us-investors-2025", "kind": "attributed", "text": "On 10 October 2025 NSO spokesperson Oded Hershowitz told a US technology publication that \"an American investment group has invested tens of millions of dollars in the company and has acquired controlling ownership\", adding that the headquarters and core operations remained in Israel under Israeli supervision including the Ministry of Defense. Israeli business reporting the same day said the group was led by Robert Simonds, that the deal was valued at several tens of millions of dollars and expected to include the divestment of NSO's roughly $500 million debt, that completion required approval from the Defence Ministry's export control agency, and that Omri Lavie's involvement would end.", "qualification": "The investors and terms were not disclosed; the company's spokesperson later declared his comments off the record, according to the publication.", "response": "The spokesperson declined to name the investors or the amount invested; Lavie did not immediately comment, and neither Simonds nor STX Entertainment responded to the publication's request for comment.", "outcome": "Luxembourg register notices record that on 8 October 2025 Dufresne Holding transferred all of NorthPole Newco's shares to Ohad Shazar Shalem Schremer, who replaced Lavie as its manager. The retained documents do not name the investors or record the export control agency's decision.", "source_ids": [ "src-012", "src-013", "src-035" ], "entity_ids": [ "nso", "simonds", "lavie", "deca" ] }, { "id": "c-ctl-founders-out", "kind": "attributed", "text": "Israeli press reported in November 2025 that a group of US investors led by Robert Simonds had bought a controlling stake in NSO in October 2025 and that NSO's founders, Niv Karmi, Shalev Hulio and Omri Lavie, were no longer shareholders.", "qualification": "Press account; the investors other than Simonds were not named.", "response": "", "outcome": "", "source_ids": [ "src-027" ], "entity_ids": [ "nso", "simonds", "karmi", "hulio", "lavie" ] }, { "id": "c-ctl-debt-purchase", "kind": "attributed", "text": "Israeli business reporting in November 2025 said that the change of control took place through the purchase of the company's debt by a new group whose members were not published, which led to Lavie's removal and Friedman's appointment, and that Luxembourg filings of late October and early November named Ohad Shazar Shalem Schremer, a lawyer, as a director of NorthPole Newco, OSY Technologies and Q Cyber Technologies S.à r.l.", "qualification": "Press account; the debt purchase itself is not shown in the retained register notices.", "response": "", "outcome": "", "source_ids": [ "src-050" ], "entity_ids": [ "nso", "lavie", "friedman", "schremer", "northpole-newco", "osy", "qcyber-lux" ] }, { "id": "c-ctl-newco-oct-2025", "kind": "fact", "text": "A notice published in Luxembourg's register on 7 November 2025 records that, by decisions of NorthPole Newco's sole shareholder of 8 October 2025, Omri Lavie resigned as manager and Ohad Shazar Shalem Schremer was appointed manager for an indefinite term, and that on 8 October 2025 Dufresne Holding (B275054) transferred all of its shares in NorthPole Newco, 100% of the capital, to Schremer, who became the sole shareholder.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-035" ], "entity_ids": [ "northpole-newco", "lavie", "schremer", "dufresne" ] }, { "id": "c-ctl-osy-oct-2025", "kind": "fact", "text": "A notice for OSY Technologies S.à r.l. published on 30 October 2025 records Ohad Shazar Shalem Schremer as a manager from 8 October 2025, the renewal of Anthony Levy's mandate as manager (appointed 15 March 2023), and the removal of Omri Lavie from the board of managers.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-038" ], "entity_ids": [ "osy", "schremer", "anthony-levy", "lavie" ] }, { "id": "c-ctl-qcl-oct-2025", "kind": "fact", "text": "A notice for Q Cyber Technologies S.à r.l. (Luxembourg) published on 28 October 2025 records Ohad Shazar Shalem Schremer as a manager from 8 October 2025, Anthony Michael Levy as manager since 15 March 2023 and delegate for day-to-day management since 5 June 2023, and the removal of Omri Lavie from the board of managers.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-043" ], "entity_ids": [ "qcyber-lux", "schremer", "anthony-levy", "lavie" ] }, { "id": "c-ctl-pledge-dec-2025", "kind": "fact", "text": "A register notice published on 22 December 2025 records that on 8 December 2025, by realisation of a pledge followed by a private sale, all of NorthPole Newco's shares held by Ohad Shazar Shalem Schremer, four classes representing 100% of the capital, were transferred to Hippocrene Ventures LLC, a Delaware limited liability company registered under number 10338240, which became the sole shareholder.", "qualification": "The notice does not name the pledgee.", "response": "", "outcome": "", "source_ids": [ "src-034" ], "entity_ids": [ "northpole-newco", "schremer", "hippocrene" ] }, { "id": "c-ctl-sale-back-dec-2025", "kind": "fact", "text": "A register notice published on 26 February 2026 records that under a share purchase agreement of 30 December 2025 Hippocrene Ventures LLC sold all of NorthPole Newco's shares (559,737,894 class A and 558,376,950 each of classes B, C and D, 100% of the capital) to Ohad Shazar Shalem Schremer, who became the sole shareholder with effect from 30 December 2025.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-033" ], "entity_ids": [ "northpole-newco", "hippocrene", "schremer" ] }, { "id": "c-ctl-lux-press-2026", "kind": "attributed", "text": "Luxembourg business press reported in April 2026 that Omri Lavie had been removed as a director of three key Luxembourg entities within ten days, Q Cyber Technologies on 28 October 2025, OSY Technologies on 30 October and NorthPole Newco on 7 November, and that on 30 December 2025 Hippocrene Ventures LLC transferred NorthPole Newco's entire share capital to an individual; it added that on 26 February 2026 NorthPole Newco recorded a further change in shareholding and in its legal form. An aggregator summary of the register shows a change of shareholders on 26 February 2026.", "qualification": "The dates the publication gives for Lavie's removal are the publication dates of the register notices, which record 8 October 2025 as the effective date. The register notice published on 26 February 2026 is the one recording the 30 December 2025 sale; no retained document shows a later owner or the change of legal form.", "response": "", "outcome": "", "source_ids": [ "src-015", "src-006" ], "entity_ids": [ "lavie", "qcyber-lux", "osy", "northpole-newco", "hippocrene", "schremer" ] }, { "id": "c-ctl-friedman-appointment", "kind": "fact", "text": "According to his witness biography published by the US House of Representatives, former US ambassador to Israel David M. Friedman was appointed on 10 November 2025 executive chairman of the Luxembourg holding company that owns NSO Group and of a Delaware subsidiary of that company; a register notice published on 30 December 2025 records his appointment as a manager of OSY Technologies with effect from 15 December 2025.", "qualification": "The biography does not name the companies.", "response": "", "outcome": "", "source_ids": [ "src-016", "src-037" ], "entity_ids": [ "friedman", "osy", "nso" ] }, { "id": "c-ctl-transparency-2025", "kind": "attributed", "text": "NSO Group's transparency report for 2025 states that in 2025 the group entered a new phase following a change in ownership and the appointment of David Friedman as executive chairman of its holding company; press in January 2026 reported that chief executive Yaron Shohat had also stepped down and that Omri Lavie, the last founder still involved, had left.", "qualification": "The company's report does not name the new owners.", "response": "", "outcome": "", "source_ids": [ "src-084", "src-080" ], "entity_ids": [ "nso", "friedman", "shohat", "lavie" ] }, { "id": "c-ctl-friedman-statements", "kind": "attributed", "text": "In an interview reported in November 2025, Friedman said he would make the case to the Trump administration that NSO's technology could help make Americans safer and would seek to sell its products to US law enforcement agencies, that \"the NSO of today is a far more careful company in how it licenses its technology than it was five six years ago\", and that \"this change of control and ownership brings with it sufficient capital to maintain the business\".", "qualification": "Statements of the executive chairman.", "response": "", "outcome": "", "source_ids": [ "src-027" ], "entity_ids": [ "friedman", "nso" ] }, { "id": "c-lux-qcl-identity", "kind": "attributed", "text": "Q Cyber Technologies S.à r.l. is a separate Luxembourg company from Q Cyber Technologies Ltd: according to Luxembourg register publications summarised by a company-data aggregator it was registered on 8 January 2016 (register number B203124) with capital of €12,500, OSY Technologies as shareholder and Eran Gorev, Yuval Somekh and K. Wilson as managers. A publication of May 2019 lists its legal form as société à responsabilité limitée and its name as Q Cyber Technologies; on 20 August 2019 Charline de Maigret and \"Shalev Holy\" became managers and Eran Gorev and Kevin Wilson left, and Yuval Somekh was again listed as a manager on 10 September 2019.", "qualification": "Aggregator summary of register publications. \"Shalev Holy\" is the spelling under which Shalev Hulio appears in Luxembourg and UK records.", "response": "", "outcome": "", "source_ids": [ "src-010" ], "entity_ids": [ "qcyber-lux", "osy", "gorev", "somekh", "kevin-wilson", "de-maigret", "hulio" ] }, { "id": "c-lux-trademarks", "kind": "attributed", "text": "Aggregator summaries of register publications list a word mark \"Q Cyber Technologies\" (16 May 2017) and a word-figurative mark \"Q\" (20 October 2016) under OSY Technologies, together with OSY's shareholding in Q Cyber Technologies.", "qualification": "Aggregator listing; the trade mark registers themselves were not retained.", "response": "", "outcome": "", "source_ids": [ "src-005" ], "entity_ids": [ "osy", "qcyber-lux" ] }, { "id": "c-lux-osy-identity", "kind": "attributed", "text": "According to a company-data aggregator's summary of the Luxembourg register, OSY Technologies S.à r.l. is registered under number B184226 (European unique identifier LURCSL.B184226) with LEI 222100KKW3GGPGATJ296, has its address at 44 rue de la Vallée, L-2661 Luxembourg, and is classified under NACE code 64.99, other financial service activities.", "qualification": "Aggregator summary of the register; the register number also appears in the company's own Israeli filings and its accounts.", "response": "", "outcome": "", "source_ids": [ "src-005" ], "entity_ids": [ "osy" ] }, { "id": "c-lux-osy-managers", "kind": "attributed", "text": "Luxembourg register publications summarised by the same aggregator record further changes on OSY Technologies' board of managers: Asher Levy as a manager from 17 September 2020 until 4 January 2022; the departure of Gerhard Schmidt on 25 August 2021, Stephen Peel on 13 September 2021, Mickael Betito and Stefan Kowski on 20 September 2021 and Yuval Somekh on 4 November 2021; Anthony Levy as a manager from 7 December 2021; Omri Lavie as a manager from 23 February 2023, when five managers left, joined by Anthony Levy on 17 March 2023; a notice of 30 October 2025 removing Lavie's entry as manager and naming Anthony Michael Levy as manager; and David M. Friedman as manager and member of the executive board in a notice of 30 December 2025.", "qualification": "Dates are those of the register publications as listed by the aggregator, not necessarily the dates of the underlying decisions.", "response": "", "outcome": "", "source_ids": [ "src-005" ], "entity_ids": [ "osy", "asher-levy", "schmidt", "peel", "kowski", "somekh", "anthony-levy", "lavie", "friedman" ] }, { "id": "c-lux-distributor", "kind": "attributed", "text": "NSO Group told the authors of the 2021 NGO report that Q Cyber Technologies S.à r.l. acts as commercial distributor for the products of the group companies: it signs contracts, issues invoices and receives payments from group customers, which form the basis of its reported income; it does not export group products and has not sought an export licence in Luxembourg. The report gives its net turnover from the sale and distribution of computer equipment and services as USD 24,738,462 in 2016, USD 82,651,201 in 2017, USD 169,214,909 in 2018 and USD 229,839,361 in 2019.", "qualification": "NSO Group's description; turnover figures as quoted from the company's accounts in the report.", "response": "NSO Group: the Luxembourg company does not export group products.", "outcome": "", "source_ids": [ "src-021" ], "entity_ids": [ "qcyber-lux", "nso" ] }, { "id": "c-lux-sales-hub", "kind": "attributed", "text": "Luxembourg business press reported in August 2022, based on financial filings, that NSO Group had booked most of its sales over the previous two years in Luxembourg.", "qualification": "Only the headline and summary of the article were retained.", "response": "", "outcome": "", "source_ids": [ "src-029" ], "entity_ids": [ "nso" ] }, { "id": "c-lux-qcl-results", "kind": "attributed", "text": "Figures summarised by a Luxembourg company-data site from Q Cyber Technologies S.à r.l.'s filed accounts show net income of $9.28 million (2022), $10.1 million (2023), $7.98 million (2024) and $7.66 million (2025), and equity falling from $27.3 million (2022) to $10.4 million (2023) and $4.89 million (2024) before rising to $6.04 million (2025).", "qualification": "Rounded figures from an aggregator.", "response": "", "outcome": "", "source_ids": [ "src-042" ], "entity_ids": [ "qcyber-lux" ] }, { "id": "c-lux-dividends-loan", "kind": "fact", "text": "OSY Technologies' 2024 accounts record dividends from Q Cyber Technologies S.à r.l. of USD 13,500,000 in 2024 and USD 27,000,000 in 2023, and a short-term loan owed by OSY to Q Cyber Technologies S.à r.l. with a principal of USD 163,680,016 at the end of 2024 (USD 197,840,966 in 2023), drawable up to USD 300,000,000 and extended in June 2023 to 30 June 2025.", "qualification": "Luxembourg press reported the two years' dividends together as $40.5 million.", "response": "", "outcome": "", "source_ids": [ "src-062" ], "entity_ids": [ "osy", "qcyber-lux" ] }, { "id": "c-lux-osy-finances", "kind": "fact", "text": "OSY Technologies' 2024 accounts show negative equity of USD 272,166,845 and a loss of USD 2,809,165 for 2024; a term loan of USD 114,548,695 owed to NorthPole Newco, originally a USD 258,549,810 loan of the term-loan proceeds made on 18 March 2019; and four full-time-equivalent staff. They omit details of companies in which OSY holds at least 20% as \"seriously prejudicial\" to them, while putting the fair market value of its subsidiaries at USD 842,000,000 under an internal valuation of November 2020.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-061", "src-062" ], "entity_ids": [ "osy", "northpole-newco" ], "adverse_subject_ids": [ "osy" ] }, { "id": "c-lux-osy-aggregator", "kind": "attributed", "text": "A Luxembourg company-data site summarising OSY's filed accounts shows net income of $3.9 million (2021), -$9.39 million (2022), $7.4 million (2023) and -$2.81 million (2024), and equity of -$267 million to -$277 million in each year from 2021 to 2024.", "qualification": "Rounded aggregator figures.", "response": "", "outcome": "", "source_ids": [ "src-036" ], "entity_ids": [ "osy" ], "adverse_subject_ids": [ "osy" ] }, { "id": "c-lux-iota-note", "kind": "fact", "text": "According to OSY's 2024 accounts, on 1 December 2014 IOTA Holdings Limited issued a promissory note of USD 94,000,000 at 4% to its former shareholder in connection with the acquisition of IOTA's subsidiaries; OSY paid the amount due to IOTA's former shareholder in 2015, and an amended note transferred the former shareholder's rights under it to OSY, which carries it as a loan to IOTA with a principal of USD 116,063,116 at the end of 2024.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-062" ], "entity_ids": [ "osy", "iota" ] }, { "id": "c-lux-osy-loans-out", "kind": "fact", "text": "OSY's 2024 accounts also record a revolving credit facility of up to USD 2,000,000 at 3% granted to Gideon Cyber Systems LLC under an agreement of 31 January 2022 effective from 31 August 2021 (principal USD 1,802,000 at the end of 2024), and a facility to Westbridge Technologies, Inc. with a principal of USD 1,589,854.", "qualification": "The accounts list the Gideon facility among other debtors, not among affiliated undertakings, and do not describe Gideon's business.", "response": "", "outcome": "", "source_ids": [ "src-062" ], "entity_ids": [ "osy", "gideon", "westbridge" ] }, { "id": "c-lux-pledges", "kind": "fact", "text": "OSY's 2024 accounts record share pledges to Wilmington Trust (London) Limited over its equity interests in Westbridge Technologies, Inc. (8 April 2019, New York law), over OSY itself granted by NorthPole Newco (8 April 2019), over the shares it holds in an unnamed affiliated undertaking (17 May 2022, Israeli law) and over its shares in Iota Holdings Limited (17 May 2022, Cypriot law); NorthPole Newco's accounts record a first-ranking pledge of all OSY shares to Wilmington Trust as collateral agent under an agreement of 14 March 2019.", "qualification": "The Israeli-law pledge does not name the affiliated company; Q Cyber Technologies Ltd is the Israeli company that OSY is recorded as owning.", "response": "", "outcome": "", "source_ids": [ "src-062", "src-061" ], "entity_ids": [ "osy", "wilmington", "westbridge", "northpole-newco", "iota" ] }, { "id": "c-lux-newco-finances", "kind": "fact", "text": "NorthPole Newco's 2024 accounts, filed on 29 July 2025, show amounts owed to credit institutions of USD 713,118,477 (USD 638,678,345 a year earlier) within total creditors of USD 746,156,153, a 2024 loss of USD 79,516,731.27 carried forward to an accumulated deficit of USD 322,449,975.86, term-loan principal of USD 440,073,128 with accrued interest of USD 177,532,472, and its 100% holding in OSY at a book value of USD 550,885,976 against an internal November 2020 valuation of USD 873,963,000.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-061" ], "entity_ids": [ "northpole-newco", "osy" ] }, { "id": "c-lux-newco-forbearance", "kind": "fact", "text": "NorthPole Newco's accounts record a forbearance agreement dated 31 December 2021 among Westbridge Technologies, Inc. and NorthPole Newco as borrowers, the lenders and Wilmington Trust (London) Limited as collateral agent, under which the lenders agreed to forbear from enforcement after certain events of default; the borrowers agreed a forbearance fee of USD 23,823,127, and in January 2022 NorthPole Newco paid USD 924,303 to terminate a currency swap with Jefferies Structured Credit LLC.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-061" ], "entity_ids": [ "northpole-newco", "westbridge", "wilmington", "jefferies" ], "adverse_subject_ids": [ "northpole-newco" ] }, { "id": "c-lux-newco-aggregator", "kind": "attributed", "text": "A Luxembourg company-data site summarising NorthPole Newco's filed accounts shows net losses of $45.6 million (2021), $37 million (2022), $86.8 million (2023) and $79.5 million (2024), with equity falling from $208 million (2021) to $4.35 million (2024); Luxembourg press in April 2026 described the 2024 accounts as showing bank debt of $713 million at NorthPole Newco and negative equity at OSY.", "qualification": "Aggregator and press summaries; the press gave OSY's negative equity as €272 million, whereas OSY's accounts state USD 272,166,845.", "response": "", "outcome": "", "source_ids": [ "src-032", "src-015" ], "entity_ids": [ "northpole-newco", "osy" ] }, { "id": "c-lux-triangle-identity", "kind": "attributed", "text": "Triangle Holdings SA is registered in Luxembourg under number B192115 with LEI 54930042RZ0X284GK323, as a holding company. A company-data site summarising its accounts shows equity of $273 million for 2019 and 2020 and negative equity of $4.32 million for 2022, with a 2022 net loss of $4.57 million.", "qualification": "Identifiers and financial figures from aggregator summaries; the office move is from an official notice.", "response": "", "outcome": "A register notice records that its registered office moved on 4 July 2023 from 2 rue Edward Steichen to 15 boulevard Friedrich Wilhelm Raiffeisen, Luxembourg, the address company-data sites still gave in October 2026.", "source_ids": [ "src-074", "src-072", "src-017" ], "entity_ids": [ "triangle" ] }, { "id": "c-lux-uk-branches", "kind": "attributed", "text": "UK branch registrations of Triangle Holdings and Square 2, as summarised by a company-data aggregator, record petitions to wind up on 2 May 2024; the summaries do not name the petitioner.", "qualification": "Aggregator summaries of UK publications concerning the UK establishments of the two Luxembourg companies; the Luxembourg companies continued to file accounts, Square 2 most recently for 2023 in October 2026.", "response": "", "outcome": "Winding-up orders followed on 30 May 2024 and liquidators were appointed in June 2024; progress reports in a winding up by the court were published in 2025 and 2026.", "source_ids": [ "src-017", "src-095" ], "entity_ids": [ "triangle", "square2" ], "adverse_subject_ids": [ "triangle", "square2" ] }, { "id": "c-lux-seven-entities", "kind": "attributed", "text": "Luxembourg press reported in April 2026 that at least seven NSO-affiliated entities remained active or had recently been active in the Luxembourg register, all at 44 rue de la Vallée: Dufresne Holding (B275054), NorthPole Newco (B230411), OSY Technologies (B184226), the Luxembourg Q Cyber Technologies, NorthPole Bidco, Triangle Holdings (B192115) and Square 2.", "qualification": "Press account; Triangle's own register notice of July 2023 gives a different registered office.", "response": "", "outcome": "", "source_ids": [ "src-015" ], "entity_ids": [ "dufresne", "northpole-newco", "osy", "qcyber-lux", "northpole-bidco", "triangle", "square2", "nso" ] }, { "id": "c-wa-complaint", "kind": "attributed", "text": "On 29 October 2019 WhatsApp Inc. and Facebook, Inc. sued NSO Group Technologies Ltd. and Q Cyber Technologies Ltd. in the US District Court for the Northern District of California, alleging that between about April and May 2019 the defendants used WhatsApp servers in the United States and elsewhere to send malware to approximately 1,400 mobile phones, whose users, according to the complaint, included attorneys, journalists, human rights activists, political dissidents, diplomats and senior foreign government officials. The complaint relied on Israeli register records to describe Q Cyber as NSO's sole active director and majority shareholder and OSY Technologies as Q Cyber's sole shareholder and director.", "qualification": "Allegations in the complaint.", "response": "The defendants argued that they were entitled to immunity because they acted for foreign governments, that Pegasus was marketed only to and used only by sovereign governments, and that their role was limited to advice and technical support in setting up, not operating, the technology; the district court and, in November 2021, the Ninth Circuit rejected the immunity defence.", "outcome": "The court later granted partial summary judgment on liability; the jury's punitive award of May 2025 was remitted to $4,002,471 in October 2025, a permanent injunction and final judgment followed on 12 November 2025, and the defendants appealed.", "source_ids": [ "src-004", "src-030", "src-026", "src-057", "src-056" ], "entity_ids": [ "whatsapp", "facebook", "nso", "qcyber", "osy" ] }, { "id": "c-wa-default", "kind": "fact", "text": "The court clerk entered default against NSO Group Technologies Limited and Q Cyber Technologies Limited on 2 March 2020; on 25 March 2020 Judge Phyllis J. Hamilton granted in part the defendants' motion to set the default aside and denied the plaintiffs' motion for alternative service. The defendants' filings in March and April 2020 included declarations of Shalev Hulio.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-030" ], "entity_ids": [ "nso", "qcyber", "whatsapp", "facebook", "hulio" ] }, { "id": "c-wa-motion-dismiss", "kind": "fact", "text": "On 2 April 2020 NSO Group Technologies Limited and Q Cyber Technologies Limited moved to dismiss the case under Federal Rules of Civil Procedure 12(b)(1), (2), (6) and (7). In their certificate of interested entities filed in May 2020, the two companies identified NSO Group Technologies Limited and OSY Technologies SARL as corporate parents. The US Department of Justice filed sealed exhibits and a declaration of a DOJ attorney in connection with WhatsApp's motion to disqualify defence counsel.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-030" ], "entity_ids": [ "nso", "qcyber", "osy", "whatsapp" ] }, { "id": "c-wa-ninth-circuit", "kind": "fact", "text": "On 8 November 2021 the US Court of Appeals for the Ninth Circuit (No. 20-16408) affirmed the district court's denial of NSO Group Technologies Limited's and Q Cyber Technologies Limited's motion to dismiss on grounds of foreign sovereign immunity. The opinion recorded NSO's assertion that its customers include the Kingdom of Bahrain, the United Arab Emirates and Mexico and that its product is used only by sovereign governments.", "qualification": "The customer list is NSO's own assertion recorded by the court, not a finding.", "response": "", "outcome": "", "source_ids": [ "src-026" ], "entity_ids": [ "nso", "qcyber", "whatsapp", "facebook", "bahrain", "uae", "mexico" ] }, { "id": "c-wa-supreme-court", "kind": "fact", "text": "NSO Group Technologies Limited and its co-petitioners asked the US Supreme Court to review the Ninth Circuit decision (No. 21-1338, petition filed 6 April 2022); the Court invited the Solicitor General to express the views of the United States and denied the petition on 9 January 2023.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-052" ], "entity_ids": [ "nso", "qcyber", "whatsapp" ] }, { "id": "c-wa-liability", "kind": "fact", "text": "According to the district court's order of 17 October 2025, the court had granted partial summary judgment for the plaintiffs on liability under the Computer Fraud and Abuse Act, California's Comprehensive Computer Data Access and Fraud Act and for breach of contract; the evidence showed that the defendants reverse-engineered WhatsApp's code to create a modified client application and used it to install their software on target users' devices through WhatsApp's servers.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-057" ], "entity_ids": [ "nso", "qcyber", "whatsapp" ], "adverse_subject_ids": [ "nso", "qcyber" ] }, { "id": "c-wa-verdict", "kind": "fact", "text": "On 6 May 2025 a jury unanimously awarded WhatsApp and Meta the full $444,719 in compensatory damages they sought, found that the defendants acted with malice, oppression or fraud, and awarded $167,254,000 in punitive damages; NSO Group Technologies Limited and Q Cyber Technologies Limited moved for a new trial on 29 May 2025.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-056", "src-057" ], "entity_ids": [ "nso", "qcyber", "whatsapp", "facebook" ], "adverse_subject_ids": [ "nso", "qcyber" ] }, { "id": "c-wa-remittitur", "kind": "fact", "text": "In its order of 17 October 2025 the court held that the punitive award could not exceed a 9:1 ratio and remitted it to $4,002,471, granting the defendants' motion to that extent; WhatsApp and Meta filed a notice accepting the remittitur on 31 October 2025.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-057", "src-056" ], "entity_ids": [ "nso", "qcyber", "whatsapp", "facebook" ], "adverse_subject_ids": [ "nso", "qcyber" ] }, { "id": "c-wa-injunction", "kind": "fact", "text": "The same order found that the defendants' conduct caused irreparable harm and that there was no dispute that it was ongoing, citing the August 2024 testimony of NSO's chief executive Yaron Shohat, and granted a permanent injunction; it directed the plaintiffs to exclude the defendants' sovereign government customers, which were not parties, from its scope. The injunction order and final judgment were entered on 12 November 2025.", "qualification": "The order does not name the sovereign customers.", "response": "", "outcome": "", "source_ids": [ "src-056", "src-057" ], "entity_ids": [ "nso", "qcyber", "whatsapp", "shohat" ], "adverse_subject_ids": [ "nso", "qcyber" ] }, { "id": "c-wa-appeals", "kind": "fact", "text": "NSO Group Technologies Limited and Q Cyber Technologies Limited appealed to the Ninth Circuit on 19 November 2025 (USCA No. 25-7380) and moved to stay the injunction; Judge Hamilton denied a stay on 19 December 2025 while extending an administrative stay by 45 days, and the Ninth Circuit denied a stay on 28 January 2026. On 30 January 2026 the court granted the plaintiffs' motion for attorney's fees, which the defendants appealed on 11 February 2026 (USCA No. 26-874); the district court case was terminated on 2 February 2026.", "qualification": "The retained records do not show the outcome of the appeals.", "response": "", "outcome": "", "source_ids": [ "src-031", "src-030", "src-056" ], "entity_ids": [ "nso", "qcyber", "whatsapp" ], "adverse_subject_ids": [ "nso", "qcyber" ] }, { "id": "c-wa-contempt", "kind": "fact", "text": "After judgment, Meta Platforms and WhatsApp pursued discovery in aid of enforcement and on 8 June 2026 moved to hold the defendants in contempt; on 16 October 2026 Judge Hamilton denied the contempt motion and issued an order on post-judgment discovery disputes.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-031" ], "entity_ids": [ "whatsapp", "nso", "qcyber", "facebook" ] }, { "id": "c-wa-us-use-argument", "kind": "attributed", "text": "In their response and objection to the plaintiffs' proposed injunction order, filed on 4 November 2025, NSO Group Technologies and Q Cyber Technologies argued that it was reasonably foreseeable that a US law enforcement or intelligence agency would use Pegasus and that an injunction limiting its use could hinder government operations in a crisis; a footnote stated that in 2018 the FBI licensed the use of Pegasus and the CIA assisted Djibouti in obtaining a Pegasus licence, citing a sealed exhibit (Dkt. 616-2).", "qualification": "Statements of the defendants in court papers; the exhibit cited was filed under seal.", "response": "", "outcome": "", "source_ids": [ "src-081", "src-077", "src-085" ], "entity_ids": [ "nso", "qcyber", "fbi", "djibouti" ] }, { "id": "c-wa-declarants", "kind": "fact", "text": "Among the declarations filed for the defendants were those of Yifa Idisis, attached to an opposition of 20 March 2025, and of NSO's chief executive Yaron Shohat, whose testimony the court cited.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-085", "src-057" ], "entity_ids": [ "idisis", "nso", "qcyber", "shohat" ] }, { "id": "c-wa-westbridge-motion", "kind": "fact", "text": "Third parties Westbridge Technologies, Josh Shaner and Terrence DiVittorio filed a motion for clarification in the WhatsApp case, which WhatsApp and Meta opposed.", "qualification": "Only the docket description was retained; the motion's content is not described.", "response": "", "outcome": "", "source_ids": [ "src-056" ], "entity_ids": [ "westbridge", "divittorio", "whatsapp", "facebook" ] }, { "id": "c-us-apple", "kind": "fact", "text": "Apple Inc. sued NSO Group Technologies Limited and Q Cyber Technologies Limited in the Northern District of California on 23 November 2021 (Apple Inc. v. NSO Group Technologies Limited, 3:21-cv-09078, Judge James Donato). In a certificate of interested entities filed in February 2022 the defendants identified OSY Technologies as their corporate parent, and on 3 March 2022 they moved to dismiss.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-046" ], "entity_ids": [ "apple", "nso", "qcyber", "osy" ], "adverse_subject_ids": [ "nso", "qcyber" ] }, { "id": "c-us-apple-outcome", "kind": "fact", "text": "The Apple case was stayed in 2022 pending the Supreme Court's decision on NSO's petition in the WhatsApp case; a later order of the same court records that it rejected NSO's forum non conveniens challenge in the Apple case in January 2024. On 13 September 2024 Apple moved to dismiss its own suit voluntarily under Rule 41(a)(2), NSO Group Technologies and Q Cyber Technologies responded, and on 12 November 2024 Judge Donato issued an order on the voluntary dismissal and sealing, terminating the case.", "qualification": "The terms of the order on voluntary dismissal are not described in the retained docket entries.", "response": "", "outcome": "", "source_ids": [ "src-046", "src-047", "src-053" ], "entity_ids": [ "apple", "nso", "qcyber" ], "adverse_subject_ids": [ "nso", "qcyber" ] }, { "id": "c-us-dada-filing", "kind": "fact", "text": "Journalists of the Salvadoran digital newspaper El Faro sued NSO Group Technologies Limited and Q Cyber Technologies Limited in the Northern District of California on 30 November 2022 (Dada v. NSO Group Technologies Limited, 3:22-cv-07513, Judge James Donato), alleging that Pegasus was used against their iPhones; an amended complaint followed in December 2022 and the case was related to the Apple case. The defendants' motion to dismiss of April 2023 was supported by declarations of Roy Blecher and NSO's chief executive Yaron Shohat.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-046", "src-049", "src-054" ], "entity_ids": [ "dada", "nso", "qcyber", "shohat", "apple" ], "adverse_subject_ids": [ "nso", "qcyber" ] }, { "id": "c-us-dada-2024", "kind": "fact", "text": "On 8 March 2024 Judge Donato dismissed the El Faro journalists' suit on the ground of forum non conveniens, accepting NSO's argument that the case involved foreign plaintiffs, foreign defendants and foreign conduct, and closed the case; the order notes the complaint's statement that virtually all of the attacks occurred in El Salvador in connection with news stories the plaintiffs were covering there.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-053", "src-049" ], "entity_ids": [ "dada", "nso", "qcyber" ] }, { "id": "c-us-dada-appeal", "kind": "fact", "text": "On appeal (Nos. 24-2179 and 24-3463), the Ninth Circuit in an unpublished memorandum of 8 July 2025, with Judge Bade dissenting, vacated the forum non conveniens dismissal and remanded; the court described Pegasus as a spyware system developed and deployed by NSO Group Technologies Limited and Q Cyber Technologies Limited, both incorporated in Israel, as alleged by the plaintiffs.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-054" ], "entity_ids": [ "dada", "nso", "qcyber" ] }, { "id": "c-us-dada-2026", "kind": "fact", "text": "After remand the defendants renewed their motion to dismiss in September 2025. On 30 September 2026 Judge Donato granted the motion for lack of personal jurisdiction, dismissed the complaint without prejudice, refused further leave to amend and entered judgment against the plaintiffs; the order describes the gravamen of the claims as NSO supplying spyware to an unnamed government outside the United States to access the Apple iPhones of plaintiffs working for a newspaper in El Salvador.", "qualification": "The court did not identify the government; NSO stated in a declaration that all its employees with relevant knowledge reside in Israel.", "response": "", "outcome": "", "source_ids": [ "src-047", "src-055", "src-067" ], "entity_ids": [ "dada", "nso", "qcyber", "shohat" ], "adverse_subject_ids": [ "nso", "qcyber" ] }, { "id": "c-us-khashoggi", "kind": "fact", "text": "On 15 June 2023 Hanan Elatr Khashoggi, the widow of journalist Jamal Khashoggi, filed a seven-count complaint in the Eastern District of Virginia (1:23-cv-779) against NSO Group Technologies Limited and Q Cyber Technologies Limited, alleging that their spyware was used by agents of the governments of Saudi Arabia and the United Arab Emirates to obtain information from two of her phones that was used in the surveillance and assassination of her husband. On 26 October 2023 Judge Leonie M. Brinkema granted the defendants' motion to dismiss with prejudice, addressing only the jurisdictional arguments.", "qualification": "The allegations about the use of the spyware are the plaintiff's; the court decided only jurisdiction.", "response": "", "outcome": "A litigation tracker kept by an academic research group reports that the Fourth Circuit dismissed her appeal in May 2025 for lack of jurisdiction.", "source_ids": [ "src-058", "src-051" ], "entity_ids": [ "elatr", "nso", "qcyber" ], "adverse_subject_ids": [ "nso", "qcyber" ] }, { "id": "c-us-khashoggi-structure", "kind": "attributed", "text": "As summarised in the Virginia memorandum, the complaint described NSO Group as a subsidiary of Q Cyber, a private company also incorporated in Israel, alleged that founder Omri Lavie runs both companies, and called Westbridge Technologies, Inc. an NSO subsidiary headquartered in Virginia formed for US sales; the defendants argued that Westbridge is not a subsidiary of NSO Group but a corporate affiliate owned by the same ultimate parent company.", "qualification": "Allegations of the plaintiff and the defendants' answer as recited by the court.", "response": "The defendants: Westbridge is an affiliate under the same ultimate parent, not an NSO subsidiary.", "outcome": "The court noted that the complaint did not allege that Westbridge was involved in surveilling the plaintiff, and dismissed the case on jurisdictional grounds.", "source_ids": [ "src-058" ], "entity_ids": [ "nso", "qcyber", "lavie", "westbridge", "elatr" ] }, { "id": "c-oc-boye-madrid", "kind": "attributed", "text": "In May 2022 Gonzalo Boye, a lawyer for Catalan politicians whom the European Parliament inquiry report describes as a Pegasus target, brought a case in Madrid on behalf of at least 19 targets against NSO, its three founders Niv Karmi, Shalev Hulio and Omri Lavie, Q Cyber Technologies and OSY, which the European Parliament inquiry report describes as a subsidiary based in Luxembourg; a research group's litigation tracker describes the defendants as NSO, Q Cyber Technologies, a subsidiary in Luxembourg, OSY and senior officers of these businesses.", "qualification": "The sources do not say whether the Israeli company Q Cyber Technologies Ltd or the Luxembourg company Q Cyber Technologies S.à r.l. was named; no outcome is recorded in the retained documents.", "response": "", "outcome": "", "source_ids": [ "src-066", "src-051" ], "entity_ids": [ "nso", "karmi", "hulio", "lavie", "qcyber-lux", "osy" ], "adverse_subject_ids": [ "nso" ] }, { "id": "c-oc-barcelona-2025", "kind": "attributed", "text": "Luxembourg press reported in April 2026 that in March 2025 a court in Barcelona placed three NSO executives, Shalev Hulio, Omri Lavie and Yuval Somekh, under investigation in the \"Catalangate\" case for their roles in the Luxembourg companies OSY Technologies and Q Cyber Technologies Luxembourg, the first such step against NSO executives in Europe, and sought Luxembourg's cooperation through a European Investigation Order.", "qualification": "Press account of a criminal investigation; being placed under investigation is not a charge or a finding, and no later stage is recorded in the retained documents.", "response": "", "outcome": "", "source_ids": [ "src-015" ], "entity_ids": [ "hulio", "lavie", "somekh", "osy", "qcyber-lux" ], "adverse_subject_ids": [ "hulio", "lavie", "somekh" ] }, { "id": "c-oc-spain-high-court", "kind": "attributed", "text": "Spain's High Court opened its own investigation after the Spanish government stated that Pegasus had been used against ministers including Prime Minister Pedro Sánchez, and in June 2022 called NSO Group's chief executive to testify as a witness; according to the litigation tracker, in 2025 the association Sentinel Alliance filed a case in Barcelona against Spain's intelligence centre, the Civil Guard, NSO Group and Candiru.", "qualification": "NSO's chief executive was called as a witness, not as a suspect. Reported in a litigation tracker kept by an academic research group, which links to the underlying reports; the filings themselves were not retained.", "response": "", "outcome": "According to the litigation tracker, the High Court investigation was shelved in July 2023, the judicial authorities citing Israel's lack of cooperation, and was reportedly reopened in 2024; no outcome of the 2025 Barcelona case is recorded.", "source_ids": [ "src-066", "src-051" ], "entity_ids": [ "nso" ] }, { "id": "c-oc-uk-criminal-complaint", "kind": "attributed", "text": "According to the litigation tracker, in September 2024 four individuals filed a criminal complaint in the United Kingdom accusing three companies of violating UK laws: NSO Group, its parent company the Luxembourg-based Q Cyber Technologies, and Novalpina Capital.", "qualification": "Reported in a litigation tracker kept by an academic research group, which links to the underlying reports; the filings themselves were not retained. The tracker calls the Luxembourg Q Cyber company NSO's parent, whereas register records show Q Cyber Technologies Ltd (Israel) as NSO's shareholder; no outcome is recorded.", "response": "", "outcome": "", "source_ids": [ "src-051" ], "entity_ids": [ "nso", "qcyber-lux", "novalpina" ], "adverse_subject_ids": [ "nso", "qcyber-lux", "novalpina" ] }, { "id": "c-oc-france", "kind": "attributed", "text": "According to the litigation tracker, complaints have been filed in France against NSO Group by the Gulf Center for Human Rights in July 2021 and by the International Federation for Human Rights, the Ligue des droits de l'homme and the human rights defender Salah Hammouri; the Paris prosecutor also opened an investigation into Pegasus on 20 July 2021 after complaints by the news site Mediapart and two of its reporters that Morocco had spied on them, and 17 more journalists later complained to the prosecutor.", "qualification": "Reported in a litigation tracker kept by an academic research group, which links to the underlying reports; the filings themselves were not retained. No outcome of the French complaints or of the investigation is recorded.", "response": "", "outcome": "", "source_ids": [ "src-051" ], "entity_ids": [ "nso" ] }, { "id": "c-oc-thailand-bahrain", "kind": "attributed", "text": "The tracker also records a civil suit against NSO Group filed in a Thai court in 2022 with the support of the Thai legal group iLaw, and letters before claim sent on 6 December 2022 to the Bahraini embassy in London and to NSO Group on behalf of the activist Yusuf al-Jamri.", "qualification": "Reported in a litigation tracker kept by an academic research group, which links to the underlying reports; the filings themselves were not retained. A letter before claim precedes a lawsuit and is not itself a proceeding.", "response": "", "outcome": "", "source_ids": [ "src-051" ], "entity_ids": [ "nso" ], "adverse_subject_ids": [ "nso" ] }, { "id": "c-oc-israel-abdulaziz", "kind": "attributed", "text": "In Israel, according to the tracker, Omar Abdulaziz sued NSO Group in 2018, alleging that it helped the Saudi royal court take over his smartphone and spy on his communications with the murdered journalist Jamal Khashoggi.", "qualification": "Reported in a litigation tracker kept by an academic research group, which links to the underlying reports; the filings themselves were not retained. The allegation is the plaintiff's; the final outcome of the suit is not recorded.", "response": "NSO Group said its products were licensed for the sole use of governments and law enforcement agencies to fight terrorism and crime lawfully, only after full vetting and licensing by the Israeli government, and that it investigates suspected misuse and may suspend or terminate contracts.", "outcome": "In 2020 an Israeli judge rejected NSO Group's motion to dismiss and its request to hold the trial in secret and ordered it to pay Abdulaziz's legal costs; NSO said it would appeal. The tracker dates the ruling to June 2020, but the press report it links to is dated 16 January 2020.", "source_ids": [ "src-051" ], "entity_ids": [ "nso" ], "adverse_subject_ids": [ "nso" ] }, { "id": "c-oc-israel-employee", "kind": "attributed", "text": "In July 2018 the Israeli Justice Ministry said a former NSO Group employee had been charged with stealing intellectual property and trying to sell it for $50 million over the Darknet in a manner that could harm state security.", "qualification": "Reported in a litigation tracker kept by an academic research group, which links to the underlying reports; the filings themselves were not retained. According to the ministry, the former employee's actions endangered NSO and could have led to its collapse.", "response": "", "outcome": "", "source_ids": [ "src-051" ], "entity_ids": [ "nso" ] }, { "id": "c-oc-malekar", "kind": "fact", "text": "In Administrative Appeal 28312-05-19, 30 petitioners represented by attorney Eitay Mack, supported by Amnesty International, asked the Tel Aviv-Jaffa District Court sitting in administrative matters to order Israel's Defence Export Controls Agency to revoke the defence export licence of NSO Group Technologies Ltd, which they said had been used against Amnesty International activists. On 12 July 2020 Judge Rachel Barkai rejected the petition, finding no sufficient evidentiary basis that an attempted hacking of a human rights activist's phone had occurred or had been carried out by NSO, declining to state whether NSO held a licence, finding that DECA reviewed licences meticulously and monitored holders closely, and making no order for costs.", "qualification": "The case was heard under a gag order, according to a 2021 NGO report.", "response": "", "outcome": "", "source_ids": [ "src-059", "src-021" ], "entity_ids": [ "nso", "deca" ] }, { "id": "c-exp-deca-regime", "kind": "attributed", "text": "NSO Group's 2025 transparency report states that its products are classified as defence articles under Israeli law and that every marketing activity and export transaction requires prior authorisation from the Israeli Ministry of Defense through its Defense Exports Control Agency (DECA), with transaction-specific licences that are subject to renewal and ongoing oversight. A legal opinion published by Novalpina in 2019, as described in the 2021 NGO report, likewise confirmed that all of NSO Group's then product line fell within Israel's defence export control regime under the 2007 Defence Export Control Law.", "qualification": "The company's own description and a legal opinion published by its then owner.", "response": "", "outcome": "", "source_ids": [ "src-084", "src-021" ], "entity_ids": [ "nso", "deca", "novalpina" ] }, { "id": "c-exp-deca-2021", "kind": "fact", "text": "On 6 December 2021 Israel's Defense Export Controls Agency announced that it had tightened control of cyber exports by publishing an updated End User Declaration, which a state seeking a cyber or intelligence system must sign as a condition for the export licence; the statement does not name NSO.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-078" ], "entity_ids": [ "deca" ] }, { "id": "c-exp-mod-2021", "kind": "attributed", "text": "In July 2021 Israel's Defence Ministry said that if NSO Group's products were found to have been used in violation of the licence conditions or of the purchasing countries' declarations it would take appropriate action, and that the State of Israel does not have access to the information collected by NSO Group's customers.", "qualification": "Ministry statement as reported by Israeli press.", "response": "", "outcome": "On 6 December 2021 the ministry's export control agency announced that it had tightened control of cyber exports through an updated End User Declaration; the announcement does not name NSO, and no retained document records a finding about NSO's licences.", "source_ids": [ "src-082", "src-078" ], "entity_ids": [ "deca", "nso" ] }, { "id": "c-exp-fara", "kind": "fact", "text": "In the Foreign Agents Registration Act filing received on 25 December 2019, Mercury Public Affairs placed its foreign principal Q Cyber Technologies Ltd in the FARA category \"controlled by a foreign government, foreign political party, or other foreign principal\", explaining that some of its technology offerings were expected to be marketed to government clients and that the Israeli Ministry of Defense may deny such sales; the attached agreement, signed for Q Cyber by its general legal counsel, retained Mercury from 15 December 2019 to 30 November 2020 and month to month thereafter for $120,000 a month plus a one-time compliance fee of $5,000.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-064", "src-021" ], "entity_ids": [ "qcyber", "mercury", "deca", "sunray" ] }, { "id": "c-exp-mercury-press", "kind": "attributed", "text": "US public-relations trade press reported in January 2020 that Israel's Q Cyber Technologies had signed Mercury Public Affairs to a $1.2 million contract for crisis communications, media outreach and government relations work concerning the WhatsApp suit, and the 2021 NGO report notes that a statement distributed by Mercury on behalf of Q Cyber Technologies Ltd. was filed with the Justice Department's FARA unit on 2 October 2020.", "qualification": "Trade press account; the contract terms are recorded in the FARA filing.", "response": "", "outcome": "", "source_ids": [ "src-099", "src-021" ], "entity_ids": [ "qcyber", "mercury", "whatsapp" ] }, { "id": "c-exp-lobbying", "kind": "attributed", "text": "A US technology-policy publication reported in March 2026, citing US business press and lobbying disclosures, that NSO Group's campaign to be removed from the US Entity List cost at least $7.6 million in lobbying fees between 2020 and 2024 and at least $190,000 in 2025; it lists firms engaged through NSO's parent Q Cyber, including Mercury Public Affairs (2019–2021) and Arnold & Porter (timing unknown), and Paul, Weiss through Q Cyber's owner OSY Technologies (2019), and names Michael Flynn among earlier advisers, paid nearly $100,000 by NSO Group's parent companies.", "qualification": "Press compilation of disclosure records.", "response": "", "outcome": "According to the same publication, NSO's outreach, including contacts with Jared Kushner and approaches from the Israeli prime minister's office, did not succeed; in May 2025 National Security Council officials turned away Vogel Group lobbyists seeking a meeting on NSO's behalf, and Vogel's lobbying for NSO lasted only a few months.", "source_ids": [ "src-101" ], "entity_ids": [ "nso", "qcyber", "mercury", "arnold-porter", "osy", "flynn" ] }, { "id": "c-exp-entity-list", "kind": "fact", "text": "By a rule published in the Federal Register on 4 November 2021 (document 2021-24123), the US Commerce Department's Bureau of Industry and Security added NSO Group, at 22 Galgalei Haplada, Herzliya, to the Entity List under section 744.11(b) of the Export Administration Regulations, requiring a licence for all items subject to the regulations with a presumption of denial. The End-User Review Committee found that NSO Group and Candiru developed and supplied spyware to foreign governments that used it to target government officials, journalists, businesspeople, activists, academics and embassy workers, contrary to US national security and foreign policy interests.", "qualification": "The entry names \"NSO Group\" at the address that both NSO Group Technologies and Q Cyber Technologies gave in their 2019 Israeli annual reports; the rule does not name either company's register number.", "response": "", "outcome": "", "source_ids": [ "src-025" ], "entity_ids": [ "bis", "nso" ], "adverse_subject_ids": [ "nso" ] }, { "id": "c-exp-entity-list-current", "kind": "fact", "text": "The official electronic Code of Federal Regulations shows the NSO Group entry, with its presumption-of-denial licence policy, in the version of the Entity List in force from 16 July 2026 with no end date and in each listed version since 26 November 2021, none marking it as removed.", "qualification": "Read from the eCFR search interface on 20 October 2026; it records the entry's presence, not any licensing decisions made under it.", "response": "", "outcome": "", "source_ids": [ "src-086", "src-087" ], "entity_ids": [ "bis", "nso" ], "adverse_subject_ids": [ "nso" ] }, { "id": "c-exp-csl", "kind": "attributed", "text": "A screening service checked in October 2026 returned an entry for \"NSO Group\" in the US Consolidated Screening List under the Bureau of Industry and Security's Entity List programme (US-BIS-EL), with the topic export control and country Israel.", "qualification": "Screening result; it reflects the Entity List designation described above and is not a separate sanctions designation.", "response": "", "outcome": "", "source_ids": [ "src-008" ], "entity_ids": [ "nso", "bis" ] }, { "id": "c-exp-delisting-efforts", "kind": "attributed", "text": "An Israeli investigative outlet reported in July 2022, with a US non-profit newsroom, that after the listing NSO spent hundreds of thousands of dollars on US lobbyists, lawyers and public relations to be removed, and that Israeli government contacts with the US administration were led by Israel's National Security Council, part of the Prime Minister's Office.", "qualification": "Press account; the White House statement is quoted by the outlet.", "response": "The White House said it was not and had not been involved in considering any request to remove a foreign commercial spyware company from the Entity List.", "outcome": "Luxembourg press reported in April 2026 that the listing remained in force and that no decision to remove NSO had been published; the official register still shows the entry.", "source_ids": [ "src-093", "src-015" ], "entity_ids": [ "nso", "bis" ] }, { "id": "c-exp-congress-letter", "kind": "attributed", "text": "In a letter of 6 May 2026 to the US Commerce Secretary, Representative Summer L. Lee wrote that since its Entity List designation in November 2021 NSO Group had experienced a \"financial freefall\" and nearly defaulted on $500 million of debt, and that in 2023 it reportedly spent nearly $1 million on lobbying; the letter requested a briefing on the purchase of NSO by an American company and on contacts with David Friedman.", "qualification": "A member of Congress's letter relying on press reports; not a finding of any agency.", "response": "", "outcome": "", "source_ids": [ "src-077" ], "entity_ids": [ "nso", "friedman", "bis" ] }, { "id": "c-exp-transparency", "kind": "attributed", "text": "According to NSO's transparency reports as summarised by the press in January 2026, the company said it suspended or terminated six unnamed government customers in 2022–2023 at a revenue loss of $57 million and rejected more than $20 million of new business in 2024 for human rights reasons; critics quoted by the publication saw the 2025 report as part of a campaign to leave the Entity List.", "qualification": "The company's own figures; the customers are not named. According to the publication, the 2025 report, unlike earlier ones, lacks figures on how many customers were rejected, investigated, suspended or terminated over human rights abuses.", "response": "Asked for comparable figures, an NSO spokesperson had not answered by the publication's deadline.", "outcome": "", "source_ids": [ "src-080" ], "entity_ids": [ "nso" ] }, { "id": "c-exp-lux-no-licence", "kind": "attributed", "text": "Luxembourg's foreign ministry and economy minister stated in February 2019, according to the 2021 NGO report, that the Luxembourg entity linked to NSO Group had never sought an export licence in Luxembourg. The 2023 European Parliament report records that after the 2021 NGO report identified nine NSO-related companies in Luxembourg in June 2021, Foreign Minister Jean Asselborn wrote to each, and that none of the nine was authorised to export cyber-surveillance products from Luxembourg.", "qualification": "Government statements as reported.", "response": "According to the European Parliament report, citing Luxembourg press, NSO Group replied that it exports its spyware only from Israel with the consent of the Israeli government; Asselborn said in October 2021 that he could not verify that.", "outcome": "Luxembourg press reported in April 2026 that, according to the ministers' answer to a parliamentary question, the export control office had received no requests from these companies.", "source_ids": [ "src-021", "src-066", "src-015" ], "entity_ids": [ "nso", "qcyber-lux", "lux-gov" ] }, { "id": "c-exp-lux-2026", "kind": "fact", "text": "Written question No. 3833, \"Activities of NSO Group in Luxembourg and possible links with Togo\", was tabled in Luxembourg's Chamber of Deputies on 23 March 2026 by deputies Sven Clement and Marc Goergen and answered in writing on 28 April 2026 by the Minister of the Economy, Lex Delles, and the Minister of Foreign Affairs and Foreign Trade, Xavier Bettel; Luxembourg press reported that the answer confirmed that the export control office had received no requests from the nine NSO-affiliated entities since the July 2021 letters.", "qualification": "The text of the ministers' answer is not on the retained page; its content is the press account.", "response": "", "outcome": "", "source_ids": [ "src-028", "src-015" ], "entity_ids": [ "nso", "lux-gov" ] }, { "id": "c-exp-bulgaria-cyprus", "kind": "attributed", "text": "NSO Group told the 2021 NGO report's authors that NSO Group Technologies Ltd., Q Cyber Technologies Ltd., Convexum, Wayout and the Bulgarian group companies export products and obtain licences from the relevant authorities for all products that require them, that group entities export from Israel, Bulgaria and Cyprus, and that each of those countries' authorities had at some point denied group licence applications. Novalpina said in March 2019 that some NSO products are exported from the EU, from Bulgaria or Cyprus, after consultation with the competent authority. The 2023 European Parliament report records that NSO denies that Pegasus is exported from Cyprus or Bulgaria and that the Cypriot and Bulgarian governments deny having granted export permits to NSO companies.", "qualification": "Competing accounts; the European Parliament report calls the Bulgarian and Novalpina statements contradictory.", "response": "NSO Group: Pegasus is not exported from Cyprus or Bulgaria.", "outcome": "", "source_ids": [ "src-021", "src-066" ], "entity_ids": [ "nso", "qcyber", "convexum", "novalpina" ] }, { "id": "c-exp-bulgaria-entities", "kind": "attributed", "text": "According to the 2021 NGO report, Circles Bulgaria EOOD and Magnet Bulgaria EOOD, held through IOTA Holdings, a subsidiary of OSY, are registered to obtain Bulgarian export licences; NSO Group said Magnet Bulgaria is inactive, that its registration with the Bulgarian export control authority expired in 2020, and that it never obtained licences to export the products named Vole or Pixcell.", "qualification": "The report's reading of Bulgarian registers and NSO's response.", "response": "NSO Group: Magnet Bulgaria is inactive and its registration lapsed in 2020.", "outcome": "", "source_ids": [ "src-021" ], "entity_ids": [ "circles", "iota", "osy", "nso" ] }, { "id": "c-exp-circles-licences-2026", "kind": "attributed", "text": "In June 2026 an international human rights organisation and a European news outlet reported, from Bulgarian licensing records for 2018–2023, that Bulgaria's export control authority licensed Circles BG, a Sofia-based company affiliated with NSO Group, to sell interception systems, mobile-tracking tools and surveillance infrastructure to intelligence agencies in Azerbaijan, Serbia, Malaysia and Mexico; the human rights organisation said the records also show licensed exports to Q Cyber Technologies and NSO Group in Israel, and the news outlet reported that in at least one case involving Brazil an export transited through Luxembourg-based Q Cyber Technologies. The outlet reported that NSO Group bought technology from Circles for $119,941 in October 2021, later transferred to the Home Front Command of Israel's Defence Ministry.", "qualification": "Reporting on leaked licensing records that the outlets reviewed but did not publish; it does not establish that any export was unlawful, and the human rights organisation noted that the licences do not show whether the technology was actually exported. The human rights organisation describes Q Cyber Technologies as the umbrella company formed when Circles was bought in 2014.", "response": "Circles did not respond to repeated requests for comment from either outlet; Bulgaria's foreign ministry said that the documentation provided by Circles showed the technologies were intended for crime and terrorism investigation and search and rescue, and that all relevant circumstances, including end-use documents, are assessed when examining applications.", "outcome": "", "source_ids": [ "src-088", "src-089" ], "entity_ids": [ "circles", "qcyber", "nso", "qcyber-lux" ] }, { "id": "c-exp-bulgaria-redacted", "kind": "fact", "text": "In a 2026 reply to an access-to-information request, annexed to the human rights organisation's report, Bulgaria's Ministry of Economy and Industry provided copies of surveillance export permits with the names of the exporter and end user, the type of product and the permit numbers deleted as commercially sensitive; an appeal against the restricted access was pending in court.", "qualification": "The redacted copies do not show which company was the exporter.", "response": "", "outcome": "", "source_ids": [ "src-100" ], "entity_ids": [ "bulgaria-ministry" ] }, { "id": "c-exp-ngo-letter-2019", "kind": "attributed", "text": "In an open letter of April 2019 to Novalpina Capital, copied to NSO Group and Francisco Partners, a coalition of NGOs including Amnesty International, Access Now, the Committee to Protect Journalists, Human Rights Watch and Privacy International wrote that Novalpina had provided background on NSO Group's compliance with export control rules but no data on its export licences.", "qualification": "The coalition's account of Novalpina's reply.", "response": "Novalpina had answered the coalition's first letter on 1 March 2019; the 2021 NGO report cites that reply, which was not retained.", "outcome": "", "source_ids": [ "src-108", "src-021" ], "entity_ids": [ "novalpina", "nso", "francisco" ] }, { "id": "c-cus-sovereign", "kind": "attributed", "text": "In their response and objection to the plaintiffs' proposed injunction order in the WhatsApp case, filed on 4 November 2025, NSO Group Technologies and Q Cyber Technologies stated that all of NSO's customers are sovereign governments, as confirmed by the auditing firm EY, and that contracts and Israeli Defence Ministry licences require Pegasus to be used only against terrorism and serious crime; they referred to major US allies, including Western European democracies, among their foreign sovereign customers without naming them.", "qualification": "The defendants' statements in court papers.", "response": "", "outcome": "", "source_ids": [ "src-081" ], "entity_ids": [ "nso", "qcyber" ] }, { "id": "c-cus-ghana", "kind": "fact", "text": "An agreement dated 17 December 2015, filed as an exhibit to the WhatsApp complaint, provides for Infraloks Development Limited, a Ghanaian company (registration number CA-66,115) engaged in reselling and supplying cyber intelligence solutions developed by NSO Group Technologies Ltd, to supply a system to the National Communication Authority of the Republic of Ghana as end user; the system description refers to the System Provider's Pegasus system operating on Ghana mobile numbers, and an attached service level agreement is between NSO Group Technologies Ltd and Infralok Development Limited.", "qualification": "An exhibit filed by the plaintiffs; the retained copy is a scanned text with recognition errors.", "response": "", "outcome": "", "source_ids": [ "src-004" ], "entity_ids": [ "infraloks", "nso", "ghana-nca" ] }, { "id": "c-cus-eu-22", "kind": "attributed", "text": "According to answers NSO Group gave the European Parliament's inquiry committee in 2022, Pegasus was initially sold to 22 end users in 14 EU member states under Israeli marketing and export licences.", "qualification": "Stated in the European Parliament's 2023 inquiry report, which relies on the sources it cites. The member states are not named by NSO.", "response": "", "outcome": "Contracts with end users in two member states were later terminated; the committee could not confirm which states these were and assumed the two were Poland and Hungary.", "source_ids": [ "src-066" ], "entity_ids": [ "nso" ] }, { "id": "c-cus-poland", "kind": "attributed", "text": "The Polish government, after initially denying it, confirmed the purchase of spyware in January 2022; former head of the Supreme Audit Office Krzysztof Kwiatkowski presented to the Senate two invoices confirming a purchase of spyware for the Central Anti-Corruption Bureau (CBA) for PLN 25 million from the Justice Ministry's Justice Fund, issued by Matic Sp. z o.o., which acted as intermediary.", "qualification": "Stated in the European Parliament's 2023 inquiry report, which relies on the sources it cites.", "response": "", "outcome": "", "source_ids": [ "src-066" ], "entity_ids": [ "cba", "matic", "nso" ] }, { "id": "c-cus-hungary", "kind": "attributed", "text": "The European Parliament report states that Hungary's Interior Ministry bought Pegasus for EUR 6 million in 2017 indirectly, through Communication Technologies Ltd, from NSO Group's company in Luxembourg, a purchase acknowledged in November 2021 by Lajos Kósa, chair of the parliamentary defence and law enforcement committee; Communication Technologies later sued the journalist Szabolcs Panyi after he investigated it. Hungary's data protection authority, which had access to the secret contract with NSO, said its inquiry found nothing inconsistent with NSO Group's terms of sale, though according to the report it verified only the authorisation procedure, not the substance of the use.", "qualification": "Stated in the European Parliament's 2023 inquiry report, which relies on the sources it cites. The report does not name the Luxembourg company.", "response": "", "outcome": "", "source_ids": [ "src-066" ], "entity_ids": [ "hungary-moi", "comm-tech", "nso" ] }, { "id": "c-cus-germany", "kind": "attributed", "text": "It was reported in September 2021 that Germany's Federal Criminal Police Office (BKA) had acquired Pegasus in late 2020; according to the European Parliament report NSO initially declined to modify the software to comply with German law but later agreed, so the BKA acquired a modified version, a purchase confirmed by then BKA vice-president Martina Link in a closed parliamentary session.", "qualification": "Stated in the European Parliament's 2023 inquiry report, which relies on the sources it cites.", "response": "", "outcome": "", "source_ids": [ "src-066" ], "entity_ids": [ "bka", "nso" ] }, { "id": "c-cus-luxembourg", "kind": "attributed", "text": "According to the European Parliament report, in October 2021 Luxembourg's Prime Minister Xavier Bettel confirmed that Luxembourg bought and used Pegasus for reasons of state security.", "qualification": "Stated in the European Parliament's 2023 inquiry report, which relies on the sources it cites.", "response": "A Luxembourg business publication's headline of 28 October 2021 states that Bettel appeared to confirm the purchase but later backtracked on his comments; the article's text was not retained.", "outcome": "", "source_ids": [ "src-066", "src-015" ], "entity_ids": [ "lux-gov", "nso" ] }, { "id": "c-cus-denials", "kind": "attributed", "text": "Other governments' positions recorded in the European Parliament report differ: Austria's government stated in answers of 22 September 2021 that Austria had not been a client of NSO; France's foreign ministry denied holding talks with NSO Group, although media reported that a French purchase was suspended in 2021; Belgium's justice minister declined to confirm whether Belgian intelligence was a client after a former Israeli intelligence official said Belgian police used Pegasus; and the Dutch government refused to comment on media reports of June 2022 that its intelligence service had used Pegasus to help the police track down a serious-crime suspect.", "qualification": "Stated in the European Parliament's 2023 inquiry report, which relies on the sources it cites. These are denials, reports and refusals to comment, not records of contracts.", "response": "", "outcome": "", "source_ids": [ "src-066" ], "entity_ids": [ "nso" ] }, { "id": "c-cus-spain", "kind": "attributed", "text": "The European Parliament report concluded that, given the secrecy surrounding it, it could not be determined with certainty whether the Spanish government concluded contracts with NSO Group or acquired and used Pegasus; Shalev Hulio, then NSO's chief executive, told a US magazine in April 2022 that Spain's use of Pegasus was legitimate given its respect for the rule of law and the requirement of Supreme Court authorisation.", "qualification": "Stated in the European Parliament's 2023 inquiry report, which relies on the sources it cites. Hulio's remark concerns use of the product, not a contract.", "response": "", "outcome": "", "source_ids": [ "src-066" ], "entity_ids": [ "nso", "hulio" ] }, { "id": "c-cus-estonia-greece", "kind": "attributed", "text": "The report, citing press, states that Estonia negotiated with NSO Group in 2018 and made a down payment on a USD 30 million deal, and that in January 2020 NSO Group submitted to Greece an official proposal for a government-to-government agreement of EUR 50 million.", "qualification": "Stated in the European Parliament's 2023 inquiry report, which relies on the sources it cites. Press-based accounts; neither government's contract is in the retained documents.", "response": "", "outcome": "According to the report, Israel's Defence Ministry later blocked Estonia from using the spyware against Russian devices, and the Greek arrangement was eventually called off.", "source_ids": [ "src-066" ], "entity_ids": [ "nso" ] }, { "id": "c-cus-saudi-uae", "kind": "attributed", "text": "Citing a book and Israeli press, the European Parliament report states that in 2017 NSO officials presented Pegasus 3 to Saudi Arabian customers at the Four Seasons Hotel in Limassol, Cyprus, and that the Saudi customers bought it for USD 55 million; the report adds that a year later Saudi Arabia killed Jamal Khashoggi after surveilling people close to him with Pegasus, which NSO disputes. It also records a document from the Cypriot party AKEL alleging that NSO exported Pegasus through a Cypriot subsidiary to a company in the United Arab Emirates against an invoice of USD 7 million, which the report says cannot be confirmed. In a March 2025 US court filing, Treo NOAL GP, general partner of the fund that bought NSO in 2019, said that information it obtained after the 2021 Entity List designation showed NSO had been heavily dependent on collections from new sales to high-risk customers such as Saudi Arabia.", "qualification": "Stated in the European Parliament's 2023 inquiry report, which relies on the sources it cites. Unconfirmed allegations and a party's statement; no contract is in the retained documents.", "response": "NSO disputes the report's statement that Saudi Arabia surveilled people close to Khashoggi with Pegasus.", "outcome": "", "source_ids": [ "src-066", "src-106" ], "entity_ids": [ "nso", "treo-gp" ] }, { "id": "c-cus-morocco", "kind": "attributed", "text": "According to US public radio as cited in the European Parliament report, Morocco had a licence for about 100,000 phone numbers, making it one of NSO's largest Pegasus clients. A 2026 investigation by an international journalism network, based on a former officer of Morocco's DGST intelligence service and a second former intelligence source, reported that the DGST procured and administered Pegasus through a private intermediary, which the reporters identified from the former officer's description as FSSYS Maroc in Rabat.", "qualification": "Press and witness accounts; no contract is in the retained documents, and the reporters found no evidence that the intermediary itself carried out infections.", "response": "Morocco called the Pegasus Project accusations erroneous and has long denied using Pegasus; Moroccan authorities, NSO Group and the chairman of FSSYS Maroc did not respond to the 2026 investigation's questions.", "outcome": "", "source_ids": [ "src-066", "src-083" ], "entity_ids": [ "nso", "fssys" ] }, { "id": "c-cus-panama", "kind": "attributed", "text": "A 2026 investigation by an international journalism network reported that NSO Group sold Pegasus to Panama in 2012, with Shalev Hulio signing the contract with the Panamanian government. The investigation also reported that Panamanian migration records show Hulio entering Panama on 3 December 2013 on a diplomatic passport issued by Israel, with his profession given as \"diplomat\", a use of a diplomatic passport that a former senior Panamanian official confirmed; it presented this as raising questions about the firm's stated independence from the Israeli state.", "qualification": "Press account; the contract, the Panamanian judgment and the migration records were not retained.", "response": "Hulio called the allegations concerning a diplomatic passport and his purported role as a representative of the State of Israel entirely false and categorically denied them; Israel's defence and foreign ministries did not respond.", "outcome": "According to the investigation, in 2023 Panama's Supreme Court sentenced two former officials to 50 months in prison for breaches of confidentiality and of the right to privacy related to Pegasus.", "source_ids": [ "src-079" ], "entity_ids": [ "nso", "panama", "hulio" ], "adverse_subject_ids": [ "hulio" ] }, { "id": "c-cus-attribution-14", "kind": "attributed", "text": "The European Parliament report, citing an international human rights organisation, names 14 non-EU countries whose authorities are most likely responsible for many cases of technically proven Pegasus infection: El Salvador, Mexico, Thailand, Morocco, India, Rwanda, Saudi Arabia, Bahrain, Jordan, Kazakhstan, Togo, the United Arab Emirates, Israel and Azerbaijan.", "qualification": "Stated in the European Parliament's 2023 inquiry report, which relies on the sources it cites. This attributes infections to states; it does not document contracts with NSO.", "response": "", "outcome": "", "source_ids": [ "src-066" ], "entity_ids": [ "nso" ] }, { "id": "c-cus-cyprus", "kind": "attributed", "text": "The report also cites a book alleging that a former NSO employee working for a company of Tal Dilian trained Cyprus's intelligence service in the use of Pegasus and that the Cypriot government bought equipment from Dilian's company; Cyprus's government told the committee that NSO Group holds no shares in Cypriot companies, that Pegasus did not appear to have been developed in or officially exported from Cyprus, and that board members of NSO had set up or bought six companies there.", "qualification": "Stated in the European Parliament's 2023 inquiry report, which relies on the sources it cites. Allegations from a book, set against the Cypriot government's answer.", "response": "Cyprus's government: Pegasus did not appear to have been developed in or officially exported from Cyprus.", "outcome": "", "source_ids": [ "src-066" ], "entity_ids": [ "nso" ] }, { "id": "c-cus-ability", "kind": "attributed", "text": "The European Parliament report states that Ability Ltd, founded by Anatoly Hurgin, cooperated with NSO Group on Pegasus and handled the network side of NSO's operations, and that in 2017 Ability was under investigation by the US Securities and Exchange Commission over alleged misstatements of its finances.", "qualification": "Stated in the European Parliament's 2023 inquiry report, which relies on the sources it cites.", "response": "", "outcome": "", "source_ids": [ "src-066" ], "entity_ids": [ "ability", "nso" ] }, { "id": "c-ppl-founders", "kind": "attributed", "text": "According to the 2021 NGO report, the founders of NSO Group Technologies, whose first initials make up the name NSO, were the businessmen Niv Carmi, Shalev Hulio and Omri Lavie, and an initial investor was the venture capitalist Eddy Shalev; the European Parliament report likewise gives 2010 as the year the group was founded by Hulio, Lavie and Niv Karmi.", "qualification": "The spelling of Karmi/Carmi varies between sources for the same person.", "response": "NSO Group told the report's authors that Niv Carmi was no longer affiliated with the group.", "outcome": "Israeli business press reported in 2025 that Carmi had left NSO after less than a year.", "source_ids": [ "src-021", "src-092", "src-066" ], "entity_ids": [ "nso", "karmi", "hulio", "lavie", "eddy-shalev" ] }, { "id": "c-ppl-hulio-ceo", "kind": "attributed", "text": "Shalev Hulio was NSO Group's co-founder and chief executive: a profile on a company-data site lists him as co-founder and vice-president of marketing of NSO Group from December 2009 and chief executive from March 2016, and as a partner of the investment firm Founders Group.", "qualification": "Aggregator profile and report; Hulio appears in Luxembourg and UK records as \"Shalev Holy\".", "response": "", "outcome": "According to the European Parliament report he stepped down as chief executive in August 2022 and was replaced by Yaron Shohat, after which NSO, according to press cited in the report, changed policy to focus only on NATO members.", "source_ids": [ "src-076", "src-020", "src-066" ], "entity_ids": [ "hulio", "nso", "founders-group", "shohat" ] }, { "id": "c-ppl-hulio-dream", "kind": "attributed", "text": "After leaving NSO, Shalev Hulio co-founded the cyber-defence and artificial-intelligence company Dream (Dream Security) with former Austrian chancellor Sebastian Kurz and Gil Dolev, the brother of NSO Group president Shiri Dolev; the European Parliament report dates its launch to October 2022 and records that its early investors included Adi Shalev, also an early investor in NSO. Israeli press reported in June 2026 that Dream had raised $260 million at a valuation of $3 billion.", "qualification": "Dates differ: the European Parliament report gives October 2022, Israeli press gives 2023 as the year of founding.", "response": "", "outcome": "", "source_ids": [ "src-066", "src-111", "src-044" ], "entity_ids": [ "hulio", "dream", "kurz", "gil-dolev", "shiri-dolev", "nso" ] }, { "id": "c-ppl-hulio-black-cube", "kind": "attributed", "text": "According to the European Parliament report, after public pressure over NSO's hiring of the private intelligence firm Black Cube against its opponents, former NSO chief executive Shalev Hulio admitted to hiring Black Cube in at least one situation in Cyprus.", "qualification": "Account in the European Parliament inquiry report; the admission itself is not retained.", "response": "", "outcome": "", "source_ids": [ "src-066" ], "entity_ids": [ "hulio", "black-cube", "nso" ], "adverse_subject_ids": [ "hulio" ] }, { "id": "c-ppl-lavie-other", "kind": "attributed", "text": "Omri Lavie also co-founded the Tel Aviv cyber-risk company Orchestra Group (founded 2009, according to a company-data profile); in 2017 Lavie and his investment partner Issac Zack said Orchestra was being financed by their investment firm Founders Group, whose chief executive was Shalev Hulio.", "qualification": "Company-data profile and a 2017 press interview.", "response": "", "outcome": "", "source_ids": [ "src-112", "src-119" ], "entity_ids": [ "lavie", "orchestra", "founders-group", "hulio" ] }, { "id": "c-ppl-karmi", "kind": "attributed", "text": "Niv Karmi later founded Polus Tech in Zug, Switzerland, in 2016, with investment from Elta Systems of Israel Aerospace Industries, according to Israeli business press; Swiss commercial-register data list him as a board member of POLUS Tech. (Switzerland) Ltd and as president of the board of Therian Labs Technologies AG, a Zug company whose purpose includes selling software solutions in Asia, in particular Indonesia. A Swiss arms-export monitoring site reported that Therian Labs received Swiss export permits for Indonesia worth CHF 4.84 million in 2022 in the dual-use category 5A001.f covering mobile interception and jamming equipment.", "qualification": "These are Karmi's own companies, not NSO or Q Cyber companies; the export permits were reported by a monitoring site and the permit records themselves were not retained.", "response": "", "outcome": "", "source_ids": [ "src-092", "src-041", "src-065", "src-110", "src-123" ], "entity_ids": [ "karmi", "polus", "therian" ] }, { "id": "c-ppl-gorev", "kind": "attributed", "text": "Eran Gorev is a partner and the president of Israel at Francisco Partners, which he joined in 2014, according to the firm's website; a company-data profile lists him as chairman of NSO Group from 2014 to 2019, and Luxembourg register publications, as summarised by an aggregator, list him as a manager of OSY Technologies between publications of 16 December 2014 and 12 April 2019 and of Q Cyber Technologies S.à r.l. from its registration in January 2016 until a publication of August 2019.", "qualification": "Website, aggregator profile and register summaries.", "response": "", "outcome": "", "source_ids": [ "src-019", "src-094", "src-005" ], "entity_ids": [ "gorev", "francisco", "nso", "osy", "qcyber-lux" ] }, { "id": "c-ppl-asher-levy", "kind": "attributed", "text": "NSO Group announced in April 2020 that it had appointed Asher Levy, chief executive of Orbotech from 2013 to 2019, as executive chairman, an appointment approved by the board earlier that year and effective on 1 April 2020; a market-data profile lists him as former chairman of N.S.O. Group Technologies Ltd.", "qualification": "Company announcement, aggregator profile and press account.", "response": "", "outcome": "He left the chairmanship at the start of January 2022, saying he had represented Novalpina and was making way for BRG's appointee, and denied that his departure had anything to do with NSO's legal and financial troubles.", "source_ids": [ "src-090", "src-070", "src-118" ], "entity_ids": [ "asher-levy", "nso", "novalpina", "brg" ] }, { "id": "c-ppl-shohat", "kind": "attributed", "text": "Yaron Shohat, previously NSO Group's chief operating officer according to a company-data profile, succeeded Shalev Hulio as chief executive in August 2022 and was also reported to be chief executive of Q Cyber Technologies; he testified as NSO's chief executive in August 2024 and, according to press in January 2026, stepped down after the 2025 change of ownership.", "qualification": "Aggregator profile and press; no register record of his offices was retained.", "response": "", "outcome": "", "source_ids": [ "src-071" ], "entity_ids": [ "shohat", "nso", "qcyber", "hulio" ] }, { "id": "c-ppl-friedman", "kind": "attributed", "text": "David M. Friedman was US ambassador to Israel from March 2017 to January 2021; before joining the State Department he practised law at Kasowitz, Benson, Torres & Friedman LLP, which he co-founded in 1994. A sanctions and PEP data service lists him as a politically exposed person on that basis and as named on the Iranian foreign ministry's own sanctions list.", "qualification": "The Iranian listing is a measure by Iran against US individuals, not a Western sanction.", "response": "", "outcome": "", "source_ids": [ "src-016", "src-121" ], "entity_ids": [ "friedman" ] }, { "id": "c-ppl-simonds", "kind": "attributed", "text": "Robert Bruce Simonds Jr. is a film producer and founder and chairman of STX Entertainment, according to an online encyclopedia. Luxembourg press reported that in January 2026 he sold his production company, Crown Productions, which it described as the film-financing subsidiary of the insurance platform A-CAP.", "qualification": "Encyclopedia and press accounts.", "response": "", "outcome": "", "source_ids": [ "src-023", "src-015" ], "entity_ids": [ "simonds", "stx" ] }, { "id": "c-ppl-anthony-levy", "kind": "fact", "text": "Anthony Levy has been a manager of NorthPole Newco, OSY Technologies and Q Cyber Technologies S.à r.l. since 15 March 2023, having earlier been a class B manager of NorthPole Newco from 22 December 2021 to 16 January 2023, and has been Q Cyber Technologies S.à r.l.'s delegate for day-to-day management since 5 June 2023, with a professional address in Luxembourg.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-061", "src-043", "src-038" ], "entity_ids": [ "anthony-levy", "northpole-newco", "osy", "qcyber-lux" ] }, { "id": "c-ppl-somekh-dumont", "kind": "attributed", "text": "Register summaries record Yuval Somekh as a manager of Q Cyber Technologies S.à r.l. from its registration in 2016 and of NorthPole Newco; according to the 2021 NGO report he was type B manager of Emerald LIE and Diamond LIE, which NSO Group said were created to grant stock options, with Gaëtan Dumont as type A manager.", "qualification": "Register summaries and NSO Group's description.", "response": "NSO Group told the 2021 NGO report that Hulio, Lavie, Somekh and Asher Levy were directors in the group and that Dumont was a professional director in five of the eight Luxembourg group companies, holding no other position in the group.", "outcome": "Register publications of 4 and 26 November 2021, as summarised by an aggregator, record that Somekh was no longer a manager of OSY Technologies and of NorthPole Newco and Q Cyber Technologies S.à r.l. respectively.", "source_ids": [ "src-021", "src-010", "src-006", "src-005" ], "entity_ids": [ "somekh", "dumont", "qcyber-lux", "northpole-newco", "emerald", "diamond", "hulio", "lavie", "asher-levy", "nso" ] }, { "id": "c-ppl-de-maigret", "kind": "attributed", "text": "A Luxembourg register publication of 20 August 2019, as summarised by an aggregator, lists Charline de Maigret as a manager of Q Cyber Technologies S.à r.l.", "qualification": "Aggregator summary of register publications.", "response": "", "outcome": "", "source_ids": [ "src-010" ], "entity_ids": [ "de-maigret", "qcyber-lux" ] }, { "id": "c-ppl-triangle-holders-2021", "kind": "attributed", "text": "NSO Group told the 2021 NGO report's authors that former employee Kevin Wilson was then a shareholder in Triangle Holdings, that former consultant Alexei Voronovitsky no longer held shares in any group company, that OSY Holdings Ltd. and Global Seven Group LP held no shares or other interest in Triangle Holdings, and that the group had no companies in the Cayman Islands or the British Virgin Islands.", "qualification": "NSO Group's statement in 2021.", "response": "", "outcome": "", "source_ids": [ "src-021" ], "entity_ids": [ "kevin-wilson", "triangle", "voronovitsky", "osy-holdings", "global-seven", "nso" ] }, { "id": "c-ppl-bec", "kind": "attributed", "text": "Under Francisco Partners' ownership, according to the firm's statement to the 2021 NGO report, NSO's business ethics committee reviewed all potential sales and blocked tens of millions of dollars of sales that would otherwise have been legally permitted; Novalpina described it as a committee of the NSO board with three NSO executives and four external members, which media reports said included Daniel Reisner of the Israeli law firm Herzog Fox & Neeman. After the 2019 buyout it was replaced by a governance, risk and compliance committee which, according to NSO Group, is a board-level committee appointed by the board of OSY Technologies that oversees investigations into credible allegations of misuse.", "qualification": "Statements of Francisco Partners, Novalpina and NSO Group.", "response": "", "outcome": "", "source_ids": [ "src-021" ], "entity_ids": [ "francisco", "nso", "novalpina", "osy" ] }, { "id": "c-ppl-bash", "kind": "attributed", "text": "According to the European Parliament report, citing press, Jeremy Bash, a former chief of staff at the CIA (2009–2011) and the US Department of Defense (2011–2013), was hired through his firm Beacon Global Strategies to advise NSO Group through Francisco Partners and was reportedly one of eight members of NSO's business ethics committee with a vote on proposed sales. He served on the President's Intelligence Advisory Board from 2022 to 2025, and a sanctions and PEP data service lists him as a politically exposed person, with no sanctions or crime topics.", "qualification": "Press accounts relayed by the report and an encyclopedia entry.", "response": "", "outcome": "According to the same press accounts, Beacon Global Strategies ended its work with NSO after the group pursued sales to Saudi Arabia.", "source_ids": [ "src-066", "src-109", "src-122" ], "entity_ids": [ "bash", "beacon", "nso", "francisco" ] }, { "id": "c-ppl-flynn", "kind": "attributed", "text": "US press reported in 2017 that, according to his financial disclosure forms, Michael Flynn received $40,280 in 2016 as an advisory board member of OSY Technologies; a Francisco Partners representative told another publication that Flynn was paid a little more than $40,000 by OSY and less than $100,000 by Francisco.", "qualification": "Press accounts of disclosure forms and a company representative's statement.", "response": "Francisco Partners' general counsel said Flynn had served in a relatively limited advisory role and that the firm routinely engages consultants to understand the industries it invests in; Flynn's lawyer did not respond to requests for comment.", "outcome": "", "source_ids": [ "src-104", "src-119" ], "entity_ids": [ "flynn", "osy", "francisco" ] }, { "id": "c-ppl-francisco", "kind": "fact", "text": "Francisco Partners Management, L.P. is a US investment adviser registered with the SEC (CRD 160272) that advises private funds; its Form ADV states that it managed about $47.05 billion of fund assets at 31 December 2025.", "qualification": "Read from a company-data site's copy of the Form ADV.", "response": "", "outcome": "", "source_ids": [ "src-022" ], "entity_ids": [ "francisco" ] }, { "id": "c-rel-westbridge", "kind": "attributed", "text": "According to the 2021 NGO report, Westbridge Technologies Inc. was incorporated in Delaware on 22 July 2014 with Omri Lavie named as president or vice-president in corporate documents, had branches registered in Maryland in 2016 (dissolved in June 2019) and Virginia in 2019, and was described in the professional profile of its former president Terry DiVittorio as the US affiliate of Q Cyber Technologies. It was then registered as an active US federal contractor (CAGE code 7FQ39) whose registration gave its immediate owner as Francisco Partners GP III Management, LLC; NSO Group told the authors that there is no relationship between Westbridge and Francisco Partners, that Westbridge's ownership passed in the 2019 Novalpina transaction and that the registration was incorrect.", "qualification": "Records as described in the report.", "response": "NSO Group: the federal contractor registration naming Francisco Partners as owner is incorrect.", "outcome": "", "source_ids": [ "src-021" ], "entity_ids": [ "westbridge", "lavie", "divittorio", "qcyber", "francisco", "nso", "novalpina" ] }, { "id": "c-rel-westbridge-sales", "kind": "attributed", "text": "The WhatsApp complaint described Westbridge Technologies, Inc. as NSO Group's US marketing and sales arm; a 2020 report based on records obtained through public-records requests said a Westbridge brochure called the company \"the North American branch of NSO Group\", stressed that it was based in Bethesda, Maryland and then majority owned by an American private equity firm, and marketed a product called Phantom, which a former NSO employee described as the US brand of Pegasus; a 2022 report said Westbridge pitched the spyware to US law enforcement.", "qualification": "Allegation in the complaint and press accounts.", "response": "An NSO spokesperson told the 2020 publication that NSO Group products sold to foreign sovereigns cannot be used to conduct cyber-surveillance within the United States and that no customer has ever been granted technology enabling the targeting of phones with US numbers.", "outcome": "According to the 2020 report, the US Drug Enforcement Administration, to which Westbridge had demonstrated the technology, and the San Diego police did not buy it because of its cost.", "source_ids": [ "src-004", "src-103", "src-098" ], "entity_ids": [ "westbridge", "nso" ] }, { "id": "c-rel-westbridge-ownership", "kind": "attributed", "text": "Francisco Partners said that it never held a direct interest in Westbridge and that its indirect interest through OSY Holdings and Triangle ended on 18 March 2019; OSY Technologies' accounts record OSY's equity interests in Westbridge Technologies, Inc., pledged to the lenders' collateral agent since April 2019, and NSO Group and Q Cyber told a US court in 2023 that Westbridge is an affiliate owned by the same ultimate parent as NSO Group rather than NSO's subsidiary.", "qualification": "Positions of Francisco Partners and the defendants, and OSY's accounts.", "response": "", "outcome": "", "source_ids": [ "src-062", "src-021", "src-058" ], "entity_ids": [ "westbridge", "francisco", "osy-holdings", "triangle", "osy", "nso", "qcyber" ] }, { "id": "c-rel-convexum", "kind": "attributed", "text": "According to the 2021 NGO report, NSO Group Technologies Ltd. acquired the Israeli counter-drone company Convexum Ltd. in February 2020 for $60 million, and one of Convexum's previous shareholders was F2 Capital Ltd., chaired by NSO investor Eddy Shalev; NSO Group said Convexum develops and exports the Eclipse anti-drone system.", "qualification": "The report's account; Israeli press later reported that Convexum was controlled in practice by Triangle rather than NSO and was separated from NSO after a court dispute.", "response": "", "outcome": "", "source_ids": [ "src-021" ], "entity_ids": [ "nso", "convexum", "eddy-shalev" ] }, { "id": "c-rel-pfos", "kind": "fact", "text": "UK Companies House records PFOS Technologies Limited, company number 08521034, incorporated in England on 9 May 2013 and dissolved on 30 November 2021; the 2021 NGO report states that NSO Group Technologies Ltd. was its sole shareholder and that its principal activity was marketing services for its parent.", "qualification": "The shareholding is the report's statement from UK filings.", "response": "", "outcome": "", "source_ids": [ "src-063" ], "entity_ids": [ "pfos", "nso" ] }, { "id": "c-rel-footprint", "kind": "attributed", "text": "According to the European Parliament report, the NSO group has had a corporate presence in Israel, the United Kingdom, Luxembourg, the Cayman Islands, Cyprus, the United States, the Netherlands, Bulgaria and the British Virgin Islands; citing the 2021 NGO report, it states that between November 2014 and December 2016 the group operated through two Dutch companies, Shapes 1 BV and Shapes 2 BV, financial holding companies later liquidated.", "qualification": "Account of the inquiry report relying on NGO research.", "response": "", "outcome": "", "source_ids": [ "src-066" ], "entity_ids": [ "nso", "shapes1", "shapes2" ] }, { "id": "c-rel-mubadala", "kind": "attributed", "text": "A British business newspaper reported in April 2022, according to three people with knowledge of the matter, that Mubadala Capital, a unit of an Abu Dhabi state fund chaired by Crown Prince Sheikh Mohammed bin Zayed al-Nahyan, was one of the largest investors in the €1 billion private equity fund that bought NSO in 2019, and that the Abu Dhabi government internally discussed buying NSO outright in autumn 2021.", "qualification": "Press account from unnamed sources, as republished by other outlets; Mubadala's stake in the fund is not quantified.", "response": "", "outcome": "According to the same account, the Abu Dhabi discussions did not progress beyond preliminary conversations.", "source_ids": [ "src-107", "src-096" ], "entity_ids": [ "mubadala", "noal", "nso" ] }, { "id": "display-claim-3dbb00fb237ef3fdf297efc9", "kind": "analysis", "text": "Q Cyber Technologies Ltd is the Israeli company that has held NSO Group Technologies' shares since March 2014 and was recorded in NSO's 2019 annual report as its corporate director from 19 March 2014; it is distinct from the Luxembourg Q Cyber Technologies S.à r.l. OSY Technologies of Luxembourg has owned all of its shares since 17 March 2014; the companies above OSY changed in 2014, 2019, February 2023 and October–December 2025, when the register shows NorthPole Newco passing from Lavie's Dufresne Holding to Schremer, to Hippocrene Ventures and back to Schremer, while the investors NSO spoke of are not named in any retained document. Q Cyber is a co-defendant with NSO in WhatsApp's California suit, in which the punitive award was remitted to $4,002,471 and a permanent injunction entered before the defendants appealed, and in July 2026 an Israeli court held that its payments to OSY were taxable dividends.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-004", "src-002", "src-003", "src-014", "src-113", "src-069", "src-021", "src-011", "src-048", "src-080", "src-053", "src-058", "src-026", "src-067", "src-039", "src-040", "src-001", "src-005", "src-068", "src-064", "src-018", "src-006", "src-007", "src-035", "src-034", "src-033", "src-012", "src-013", "src-030", "src-057", "src-056", "src-031", "src-116", "src-025", "src-086", "src-087", "src-043", "src-038", "src-066", "src-051" ], "entity_ids": [ "qcyber", "nso", "shohat", "ngtp", "sesame", "osy", "idisis", "triangle", "square2", "osy-holdings", "gorev", "francisco", "northpole-holdco", "novalpina-luxco", "noal", "novalpina-gp", "mercury", "northpole-newco", "northpole-bidco", "diamond", "dufresne", "lavie", "brg", "treo-gp", "simonds", "schremer", "hippocrene", "deca", "whatsapp", "facebook", "kfar-saba", "bis", "qcyber-lux", "anthony-levy", "karmi", "hulio" ] }, { "id": "display-claim-2c3dd735ec3e65497135def0", "kind": "analysis", "text": "Q Cyber Technologies Ltd is a private Israeli company, number 514971522. It was incorporated on 2 December 2013 as L.E.G.D. Company Ltd, and on 29 May 2016 the Israeli Registrar of Companies certified its change of name to Q Cyber Technologies Ltd. NSO Group Technologies Ltd, registered as N.S.O. Group Technologies Ltd under number 514395409, had been incorporated on 25 January 2010. In their annual reports to the Registrar updated to 7 January 2019 both companies gave the same address, 22 Galgalei Haplada, Herzliya. Copies of the register published by two Israeli company-information sites, read instead of the register itself, list Q Cyber as an active private company formed to engage in any lawful business, with a last annual report for 2025, and give it and NSO the same address in each copy: Yael Man 1, Ramat HaSharon in one and HaAluf Yitzhak Hofi 1, Ramat HaSharon in the other. Neither copy records when the address changed, and a shared address does not show which company occupies the premises.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-004", "src-002", "src-003", "src-014", "src-113" ], "entity_ids": [ "qcyber", "nso" ] }, { "id": "display-claim-2b9773f1019f2cfede728887", "kind": "analysis", "text": "Until at least June 2019, according to the WhatsApp complaint, NSO Group's website described NSO as \"a Q Cyber Technologies company\"; the archived page filed as an exhibit reads \"NSO Group, a Q Cyber Technologies company\". In 2021 correspondence with the authors of an NGO research report, NSO Group gave its own description of the two companies' functions: NSO Group Technologies and Q Cyber Technologies develop, market and export Pegasus and related analytical products for governmental use and provide sales, marketing and administrative support and oversight to their affiliates. Israeli business reporting said in January 2023 that the difference between Q Cyber and NSO might be purely symbolic and in March 2023 that Q Cyber was in every respect identical to NSO, with NSO's chief executive Yaron Shohat also its chief executive; no register record of Q Cyber's officers after 2019 was retained, and press reports of January 2026 say Shohat stepped down after the 2025 change of ownership. US courts have treated the two companies together: the Ninth Circuit's opinion of 8 November 2021 and the Northern District of California's orders of 8 March 2024 and 30 September 2026 refer to them jointly as \"NSO\", and the Eastern District of Virginia's memorandum of 26 October 2023 describes NSO Group as a subsidiary of Q Cyber.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-004", "src-069", "src-021", "src-011", "src-048", "src-080", "src-053", "src-058", "src-026", "src-067" ], "entity_ids": [ "nso", "qcyber", "shohat" ] }, { "id": "display-claim-c1b4255e2d6c86dfceb94c28", "kind": "analysis", "text": "According to Israeli register records cited in the 2021 NGO report, which were not themselves retained, Q Cyber has since 2019 been the sole shareholder of two further Israeli companies, NGTP Ltd (number 516043551, incorporated 20 June 2019) and S. Sesame Technology Ltd (number 516080850, incorporated 5 September 2019). NSO Group told the authors that both were inactive and had been created for potential future plans that had not materialised. Copies of the register, which do not show shareholders or officers, list both as active private companies with annual reports filed for 2025; NGTP's registered address is HaAluf Yitzhak Hofi 1, Ramat HaSharon, the address shown for Q Cyber and NSO in the same source, and S. Sesame Technology's is in Neve Daniel.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-021", "src-039", "src-040" ], "entity_ids": [ "qcyber", "ngtp", "sesame" ] }, { "id": "display-claim-c72de5b5741e0ab6e7dfe483", "kind": "analysis", "text": "Q Cyber's own annual report, updated to 7 January 2019 and signed on 16 June 2019, lists OSY Technologies S.à r.l. of Luxembourg (B184226) as its sole shareholder with all 100,000 ordinary shares and as its director from 17 March 2014. According to the Israeli tax judgment of July 2026, Q Cyber's shares passed to OSY on 17 March 2014, 70% of NSO's shares were transferred from OSY to Q Cyber under a trust agreement on 19 March 2014, and the remaining 30% were exchanged for shares in Triangle Holdings on 30 November 2014. NSO's report of the same date as Q Cyber's lists two shareholders: Q Cyber, with 118,263 ordinary, 8,936 ordinary A and 295,170 preferred A shares, and NSO itself, with 67,453 ordinary shares. Above OSY the chain has changed with each owner. According to the 2021 NGO report and an aggregator summary of the Luxembourg register, from November 2014 Square 2 owned OSY and was in turn owned by Triangle Holdings, whose sole shareholder at first was OSY Holdings, which Francisco Partners described in 2021 as a Cayman Islands vehicle wholly owned by its fund Francisco Partners III, through which the fund held an indirect controlling interest in NSO from March 2014 to 18 March 2019. After the 2019 buyout, Mercury Public Affairs' registration of December 2019 under the US Foreign Agents Registration Act described Q Cyber as wholly owned by OSY, which Square 2 held through intermediate companies, with Square 2 about 32% owned by Triangle and about 68% by NorthPole Holdco, a vehicle of the fund then called Novalpina Capital Partners I SCSp.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-004", "src-001", "src-021", "src-005", "src-068", "src-064" ], "entity_ids": [ "qcyber", "osy", "idisis", "nso", "triangle", "square2", "osy-holdings", "gorev", "francisco", "northpole-holdco", "novalpina-luxco", "noal", "novalpina-gp", "mercury" ] }, { "id": "display-claim-44e65365f895dbd05c47deba", "kind": "analysis", "text": "An aggregator's summary of the Luxembourg register records that NorthPole Newco replaced Square 2 as OSY's shareholder on 6 May 2019, after the buyout. Israeli business reporting on 1 March 2023, based on a notice filed in Q Cyber's Tel Aviv proceedings and on the Luxembourg register, said that the lenders that had financed the 2019 buyout had exercised their rights under the loan agreements, so that the pledged shares of NorthPole, until then held by a holding company called Diamond, passed to Dufresne Holding, whose sole shareholder and director was Omri Lavie; NSO did not respond, and a spokesperson for TREO NOAL GP, general partner of the fund, said the lenders had seemingly organised a foreclosure after NSO failed to meet its financial obligations since 2021, that the fund had been denied basic corporate information, and that its investment had been and remained valueless. A register publication of 24 February 2023, as summarised by the same aggregator, records Dufresne in place of Diamond LIE as NorthPole Newco's shareholder. On 8 October 2025 Dufresne transferred all of NorthPole Newco's shares to Ohad Shazar Shalem Schremer. On 8 December 2025, by realisation of a pledge followed by a private sale, they passed to Hippocrene Ventures LLC, a Delaware company; the register notice does not name the pledgee. Under a share purchase agreement of 30 December 2025 Hippocrene sold them back to Schremer, who became sole shareholder again.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-018", "src-006", "src-005", "src-011", "src-007", "src-035", "src-034", "src-033" ], "entity_ids": [ "northpole-holdco", "square2", "northpole-newco", "northpole-bidco", "osy", "diamond", "dufresne", "lavie", "brg", "nso", "treo-gp", "noal", "simonds", "schremer", "hippocrene" ] }, { "id": "display-claim-7cb05a18b7d515b36cb82278", "kind": "analysis", "text": "On 10 October 2025 NSO's spokesperson told a US technology publication that \"an American investment group has invested tens of millions of dollars in the company and has acquired controlling ownership\", with the headquarters and core operations remaining in Israel under Israeli supervision; Israeli business reporting the same day named Robert Simonds as the group's leader, valued the deal at several tens of millions of dollars, expected it to include the divestment of NSO's roughly $500 million debt and said it needed approval from the Defence Ministry's export control agency, with Lavie's involvement ending. The spokesperson declined to name the investors or the amount and later declared his comments off the record, according to the US publication; Lavie did not immediately comment, and neither Simonds nor STX Entertainment responded. The 8 October 2025 transfer to Schremer described above is the change the register records. The retained documents do not name the investors or record the agency's decision.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-012", "src-013", "src-035" ], "entity_ids": [ "nso", "simonds", "lavie", "deca" ] }, { "id": "display-claim-bd5cd7c23e26378741ae4607", "kind": "analysis", "text": "On 29 October 2019 WhatsApp and Facebook sued NSO Group Technologies and Q Cyber Technologies in the Northern District of California, alleging that between about April and May 2019 the defendants used WhatsApp servers to send malware to approximately 1,400 mobile phones. The defendants argued that they were immune because they acted for foreign governments; the district court and, in November 2021, the Ninth Circuit rejected that defence, and the court later granted partial summary judgment on liability. On 6 May 2025 a jury awarded $444,719 in compensatory and $167,254,000 in punitive damages; on 17 October 2025 the court remitted the punitive award to $4,002,471 and granted a permanent injunction, directing that the defendants' sovereign government customers, which it did not name, be excluded from its scope, and final judgment was entered on 12 November 2025. The two companies appealed to the Ninth Circuit on 19 November 2025; the retained records do not show the outcome of the appeals.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-004", "src-030", "src-026", "src-057", "src-056", "src-031" ], "entity_ids": [ "whatsapp", "facebook", "nso", "qcyber", "osy", "shohat" ] }, { "id": "display-claim-1c55c9355e82ff613452db38", "kind": "analysis", "text": "In Israel, the Central District Court dismissed Q Cyber's withholding-tax appeal on 28 July 2026, holding that its payments to its foreign parent were to be taxed as dividends rather than treated as loan repayments, and ordered it to pay NIS 40,000 in costs; the court cancelled the penalty for failure to withhold tax, finding no fraudulent or false conduct. This is a district-court judgment, and the retained records do not show whether it was appealed.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-001", "src-116" ], "entity_ids": [ "qcyber", "kfar-saba", "osy" ] }, { "id": "display-claim-8a426ecb26fbba49bea74957", "kind": "analysis", "text": "Since a rule published on 4 November 2021, \"NSO Group\" has been on the US Entity List, with a licence required for all items subject to the Export Administration Regulations and a presumption of denial. The entry gives the Herzliya address that both NSO Group Technologies and Q Cyber Technologies used in their 2019 Israeli annual reports, without either company's register number. The official electronic Code of Federal Regulations, read on 20 October 2026, still shows the entry in the version in force from 16 July 2026; that records its presence, not licensing decisions under it.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-025", "src-086", "src-087" ], "entity_ids": [ "bis", "nso" ] }, { "id": "display-claim-ea739207a8c98b6dbb318dc6", "kind": "analysis", "text": "Two points about Q Cyber itself remain open in the retained record. The July 2026 tax judgment describes Omri Lavie, who testified for Q Cyber, as currently its controlling owner through the chain of companies and, accepting the Assessing Officer's remark, as its sole shareholder with an interest in the outcome; the judgment does not date that \"currently\", and Luxembourg register publications record that Lavie's holding company transferred NorthPole Newco to another person on 8 October 2025, when he resigned as its manager, and notices of 28 and 30 October 2025 record his removal from the boards of Q Cyber Technologies S.à r.l. and OSY Technologies. And in the Madrid case brought in May 2022 by Gonzalo Boye on behalf of at least 19 Pegasus targets against NSO, its three founders, Q Cyber Technologies and OSY, the sources do not say whether the Israeli Q Cyber Technologies Ltd or the Luxembourg Q Cyber Technologies S.à r.l. was named, and no outcome is recorded.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-001", "src-043", "src-038", "src-066", "src-051" ], "entity_ids": [ "lavie", "qcyber", "nso", "gorev", "francisco", "qcyber-lux", "schremer", "anthony-levy", "osy", "karmi", "hulio" ] }, { "id": "display-claim-57698fa7f4915e43e6ae334a", "kind": "analysis", "text": "On 5 February 2014 OSY Technologies S.à r.l., a Luxembourg company, agreed with NSO Group Technologies and its shareholders to acquire all rights in NSO in two stages: $70 million in cash for 70% of the rights and, for the remaining 30%, an exchange of NSO shares for shares in Triangle Holdings, which made NSO's original shareholders partners in Francisco Partners' cyber business. On 17 March 2014 the shares of Q Cyber, then still called L.E.G.D. Company, passed to OSY; on 19 March 70% of NSO's shares were transferred from OSY to Q Cyber under a trust agreement, and on 30 November the remaining 30% were exchanged for Triangle shares. Q Cyber's financial statements, as quoted by the court, describe NSO as the subsidiary it acquired in 2014 from its parent OSY.", "qualification": "These steps are findings recited in the Israeli Central District Court's judgment of 28 July 2026 in Q Cyber's tax appeal; Q Cyber's financial statements were quoted by the court and were not themselves retained.", "response": "", "outcome": "", "source_ids": [ "src-001" ], "entity_ids": [ "osy", "nso", "triangle", "francisco", "qcyber" ] }, { "id": "display-claim-4b970ead49f9f2a7458f0369", "kind": "analysis", "text": "The price is recorded differently. The judgment gives $70 million in cash for 70% of the rights; the 2021 NGO report states that Francisco Partners III acquired a 70% stake for $115 million in a deal announced in March 2014 and reportedly approved by Israel's Ministry of Defense; and a 2017 news report puts the purchase at $120 million. The figures may measure different components of the same transaction, and none of the retained records reconciles them.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-021", "src-104" ], "entity_ids": [ "francisco", "nso", "osy" ] }, { "id": "display-claim-e21bb16055f6153751975237", "kind": "analysis", "text": "A 2023 European Parliament inquiry report, relying on the NGO report, gives further figures: just under $130 million for Circles, 90% of NSO for Francisco Partners, and a merger of Circles and NSO under L.E.G.D. Company Ltd., known as Q Cyber Technologies Ltd. since 29 March 2016. Those details differ from the primary records: the Israeli name-change certificate is dated 29 May 2016, and the other accounts give Francisco Partners 70% of NSO, not 90%.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-066" ], "entity_ids": [ "francisco", "circles", "nso", "qcyber" ] }, { "id": "display-claim-a2decca21f906fa1de2e27e7", "kind": "analysis", "text": "The tax-appeal judgment of 28 July 2026 describes OSY as a Luxembourg-resident company that Francisco Partners held not directly but through a chain of companies headed by Triangle Holdings S.A. Francisco Partners told the authors of the 2021 NGO report that from March 2014 to 18 March 2019 its fund Francisco Partners III held an indirect controlling interest in NSO through OSY Holdings Ltd., a wholly owned Cayman Islands vehicle that controlled Triangle, never exported anything and did nothing but hold that interest; by 2021, it said, OSY Holdings had no remaining assets or liabilities and was being dissolved under Cayman Islands law.", "qualification": "Francisco Partners called OSY Holdings an exempted limited partnership, whereas Triangle's minutes of 1 December 2014 describe OSY Holdings Limited as an exempted company registered with the Cayman Islands Companies Register under number MC-284745.", "response": "", "outcome": "", "source_ids": [ "src-001", "src-021", "src-068" ], "entity_ids": [ "osy", "francisco", "triangle", "osy-holdings", "nso" ] }, { "id": "display-claim-48ff9be182c300131c71e42b", "kind": "analysis", "text": "According to Luxembourg and Cayman records cited in the 2021 NGO report, OSY Technologies was incorporated on 3 February 2014 with OSY Holdings Ltd., registered in the Cayman Islands on 30 January 2014, as its sole shareholder, and from March 2014 OSY was the sole shareholder and active director of L.E.G.D. Company; OSY's own 2024 accounts confirm its incorporation date. The same report states that Triangle Holdings SA and Square 2 S.à r.l. were each incorporated in Luxembourg on 21 November 2014, and that OSY Holdings became Triangle's sole shareholder, with Eran Gorev, a Francisco Partners director and newly appointed NSO chair, as its sole director; Triangle became Square 2's sole shareholder, and Square 2 took full ownership of OSY. An aggregator summary of the Luxembourg register records Square 2 as OSY's shareholder from 28 November 2014.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-021", "src-062", "src-005" ], "entity_ids": [ "osy", "osy-holdings", "qcyber", "triangle", "square2", "gorev", "nso", "francisco" ] }, { "id": "display-claim-5f14e9f355dc6064d5dc8c7d", "kind": "analysis", "text": "The Israeli annual reports updated to 7 January 2019 show the chain at Q Cyber's level. Q Cyber's own report, signed on 16 June 2019, lists OSY Technologies (Luxembourg register number B184226) as its sole shareholder with all 100,000 ordinary shares and as its director since 17 March 2014, with Yifa Idisis as financial director. NSO's report names Q Cyber as NSO's director from 19 March 2014, a financial director named Idisis, and two shareholders: Q Cyber, with 118,263 ordinary, 8,936 ordinary A and 295,170 preferred A shares, and NSO itself, with 67,453 ordinary shares.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-004" ], "entity_ids": [ "qcyber", "osy", "idisis", "nso" ] }, { "id": "display-claim-bfa0c51b50b31b967e5198c9", "kind": "analysis", "text": "The 2021 NGO report observed that these 67,453 treasury shares were 36% of NSO's allotted ordinary shares and that it was unclear who exercised their ownership. NSO Group replied that Israeli law allows a company to hold its own shares, for example after a buyback, and that the full ownership rights in NSO Group Technologies are therefore held by Q Cyber. The buyback itself is not documented in the retained records.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-021" ], "entity_ids": [ "nso", "qcyber" ] }, { "id": "display-claim-3786b473adbb9e9636dcd6ce", "kind": "analysis", "text": "Minutes of Triangle's extraordinary general meeting of 1 December 2014, published in Luxembourg's official gazette, start from OSY Holdings Limited as sole shareholder and raise the capital from USD 48,038.80 to USD 74,548.10 with new class A and class D shares. Omri Lavie and Shalev Hulio, recorded as Shalev Holy, each subscribed 67,263 class D shares (9% of the capital) for 50 NSO shares; Eddy Shalev 13,444 class D shares (1.8%) for 10 NSO shares; the Israeli trust company ESOP Management and Trust Services 20,767 class A shares (2.8%) for 20,767 NSO shares; and, for cash, Global Seven Group LP, a British Virgin Islands limited partnership, 89,458 class D shares (12%) and Eran Gorev 6,336 class D shares (0.8%). The minutes do not name Global Seven Group's general partner or beneficial owners.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-068" ], "entity_ids": [ "triangle", "osy-holdings", "lavie", "hulio", "eddy-shalev", "esop", "global-seven", "gorev", "nso" ] }, { "id": "display-claim-81f4bf123b4fb7b6d22ba9b3", "kind": "analysis", "text": "The 2021 NGO report summarises the result as about 35.5% of Triangle for the new shareholders, including Alexei Voronovitsky with 0.1%, and the remaining 64.5% for OSY Holdings, that is Francisco Partners. NSO Group told the authors that the trust company held shares and options for employees under the company's employee stock ownership plan, an entity the tax rules required. According to the report, Triangle's board resolved on 18 February 2019 to buy back the trust's shares, which ended its shareholding.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-021" ], "entity_ids": [ "triangle", "osy-holdings", "francisco", "esop", "voronovitsky", "nso" ] }, { "id": "display-claim-2704b537b70422e150458547", "kind": "analysis", "text": "On 1 December 2014 Triangle appointed as directors Alessandro Celli, Jonathan Murphy, Andrew Kowal and Matthew Spetzler, all with professional addresses in London or San Francisco, the latter Francisco Partners' registered office, together with Frédéric Gardeur, Omri Lavie, Shalev Hulio and Boaz Goldman of the Circles group, with Andreas Koutsos as observer. According to Triangle's minutes as summarised in the NGO report, on 1 April 2019 the company acknowledged the resignations of Goldman, Eran Gorev, Kowal, Murphy and Spetzler as class A directors.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-068", "src-021" ], "entity_ids": [ "triangle", "murphy", "kowal", "spetzler", "lavie", "hulio", "goldman", "gorev", "circles" ] }, { "id": "display-claim-86352a5913afb891425e9b8c", "kind": "analysis", "text": "Alongside NSO, Francisco Partners acquired through OSY on 1 December 2014 the Circles group of companies, also active in the cyber field, according to the judgment. The 2021 NGO report adds that Circles was founded in 2010 by Tal Dilian, Boaz Goldman and Eric Banoun, is known for technology exploiting vulnerabilities in the SS7 telephone signalling network for surveillance, and cost Francisco Partners $130 million. Citing OSY's 2014 accounts, the report states that OSY also acquired IOTA Holdings Ltd., registered in Cyprus on 4 November 2014 and parent of CS-Circles Solutions Ltd., Global Hubcom Ltd. and MS Magnet Solutions Ltd. The report adds that CS-Circles Solutions owns Circles Bulgaria EOOD (incorporated in July 2017) and MS Magnet Solutions owns Magnet Bulgaria EOOD (incorporated in April 2014). NSO Group told the authors that the Circles-linked company CT-Circles Technologies Ltd. is not part of the NSO Group.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-001", "src-021" ], "entity_ids": [ "francisco", "osy", "circles", "goldman", "iota", "qcyber" ] }, { "id": "display-claim-8ab1434eb9af3748f1f4fea6", "kind": "analysis", "text": "A US business magazine reported in December 2017 that Francisco Partners had months earlier failed to sell part of NSO to the New York-based Blackstone Group at a reported valuation of $1 billion, and that the deal collapsed amid reports that summer about the use of NSO's spyware in Mexico. The sale did not take place; no other retained record describes the negotiations.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-119" ], "entity_ids": [ "francisco", "nso" ] }, { "id": "display-claim-3726a32c9376f7a282bc8c58", "kind": "analysis", "text": "Q Cyber Technologies Ltd appealed to Israel's Central District Court in Lod (TA 59924-03-22, Judge Avi Gorman) against assessments by the Kfar Saba Assessing Officer of tax that, according to the officer, it should have withheld for the tax years 2014–2015 and 2017–2018. The question was whether the sequence of steps taken to acquire an Israeli company, financed by loans from a foreign parent company and their repayment, was an artificial transaction under section 86 of the Income Tax Ordinance. As the judgment summarises the parties' positions, the Assessing Officer argued that the arrangement served to avoid tax on dividends and on the transfer of profits abroad, contrary to Israel's two-tier taxation under which dividends paid to a foreign-resident company are taxable. Q Cyber answered that the transaction followed accepted practice and rested on substantive commercial reasons for creating and operating an Israeli company, and that repaying the loan to its foreign parent was neither a dividend nor taxable. On 28 July 2026 the court accepted the Assessing Officer's position and dismissed the appeal.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-001", "src-116" ], "entity_ids": [ "qcyber", "kfar-saba" ] }, { "id": "display-claim-4cb2288aaa57a000e64e136e", "kind": "analysis", "text": "According to the judgment, Q Cyber was incorporated on 2 December 2013 as a shelf company named L.E.G.D. Ltd and later renamed, and a 2026 review of the judgment by an Israeli law firm reports the court's finding that at the time of the acquisition it had no employees, no substantive operations and no bank account. The judgment records that between 2014 and 2018 Q Cyber repaid the loans from its parent OSY with loans and dividends it received from its subsidiary NSO; more than $86 million of the repayment funds passed directly from NSO to OSY rather than through Q Cyber's bank account. In 2016 NSO declared a dividend of about $38.4 million to Q Cyber, which stayed with NSO to repay Q Cyber's loans from NSO, and the roughly $86 million that Q Cyber paid to OSY repaid the loans taken to buy NSO's shares in 2014.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-001", "src-116" ], "entity_ids": [ "qcyber", "osy", "nso" ] }, { "id": "display-claim-c79cd637ad5aa58faf037b00", "kind": "analysis", "text": "Relying on Q Cyber's own financial statements, the Assessing Officer also raised substantial doubt whether Q Cyber was in fact the entity that acquired NSO, or whether NSO's shares were transferred to it only after an agreement had been signed for the Luxembourg company to acquire NSO directly. This argument is reported in a review of the judgment, which states that the court took it into account.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-116" ], "entity_ids": [ "qcyber", "nso", "osy", "kfar-saba" ] }, { "id": "display-claim-6fb99235e3913626bb1bac5c", "kind": "analysis", "text": "The court held that the arrangement was an artificial transaction. Had NSO's profits been distributed directly to the Luxembourg company, the dividend would have borne 10% tax under the Israel–Luxembourg tax treaty; interposing Q Cyber allowed the funds to move as loan repayments without that tax. Q Cyber had not proved a fundamental commercial purpose other than tax: no contemporaneous evidence explained why the Israeli company was included, key representatives of the investment fund were not called as witnesses, and the commercial reasons put forward, including centralising marketing and distribution, finding further investments in Israel and defence-export regulation, were not shown to have shaped the structure when it was designed. This reasoning is the court's, as summarised in a law-firm review of the judgment.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-116" ], "entity_ids": [ "qcyber", "osy", "nso", "kfar-saba" ] }, { "id": "display-claim-95737a7f9d4ca85bd8511e10", "kind": "analysis", "text": "The court dismissed the appeal, holding that the payments to the foreign parent company were to be taxed as dividends rather than treated as loan repayments, and ordered Q Cyber to pay the Assessing Officer's costs of NIS 40,000. It cancelled the penalty for failure to withhold tax at source, finding that the circumstances did not justify a finding of fraudulent or false conduct. This is a district-court judgment, and the retained records do not show whether it was appealed.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-001", "src-116" ], "entity_ids": [ "qcyber", "kfar-saba", "osy" ] }, { "id": "display-claim-36ca66daf2c4c0df01ce439d", "kind": "analysis", "text": "Omri Lavie, a co-founder and shareholder of NSO, testified for Q Cyber. The judgment describes him as currently the controlling owner of Q Cyber through the chain of companies and, accepting the Assessing Officer's remark, as its sole shareholder with an interest in the outcome; it does not date that \"currently\", and Luxembourg register publications record that Lavie's holding company transferred NorthPole Newco to another person on 8 October 2025, when Lavie resigned as its manager, and notices of 28 and 30 October 2025 record his removal from the boards of Q Cyber Technologies S.à r.l. and OSY Technologies. The court described Eran Gorev, Francisco Partners' representative in Israel, as apparently a key figure among the Francisco Partners people who, Lavie testified, designed the transaction; according to Lavie, Gorev negotiated the purchase of the NSO shares and managed Q Cyber on Francisco's behalf shortly after it was set up. Gorev gave a statement to the Assessing Officer but was not called as a witness.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-001", "src-035", "src-043", "src-038" ], "entity_ids": [ "lavie", "qcyber", "nso", "gorev", "francisco", "northpole-newco", "schremer", "dufresne", "qcyber-lux", "anthony-levy", "osy" ] }, { "id": "display-claim-169e84e56a000d3d5af89da3", "kind": "analysis", "text": "According to what the parties told the court, Francisco Partners sold its holdings in Q Cyber, and through it in NSO, in 2019, and the purchaser later sold them on to one of NSO's original shareholders.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-001" ], "entity_ids": [ "francisco", "qcyber", "nso" ] }, { "id": "display-claim-c1ed5536fd0984a5eea50897", "kind": "analysis", "text": "On 14 February 2019 Novalpina Capital published a press release announcing that NSO Group's management team and founders were acquiring the company from the private equity firm Francisco Partners. The buyers' announcement said the acquisition was led by the co-founders Shalev Hulio and Omri Lavie with members of the senior executive team and many employees, supported by Novalpina Capital as equity partner, with Jefferies Group LLC advising and leading the financing, and that NSO had finished 2018 with revenues of $250 million and dozens of licensed customers, a figure that is the company's own. WhatsApp's complaint of October 2019 alleged the same sequence: financing from 2014 by a San Francisco-based private equity firm that ultimately bought a controlling stake, and reacquisition by the founders in and around February 2019.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-009", "src-004" ], "entity_ids": [ "nso", "francisco", "hulio", "lavie", "novalpina" ] }, { "id": "display-claim-13d589cd668a32c72ec1d8e9", "kind": "analysis", "text": "Francisco Partners told the authors of the 2021 NGO report that on 18 March 2019 OSY Holdings disposed of its entire interest in Triangle Holdings and Eran Gorev sold his whole interest too; after that, it said, neither it, its fund, OSY Holdings nor any associated person, Gorev included, kept any ownership or economic interest in NSO Group, and Gorev, Matt Spetzler and Andrew Kowal resigned as directors. A 2023 European Parliament report dates Francisco Partners' sale of its entire interest to Novalpina to 14 February 2019, the day the deal was announced.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-021", "src-066" ], "entity_ids": [ "francisco", "osy-holdings", "triangle", "gorev", "spetzler", "kowal", "nso" ] }, { "id": "display-claim-9301e5978d80b488ddb79230", "kind": "analysis", "text": "Accounts of the terms differ in what they measure. Israeli business reporting in 2022, based on Tel Aviv court documents, said the deal valued NSO at over $1 billion: Hulio and NSO's management held 30% and Novalpina acquired 70% through a direct investment of $290 million, $100 million in shares from Hulio and his associates and $400 million of bank loans placed in the holding company controlling NSO. A 2022 news agency report said Novalpina borrowed $500 million and placed the debt in the holding company above NSO, and the fund's general partner told a New York court in 2025 that the fund acquired the NSO Group for €218.5 million. These press accounts and the party's filing describe different components, such as enterprise value, equity cheque and borrowing, and are not reconciled in the retained records.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-115", "src-120", "src-106" ], "entity_ids": [ "nso", "novalpina", "hulio", "noal", "francisco" ] }, { "id": "display-claim-dd6ab056eadadc2142a728bc", "kind": "analysis", "text": "According to the 2021 NGO report, the Luxembourg fund Novalpina Capital Partners I SCSp, registered on 23 August 2017, had commitments above its €1 billion target. Its limited partners included the Oregon Public Employees Retirement System (18%), the Alaska Permanent Fund Corp. (5.1%), South Yorkshire Pensions Authority (2.7%) and East Riding Pension Fund (1.4%); these are shares of commitments to the fund, not stakes in NSO. The fund invested through Novalpina Capital Partners I LuxCo S.à r.l. (incorporated 13 November 2017) and, for NSO, through NorthPole Holdco S.à r.l., wholly owned by LuxCo. Its general partner, Novalpina Capital Partners I GP S.à r.l. (incorporated 18 August 2017), was ultimately owned by Novalpina Capital Group S.à r.l. of Stephen Peel, Stefan Kowski and Bastian Lueken; an English High Court judgment of 2025 likewise says the fund, now NOAL SCSp, was set up in 2017 by Kowski, Lueken and Peel.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-021", "src-102", "src-075" ], "entity_ids": [ "noal", "oregon", "alaska", "south-yorkshire", "east-riding", "novalpina-gp", "novalpina-luxco", "northpole-holdco", "novalpina-group", "peel", "kowski", "lueken" ] }, { "id": "display-claim-d39b729e1fc0ece8c5b41f83", "kind": "analysis", "text": "Register minutes summarised in the report record that on 19 March 2019 LuxCo's shareholders resolved that 893,750 class 2 tracking shares would track the investment in NorthPole Holdco, and on 8 May 2019 the fund contributed those shares (valued at EUR 32,564,682) and a receivable of EUR 184,465,145, together EUR 217,029,827, to a new company, Novalpina Capital Partners I LuxCo North S.à r.l.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-021" ], "entity_ids": [ "novalpina-luxco", "northpole-holdco", "noal", "nso" ] }, { "id": "display-claim-b08913e376ef404714502e6e", "kind": "analysis", "text": "Luxembourg register publications summarised by a company-data aggregator record NorthPole Holdco S.à r.l. (B226434), originally Eighteen Scabiosa S.à r.l., with LuxCo as shareholder and Gaëtan Dumont, Allen Foley and Philip Zarb Mizzi as managers from 30 November 2018. Stefano Pileri and Michael Elie Zini became managers in July 2021 and were replaced by Dumont and Foley in August 2021; Tamara Makarenko became a manager on 24 February 2022, Dumont and Foley left on 1 March 2022, and James Ward became a manager on 20 October 2022.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-075" ], "entity_ids": [ "northpole-holdco", "novalpina-luxco", "dumont", "makarenko", "ward" ] }, { "id": "display-claim-7c701b6eb5a2a6e022f9d5e9", "kind": "analysis", "text": "According to the 2021 NGO report, after transactions in April 2019 Triangle Holdings owned 31.4% of Square 2 ($22 million of $70 million) and NorthPole Holdco owned 68.6% ($48 million); Square 2 owned NorthPole Bidco, which owned NorthPole Newco, which owned OSY Technologies, and OSY continued to own IOTA Holdings, Q Cyber Technologies S.à r.l., Q Cyber Technologies Ltd and Westbridge Technologies Inc. Aggregator summaries of the register date the steps: NorthPole Holdco became a Square 2 shareholder on 11 April 2019 (capital $70.8 million); NorthPole Newco, registered on 5 December 2018 as Eighteen Jasmine S.à r.l. and renamed on 31 January 2019, had NorthPole Bidco as shareholder from 15 April 2019; and NorthPole Newco replaced Square 2 as OSY's shareholder on 6 May 2019. The underlying publications were not retained.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-021", "src-018", "src-006", "src-005" ], "entity_ids": [ "triangle", "square2", "northpole-holdco", "northpole-bidco", "northpole-newco", "osy", "iota", "qcyber-lux", "qcyber", "westbridge", "novalpina" ] }, { "id": "display-claim-62d46cf1cd0318edf178d347", "kind": "analysis", "text": "Boards were rebuilt in the same weeks, according to register minutes summarised in the NGO report and an aggregator summary of the register. At Square 2's meeting on 1 April 2019 Triangle resigned as sole manager; Stefan Kowski, Stephen Peel, Mickaël Betito, Gerhard Schmidt, Zamir Dahbash and Günter Maximilian Schmid (recorded in Triangle's December 2019 minutes as Maximilian Schmid Günter) became class A managers and Omri Lavie, Shalev Hulio and Yuval Somekh class B managers. At OSY, OSY Holdings Ltd., Eran Gorev and Kevin Wilson were removed and the same class A managers, with Lavie and Hulio as class B managers, appointed; the aggregator dates Gorev's and Wilson's exit to 12 April 2019. Triangle's articles of 17 April 2019, as quoted in the report, make directors nominated by Hulio and Lavie class B directors and those nominated by NorthPole Holdco through NorthPole Bidco class A directors, and let class B directors represent the company only if the board delegates its powers to them.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-021", "src-005" ], "entity_ids": [ "square2", "triangle", "kowski", "peel", "schmidt", "lavie", "hulio", "somekh", "osy", "osy-holdings", "gorev", "kevin-wilson", "northpole-holdco", "northpole-bidco" ] }, { "id": "display-claim-85c3231f3ee5abc157a5344c", "kind": "analysis", "text": "The US lobbying registration that Mercury Public Affairs filed for Q Cyber described the same chain at the end of 2019. Exhibit A to Mercury Public Affairs' registration under the Foreign Agents Registration Act, received by the Justice Department on 25 December 2019, states that Q Cyber is wholly owned by OSY Technologies, which is wholly owned through intermediate holding companies by Square 2; that Square 2 is about 32% owned by Triangle Holding S.A. and about 68% by North Pole Holdco; that NorthPole is wholly owned by Novalpina Capital Partners I LuxCo, 99% owned by the ultimate parent, whose general partner is Novalpina Capital Partners I GP S.à r.l. That ultimate parent is the fund then called Novalpina Capital Partners I SCSp.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-064" ], "entity_ids": [ "qcyber", "osy", "square2", "triangle", "northpole-holdco", "novalpina-luxco", "noal", "novalpina-gp", "mercury" ] }, { "id": "display-claim-37fbec9d18f9501979b2cc7c", "kind": "analysis", "text": "On 30 December 2019, according to Triangle's minutes as summarised in the report and an aggregator, NorthPole Holdco contributed all of its 484,808,020 Square 2 shares, 68.46% of Square 2's capital with a fair market value of USD 247,825,445, to Triangle in exchange for new class A, B and D shares. Square 2 became wholly owned by Triangle, which became the point of connection between Novalpina and NSO, and NorthPole Holdco's stake came to about 59.8% of Triangle's class A shares; register summaries show Triangle replacing NorthPole Holdco as Square 2's shareholder on 27 January 2020. The same day Triangle's shareholders appointed the Novalpina executives Mickaël Betito, Stefan Kowski, Stephen Peel, Maximilian Schmid Günter and Gerhard Schmidt as class A directors and reclassified Hulio and Lavie as class B directors, and on 27 April 2020 Triangle appointed Asher Levy, named NSO's executive chairman in early April 2020, as a class A director.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-021", "src-018" ], "entity_ids": [ "northpole-holdco", "square2", "triangle", "novalpina", "nso", "kowski", "peel", "schmidt", "hulio", "lavie", "asher-levy" ] }, { "id": "display-claim-5674cac85bebba886687272b", "kind": "analysis", "text": "NSO Group described Novalpina's role to the report's authors in 2021: as a shareholder it appointed members to the boards of Triangle Holdings S.A. and OSY Technologies S.a.r.l. and their committees, which gave strategic direction, but it was not involved in the group's day-to-day operations.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-021" ], "entity_ids": [ "novalpina", "triangle", "osy", "nso" ] }, { "id": "display-claim-b659009aedf2b0ea53b48df8", "kind": "analysis", "text": "According to register minutes summarised in the 2021 NGO report, on 30 November 2020 NorthPole Bidco contributed all its shares in Goatilev and NorthPole Newco to Emerald LIE for USD 326,800,326.27 in exchange for 350,000,000 new preferred B shares, and Emerald LIE passed the same shares to Diamond LIE that day, inserting both companies between NorthPole Bidco and NorthPole Newco. NSO Group said Emerald and Diamond were created to grant stock options to management, directors and employees. Register summaries record Emerald and then Diamond as NorthPole Newco's shareholder from 15 and 17 December 2020, and a publication of 24 February 2023 records Dufresne Holding in Diamond's place; Israeli business reporting attributed that change to the lenders' exercise of their rights under the loan agreements.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-021", "src-006" ], "entity_ids": [ "northpole-bidco", "goatilev", "northpole-newco", "emerald", "diamond", "nso" ] }, { "id": "display-claim-76de67492bd59f3943cdf2e2", "kind": "analysis", "text": "On 5 February 2020 NorthPole Bidco acquired Goatilev Ltd., an Israeli shelf company that bought two Israeli companies in February and March 2020, according to NorthPole Bidco's accounts as quoted in the report. The report says Goatilev is reported to have bought Wayout, a company focused on router compromise and on intercepting data from Internet of Things devices; NSO Group confirmed that Wayout is an NSO Group company developing cyber security products for the IoT world for governmental use.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-021" ], "entity_ids": [ "northpole-bidco", "goatilev", "nso" ] }, { "id": "display-claim-07f006255c6656264fb788cb", "kind": "analysis", "text": "NorthPole Newco's 2024 accounts describe the financing. On 3 March 2019 its then sole shareholder entered into a credit agreement for a six-year term loan of up to USD 510,000,000 and a revolving facility of up to USD 30,000,000; under a joinder agreement of 8 April 2019 NorthPole Newco became the borrower and assumed the liability, a \"debt pushdown\". The term loan bore interest at the alternate base rate plus an initial margin of 7.00%.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-061" ], "entity_ids": [ "northpole-newco" ] }, { "id": "display-claim-d5bad1302366ff81427e3dc9", "kind": "analysis", "text": "In May 2021 Moody's, describing NorthPole Newco as the top entity of NSO Group's restricted group, downgraded it from B2 to B3, together with its $300 million and €176.96 million senior secured term loans maturing in March 2025 and its $30 million revolving facility maturing in March 2024, with a negative outlook; the announcement is retained as republished by a human-rights resource centre on 25 May 2021. NorthPole Newco's accounts later record a forbearance agreement with the lenders of 31 December 2021 after certain events of default.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-024", "src-061" ], "entity_ids": [ "northpole-newco", "nso" ] }, { "id": "display-claim-766cbb243d7de36967d8cb5d", "kind": "analysis", "text": "Israeli business reporting in March 2022 described the roughly $500 million of debt as owed entirely by NorthPole Newco, with estimated annual interest of $65 million. It reported that days after NSO's US blacklisting Moody's cut the rating to Caa2, that a senior source said NSO did not feel exposed because the Israeli company had given no surety for the loan, and that the lenders it was told of included three main groups, Credit Suisse and the US hedge funds Senator Investment and Birch Grove Capital, alongside BlackRock, Ellington and Jefferies. Birch Grove Capital said it was not commenting, and Credit Suisse and Senator declined to comment.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-115" ], "entity_ids": [ "northpole-newco", "nso", "novalpina", "credit-suisse", "senator", "birch-grove", "francisco" ] }, { "id": "display-claim-0c08818b2d2deb996672f4b1", "kind": "analysis", "text": "In July 2021 British press reported that public investors in the fund holding NSO's majority stake, led by the Oregon public pension fund, were in talks to hand the fund's management to the US consultancy Berkeley Research Group (BRG); Novalpina and NSO declined to comment and BRG did not immediately respond. According to the fund's general partner, the investors voted by 99% that month to remove Novalpina as general partner, and an English High Court judgment of 2025 records that Treo GP replaced Novalpina Capital Partners 1 GP Sarl on 27 August 2021. The European Parliament inquiry report, relying on press and NGO sources, says BRG then launched investigations into the lawfulness of NSO's activities and its compliance with the US blacklisting, and that NSO's management obstructed BRG's inquiries in May 2022.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-045", "src-097", "src-102", "src-066" ], "entity_ids": [ "noal", "brg", "novalpina", "oregon", "treo-gp", "novalpina-gp", "nso" ] }, { "id": "display-claim-5800aea3ddf9d3d629b0e53d", "kind": "analysis", "text": "Israeli business reporting in 2022 said that the limited partners, including Centerbridge Partners and the Oregon and Alaska pension funds, wanted a manager to prepare the assets for sale. It said BRG joined NSO's board in September 2021 and by the end of that year controlled the board of Triangle Holdings, where chairman Asher Levy, nominated by Novalpina, was replaced by BRG partner Finbarr O'Connor. Levy told the press in January 2022 that he had been appointed to represent Novalpina and was making way for BRG's appointee, that he had resigned when BRG took control in July 2021 and served out his term, and that his departure was unrelated to reports about NSO. A March 2023 report says BRG's control ended when the new controlling owner replaced the directors down the chain, including those appointed by BRG.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-115", "src-114", "src-117", "src-011" ], "entity_ids": [ "noal", "centerbridge", "oregon", "alaska", "brg", "triangle", "asher-levy", "oconnor", "nso", "novalpina" ] }, { "id": "display-claim-e070913b74850b63f27e23e8", "kind": "analysis", "text": "A notice published in Luxembourg's electronic register on 4 January 2023 lists Triangle's class A directors as Finbarr O'Connor and Howard Berkowitz, appointed on 4 October 2021 until the 2026 general meeting, and Gavin Farrell and Jeffrey Dunn, appointed on 14 January 2022 until the 2027 general meeting, all with an address care of a New York law firm. At NorthPole Newco, register summaries by a company-data aggregator record Tamara Makarenko as a manager from 22 December 2021, replacing Gaëtan Dumont and Allen Foley, until 4 January 2022, Anthony Levy from 24 December 2021, and Asher A. Bornstein and Makarenko from 29 December 2022, with Anthony Levy leaving on 20 January 2023. The UK Companies House record of Triangle as an overseas company (FC040779) lists eight active directors, each shown as appointed on 1 August 2023: Berkowitz, Dunn, Farrell and O'Connor with a New York correspondence address, Makarenko and James Ward, and NSO's founders Shalev Holy (Hulio) and Omri Lavie; Luxembourg notices give earlier appointment dates for some of them.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-073", "src-006", "src-124" ], "entity_ids": [ "triangle", "oconnor", "berkowitz", "farrell", "dunn", "northpole-newco", "makarenko", "bornstein", "anthony-levy", "dumont", "ward", "hulio", "lavie" ] }, { "id": "display-claim-09297a3f056433016dd92fde", "kind": "analysis", "text": "Citing press reports, the European Parliament inquiry report says NSO reportedly had revenues of about USD 243 million in 2020, but that the Pegasus Project revelations, the Apple and Meta lawsuits, the US blacklisting, the tightening of Israel's export regime, inquiries in several countries and frictions within the fund led to a severe decline in profit, and that its debt at one point reached 6.5 times its normal annual revenue; no NSO accounts were retained. In a 2025 petition to a New York federal court, the fund's general partner stated that in October 2021 NSO acknowledged its precarious position and asked for an immediate $10 million to meet payroll, and that a few days after the money was provided, on 3 November 2021, NSO was put on the US Entity List.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-066", "src-106" ], "entity_ids": [ "nso", "treo-gp", "noal" ] }, { "id": "display-claim-c4105d222030b6d1dd4de109", "kind": "analysis", "text": "In January 2022 Israeli business reporting said that, at the request of BRG as NSO's controlling shareholder, Judge Hagai Brenner of the Tel Aviv District Court appointed a lawyer as temporary trustee of the drone company Convexum, announced two years earlier as acquired by NSO for $60 million. The report said Convexum had in practice been controlled by Triangle, owned 70% by Novalpina and 30% by NSO's management and employees, and that BRG's court papers put NSO's debts at $460 million while NSO negotiated a sale to two US funds with bids of $1 billion to $1.2 billion. A year later the press reported that the proceedings ended with Convexum's separation from NSO, which NSO's management had opposed.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-114", "src-060" ], "entity_ids": [ "brg", "convexum", "nso", "triangle", "novalpina" ] }, { "id": "display-claim-312a827ef0eb869f3228bdf1", "kind": "analysis", "text": "According to court records described in Israeli business reporting in March 2022, the group around Shalev Hulio worked on selling NSO together with Convexum against BRG's position. One offer, from Integrity Partners, proposed injecting $300 million at a valuation of $1 billion to $1.5 billion, leaving the Hulio group with 30%, focusing sales on Western democracies and repaying debt by 2029. NSO Group called a January 2022 report of talks with Integrity Partners full of inaccuracies and half-truths but confirmed it was talking to US-based funds. No such sale took place, according to the later ownership record.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-115", "src-118" ], "entity_ids": [ "hulio", "nso", "convexum", "brg" ] }, { "id": "display-claim-f016335601096c6c61f7f807", "kind": "analysis", "text": "The same court documents show NSO's management declining to give BRG full financial information, saying that disclosure to a foreign investor required approval from the Israeli Defence Ministry's export control body because some of it was classified; the approval had reportedly not been received. In court papers reported in February 2022, BRG's lawyers said that since the Pegasus Project the only new potential Pegasus bookings came from \"elevated risk customers\", while lawyers for the lenders said BRG's approach had shut the company off from new customers and deepened its liquidity crisis. A source familiar with NSO said BRG wanted the company to shut down or stop some activities with customers, which NSO said its legal obligations did not allow unless customers misused the system. These are the parties' positions as reported by the press.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-115", "src-120" ], "entity_ids": [ "nso", "brg", "deca" ] }, { "id": "display-claim-7c9bfb25428bd6749016cb05", "kind": "analysis", "text": "In January 2023 Q Cyber Technologies itself sued BRG, the parent companies, the syndicate of lenders and the founders Hulio and Lavie in the Tel Aviv District Court. As Israeli business reporting described its claim, it asked the court to declare who its board of directors was, whether the appointments of Tamara Makarenko and Asher Alan Bornstein by BRG were valid, and whether a board decision of 29 December 2022 requiring it to hand over information and documents was valid, and sought urgent interim relief preserving the position before the new directors were appointed. Q Cyber said that it and its management took no position on the merits of the defendants' dispute but faced serious consequences if they complied with decisions later found unlawful. The case number is not given in the retained documents. In February 2023 a notice filed in the proceeding told the court that the lenders had exercised their rights under the loan agreements, and according to a March 2023 report the new controlling owner then replaced the directors down the chain, including those appointed by BRG. No ruling on Q Cyber's claim is recorded in the retained documents.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-060", "src-011" ], "entity_ids": [ "qcyber", "brg", "hulio", "lavie", "makarenko", "bornstein", "shohat" ] }, { "id": "display-claim-30546f1e216270d6973ef5f3", "kind": "analysis", "text": "According to Q Cyber's claim as reported, a Luxembourg court ruled in December 2022, in a dispute among Novalpina's directors, that acts of directors appointed by Novalpina between August and December 2021 were void, after which BRG moved to appoint Makarenko and Bornstein to the group companies. On 16 December 2022 the minority shareholders Hulio and Lavie wrote that the new directors' decisions were invalid, and on 29 December the lenders, who had lent the group about half a billion dollars, also questioned their legitimacy. The new directors held the board meeting on 29 December regardless and demanded commercially sensitive documents; Makarenko declined to produce the decision appointing her and relied on an opinion of English counsel. The Luxembourg ruling itself was not retained.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-060" ], "entity_ids": [ "qcyber", "novalpina", "brg", "makarenko", "bornstein", "hulio", "lavie" ] }, { "id": "display-claim-1bda0cc3618da1c4cfd67b32", "kind": "analysis", "text": "On 22 January 2023 some respondents, including the fund's side and the directors it appointed, asked the court to reject the interim request, alleging bad faith. As reported the next day, they argued that Hulio, although he had formally resigned as chief executive in August 2022 and left the board, remained extensively involved in decisions through the current chief executive Yaron Shohat; that because management concealed its actions the company might be selling its products, which they called offensive cyber weapons, to problematic or high-risk customers; and that Hulio had attended the disputed board meeting without protest and voted. These were allegations in court papers, not findings of the court. NSO's response was: \"Our request for declaratory relief is our response.\"", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-048" ], "entity_ids": [ "qcyber", "hulio", "shohat", "nso", "novalpina" ] }, { "id": "display-claim-777052c978041dbbc3051659", "kind": "analysis", "text": "According to the European Parliament report, on 25 April 2022 two of Novalpina's former general partners sued BRG in Luxembourg for Novalpina's reinstatement as general partner and the suspension of BRG's decisions; the court dismissed the demands and BRG remained in charge of the fund. The fund's general partner said in a November 2022 press release that on 6 May 2022 the fund and its vehicles had filed a criminal complaint with civil-party joinder against Stefan Kowski, Bastian Lueken and Gerhard Schmidt for abuse of powers, under investigation by an investigating judge, and that a Luxembourg judge had rejected Novalpina's expedited attempt to confirm a veto right. The complaint is an allegation; no response from Kowski, Lueken or Schmidt and no outcome of the investigation is recorded in the retained documents.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-066", "src-097" ], "entity_ids": [ "novalpina", "brg", "noal", "treo-gp", "kowski", "lueken", "schmidt" ] }, { "id": "display-claim-7a0a929d7a03918d6bf437dd", "kind": "analysis", "text": "In a March 2025 petition in the Southern District of New York (1:25-mc-00133), the general partner TREO NOAL GP said the fund's investment in NSO is the subject of proceedings in the Commercial Court of England and Wales against Novalpina's founders, claiming damages for conspiracy among other things, and sought discovery from the law firm Weil, Gotshal & Manges for use in Luxembourg; the defendants filed defences to the English claim in January 2025, according to the petition's exhibit list. US legal press reported in 2025 that the fund's 2021 difficulties and its founders' falling-out were being litigated in Luxembourg. The claims are unadjudicated in the retained records.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-105", "src-106" ], "entity_ids": [ "treo-gp", "noal", "kowski", "lueken", "peel", "weil" ] }, { "id": "display-claim-3b7757d86077c36d3d5b8bc9", "kind": "analysis", "text": "US legal press reported in October 2025, citing British business press and court documents, that Weil Gotshal partner Gerhard Schmidt invested €5 million in Novalpina Capital in 2017 without the usual fees and chaired it, advised Novalpina on the NSO deal and sat on the board of the holding company overseeing NSO. According to a party's court filing he \"would have been voting\" when NSO's oversight board moved to renew Saudi Arabia's access to Pegasus after the murder of Jamal Khashoggi, access that two unnamed people familiar with the matter said was restored by mid-2019. In April 2019 a coalition of NGOs had questioned the independence of Schmidt, reportedly non-executive chairman of Novalpina Capital Group, as part of Novalpina's legal compliance team. NSO said it complies fully with all applicable laws and sells only to vetted intelligence and law enforcement agencies; no response from Schmidt or his firm is recorded in the retained documents.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-105", "src-108" ], "entity_ids": [ "schmidt", "novalpina", "novalpina-group", "triangle", "nso", "weil" ] }, { "id": "display-claim-417c99652ea13f6e94945183", "kind": "analysis", "text": "Israeli business reporting on 1 March 2023 said that the lenders, who had lent about half a billion dollars for the buyback from Francisco Partners, had exercised their rights under the loan agreements. The shares of NSO's Luxembourg parent NorthPole, until then held by a holding company called Diamond and pledged to the lenders, were transferred directly to Dufresne Holdings, created in Luxembourg in January 2023; according to the register as of 10 February, Dufresne had one shareholder and one director, Omri Lavie, and the new controlling owner replaced the directors throughout the chain, including BRG's, pending the entry of new investors. The report, based on a notice filed in Q Cyber's Tel Aviv proceedings and on the Luxembourg register, called OSY NSO's Israeli parent, whereas the Israeli parent is Q Cyber. NSO did not respond. A spokesperson for TREO NOAL GP, general partner of the NOAL fund, which held the majority equity in NSO, said the lenders, who had exercised effective control over NSO for 15 months, had seemingly organised a foreclosure after NSO failed to meet its financial obligations since 2021, that the fund had been denied basic corporate information, including on compliance with US law and sales to elevated-risk customers, and that its investment had been and remained valueless.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-011" ], "entity_ids": [ "northpole-newco", "diamond", "dufresne", "lavie", "brg", "nso", "osy", "treo-gp", "noal" ] }, { "id": "display-claim-ecfb8b699283fba86235be59", "kind": "analysis", "text": "The company records fill in the dates. Register summaries by a company-data aggregator, whose dates are those of the register publications, record that Dufresne Holding S.à r.l. (B275054) was registered on 27 January 2023 with capital of €12,000, Lavie as manager and one shareholder, Lavie being listed as partner in 2023 and 2024, and that a publication of 24 February 2023 records it in place of Diamond LIE as NorthPole Newco's shareholder. NorthPole Newco's 2024 accounts record that on 17 February 2023 all shares held by its new shareholder were pledged to Wilmington Trust (London) Limited as collateral agent, and that after the \"appropriation\" the lenders agreed on 16 March 2023 to the change of control of the company and its subsidiaries and extended a super-priority loan of USD 5,000,000. The accounts list Lavie as a manager from 17 February 2023 and Anthony Levy from 15 March 2023, with the same two managers at OSY; an aggregator page for Lavie lists him as a manager of OSY and of Q Cyber Technologies S.à r.l. in publications of 23 February 2023 and of NorthPole Newco in one of 24 February 2023, with Anthony Levy beside him from March 2023 and both still listed in August 2024. A publication of 17 August 2026 again lists Lavie as Dufresne's manager and member of its executive board, with one shareholder.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-007", "src-006", "src-018", "src-035", "src-061", "src-062" ], "entity_ids": [ "dufresne", "lavie", "northpole-newco", "diamond", "simonds", "wilmington", "anthony-levy", "osy", "qcyber-lux" ] }, { "id": "display-claim-c84a4b996af0c169681c2813", "kind": "analysis", "text": "A press account of August 2023 named the creditors who had taken the shares and moved them to Lavie's holding company as including Credit Suisse, Senator Investment Group and Birch Grove Capital, and said the company still carried about half a billion dollars of debt from the Francisco Partners buyback.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-091" ], "entity_ids": [ "dufresne", "nso", "lavie", "credit-suisse", "senator", "birch-grove", "francisco" ] }, { "id": "display-claim-04325b7bcb4c3bfae429b07d", "kind": "analysis", "text": "According to Israeli business reporting, the Hollywood producer Robert Simonds, founder of STX Entertainment, joined the holding company's board shortly after the transfer, at the lenders' initiative to raise financing, and tried to acquire NSO in June 2023; an aggregator's summary of the register lists his appointment as a Dufresne manager in a publication of 16 March 2023 and his departure in one of 17 August 2023. He left the board in August 2023 after five months, when the acquisition attempt had failed. The August 2023 report suggested he may have been forced out for lack of Israeli Defence Ministry approval, possibly because of business ties to China; that reason is the publication's speculation, not a recorded decision of the ministry.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-013", "src-091", "src-007", "src-006", "src-018", "src-035" ], "entity_ids": [ "simonds", "dufresne", "nso", "stx", "lavie", "northpole-newco", "diamond" ] }, { "id": "display-claim-e50c0b0b7ca91aaecd3c2265", "kind": "analysis", "text": "On 10 October 2025 NSO spokesperson Oded Hershowitz told a US technology publication that \"an American investment group has invested tens of millions of dollars in the company and has acquired controlling ownership\", and that the headquarters and core operations remained in Israel under Israeli supervision, including the Ministry of Defense. He declined to name the investors or the amount and, according to the publication, later declared his comments off the record; Lavie did not immediately comment, and neither Simonds nor STX Entertainment responded. Israeli business reporting the same day said the group was led by Simonds, that the deal was valued at several tens of millions of dollars and expected to include the divestment of NSO's roughly $500 million debt, that completion required approval from the Defence Ministry's export control agency, and that Lavie's involvement would end. Luxembourg register notices record that on 8 October 2025 Dufresne Holding transferred all of NorthPole Newco's shares to Ohad Shazar Shalem Schremer, who replaced Lavie as its manager; the retained documents do not name the investors or record the agency's decision.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-012", "src-013", "src-035" ], "entity_ids": [ "nso", "simonds", "lavie", "deca" ] }, { "id": "display-claim-015b7c2f6030a7fb6e3d4f5c", "kind": "analysis", "text": "Israeli press reported in November 2025 that the group led by Simonds had bought a controlling stake in October and that NSO's founders, Niv Karmi, Shalev Hulio and Omri Lavie, were no longer shareholders; the investors other than Simonds were not named. Israeli business reporting the same month said the change of control took place through the purchase of the company's debt by a new group whose members were not published, leading to Lavie's removal and the appointment of David M. Friedman (below), and that Luxembourg filings of late October and early November named Schremer, a lawyer, as a director of NorthPole Newco, OSY Technologies and Q Cyber Technologies S.à r.l. The debt purchase itself does not appear in the retained register notices.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-027", "src-050" ], "entity_ids": [ "nso", "simonds", "karmi", "hulio", "lavie", "friedman", "schremer", "northpole-newco", "osy", "qcyber-lux" ] }, { "id": "display-claim-2536bd3388c0233c8f7c4f66", "kind": "analysis", "text": "According to his witness biography published by the US House of Representatives, former US ambassador to Israel David M. Friedman was appointed on 10 November 2025 executive chairman of the Luxembourg holding company that owns NSO Group and of a Delaware subsidiary; the biography does not name the companies, and a register notice published on 30 December 2025 records his appointment as a manager of OSY Technologies from 15 December 2025. In an interview reported in November 2025, Friedman said he would make the case to the Trump administration that NSO's technology could help make Americans safer and would seek to sell its products to US law enforcement agencies, that \"the NSO of today is a far more careful company in how it licenses its technology than it was five six years ago\", and that \"this change of control and ownership brings with it sufficient capital to maintain the business\".", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-016", "src-037", "src-027" ], "entity_ids": [ "friedman", "osy", "nso" ] }, { "id": "display-claim-cc72b40942d9d1727321679a", "kind": "analysis", "text": "NSO Group's transparency report for 2025 says the group entered a new phase in 2025 following a change in ownership and Friedman's appointment as executive chairman of its holding company, without naming the new owners. Press in January 2026 reported that chief executive Yaron Shohat had also stepped down and that Lavie, the last founder still involved, had left.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-084", "src-080" ], "entity_ids": [ "nso", "friedman", "shohat", "lavie" ] }, { "id": "display-claim-aed3196ea1ac2a640572305a", "kind": "analysis", "text": "A notice published on 7 November 2025 records that, by decisions of NorthPole Newco's sole shareholder of 8 October 2025, Lavie resigned as manager and Schremer was appointed for an indefinite term, and that on 8 October Dufresne Holding (B275054) transferred all of its shares in NorthPole Newco, 100% of the capital, to Schremer, who became sole shareholder. Notices published on 28 and 30 October 2025 record Schremer as a manager of Q Cyber Technologies S.à r.l. and of OSY Technologies from 8 October 2025 and Lavie's removal from both boards, with Anthony Michael Levy remaining a manager of each; at Q Cyber Technologies S.à r.l. Levy is also delegate for day-to-day management since 5 June 2023, and Levy's OSY mandate was renewed.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-035", "src-043", "src-038" ], "entity_ids": [ "northpole-newco", "lavie", "schremer", "dufresne", "qcyber-lux", "anthony-levy", "osy" ] }, { "id": "display-claim-ee4d26ba5d646ed766c87c97", "kind": "analysis", "text": "A notice published on 22 December 2025 records that on 8 December 2025, by realisation of a pledge followed by a private sale, all of NorthPole Newco's shares held by Schremer, four classes representing 100% of the capital, were transferred to Hippocrene Ventures LLC, a Delaware limited liability company registered under number 10338240, which became sole shareholder; the notice does not name the pledgee. A notice published on 26 February 2026 records that under a share purchase agreement of 30 December 2025 Hippocrene Ventures sold all of NorthPole Newco's shares (559,737,894 class A and 558,376,950 each of classes B, C and D) back to Schremer, who became sole shareholder with effect from that date.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-034", "src-033" ], "entity_ids": [ "northpole-newco", "schremer", "hippocrene" ] }, { "id": "display-claim-ed0e2466416d056ade0a9031", "kind": "analysis", "text": "Luxembourg business press reported in April 2026 that Lavie had been removed as a director of three key Luxembourg entities within ten days, Q Cyber Technologies on 28 October 2025, OSY Technologies on 30 October and NorthPole Newco on 7 November; those are the publication dates of the notices, which give 8 October 2025 as the effective date. It added that on 30 December 2025 Hippocrene Ventures transferred NorthPole Newco's entire capital to an individual, and that on 26 February 2026 NorthPole Newco recorded a further change in shareholding and in its legal form; an aggregator summary of the register shows a change of shareholders on that date. The notice published on 26 February 2026 is the one recording the 30 December sale; no retained document shows a later owner or the change of legal form.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-015", "src-006" ], "entity_ids": [ "lavie", "qcyber-lux", "osy", "northpole-newco", "hippocrene", "schremer" ] }, { "id": "display-claim-3f762844e0051627e7210f75", "kind": "analysis", "text": "Q Cyber Technologies S.à r.l. is a separate company from the Israeli Q Cyber Technologies Ltd. According to Luxembourg register publications summarised by a company-data aggregator, it was registered on 8 January 2016 (register number B203124) with capital of €12,500, OSY Technologies as shareholder and Eran Gorev, Yuval Somekh and K. Wilson as managers. A publication of May 2019 lists its legal form as société à responsabilité limitée and its name as Q Cyber Technologies; on 20 August 2019 Charline de Maigret and \"Shalev Holy\", the spelling under which Shalev Hulio appears in Luxembourg and UK records, became managers while Gorev and Kevin Wilson left, and Somekh was again listed as a manager on 10 September 2019. Aggregator summaries also list under OSY a word mark \"Q Cyber Technologies\" (16 May 2017) and a word-figurative mark \"Q\" (20 October 2016), together with OSY's shareholding in Q Cyber Technologies; the trade mark registers themselves were not retained.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-010", "src-005" ], "entity_ids": [ "qcyber-lux", "osy", "gorev", "somekh", "kevin-wilson", "de-maigret", "hulio" ] }, { "id": "display-claim-3270c59c53a728cbd86162e3", "kind": "analysis", "text": "NSO Group told the authors of a 2021 NGO report that the Luxembourg company acts as commercial distributor for the group companies' products: it signs contracts, issues invoices and receives payments from group customers, which form the basis of its reported income, but it does not export group products and has not sought an export licence in Luxembourg. The report, quoting the company's accounts, gives its net turnover from the sale and distribution of computer equipment and services as USD 24,738,462 in 2016, USD 82,651,201 in 2017, USD 169,214,909 in 2018 and USD 229,839,361 in 2019. Luxembourg business press reported in August 2022, based on financial filings, that NSO had booked most of its sales over the previous two years in Luxembourg; only the article's headline and summary were retained.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-021", "src-029" ], "entity_ids": [ "qcyber-lux", "nso" ] }, { "id": "display-claim-88857501e1b04e1384d67092", "kind": "analysis", "text": "Rounded figures summarised by a Luxembourg company-data site from Q Cyber Technologies S.à r.l.'s filed accounts show net income of $9.28 million for 2022, $10.1 million for 2023, $7.98 million for 2024 and $7.66 million for 2025, with equity falling from $27.3 million in 2022 to $10.4 million in 2023 and $4.89 million in 2024 before rising to $6.04 million in 2025. OSY's 2024 accounts record dividends from Q Cyber Technologies S.à r.l. of USD 13,500,000 in 2024 and USD 27,000,000 in 2023, which Luxembourg press reported together as $40.5 million, and a short-term loan owed by OSY to the Luxembourg Q Cyber with a principal of USD 163,680,016 at the end of 2024 (USD 197,840,966 a year earlier), drawable up to USD 300,000,000 and extended in June 2023 to 30 June 2025.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-042", "src-062" ], "entity_ids": [ "qcyber-lux", "osy" ] }, { "id": "display-claim-92ef3f52ec43fa4e5d6d12a2", "kind": "analysis", "text": "According to a company-data aggregator's summary of the Luxembourg register, OSY Technologies S.à r.l. is registered under number B184226 (European unique identifier LURCSL.B184226) with LEI 222100KKW3GGPGATJ296, at 44 rue de la Vallée, L-2661 Luxembourg, under NACE code 64.99, other financial service activities; the register number also appears in Q Cyber's own Israeli filings and in OSY's accounts. Register publications listed by the same aggregator, dated by publication rather than by decision, record Asher Levy as a manager from 17 September 2020 until 4 January 2022; the departures of Gerhard Schmidt on 25 August 2021, Stephen Peel on 13 September 2021, Mickael Betito and Stefan Kowski on 20 September 2021 and Yuval Somekh on 4 November 2021; Anthony Levy from 7 December 2021; Omri Lavie from 23 February 2023, when five managers left, joined by Anthony Levy on 17 March 2023; a notice of 30 October 2025 removing Lavie's entry as manager and naming Anthony Michael Levy as manager; and David M. Friedman as manager and member of the executive board in a notice of 30 December 2025.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-005" ], "entity_ids": [ "osy", "asher-levy", "schmidt", "peel", "kowski", "somekh", "anthony-levy", "lavie", "friedman" ] }, { "id": "display-claim-a16b83fb71194e44f5b157a7", "kind": "analysis", "text": "OSY's 2024 accounts show negative equity of USD 272,166,845 and a 2024 loss of USD 2,809,165; a term loan of USD 114,548,695 owed to NorthPole Newco, originally a USD 258,549,810 on-loan of the term-loan proceeds made on 18 March 2019; and four full-time-equivalent staff. They omit details of companies in which OSY holds at least 20% as \"seriously prejudicial\" to them, while putting the fair market value of its subsidiaries at USD 842,000,000 under an internal valuation of November 2020. A company-data site summarising the filed accounts shows rounded net income of $3.9 million for 2021, -$9.39 million for 2022, $7.4 million for 2023 and -$2.81 million for 2024, with equity between -$267 million and -$277 million each year.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-061", "src-062", "src-036" ], "entity_ids": [ "osy", "northpole-newco" ] }, { "id": "display-claim-10f05a3084f309220883869b", "kind": "analysis", "text": "The same accounts record a USD 94,000,000 promissory note at 4% issued on 1 December 2014 by IOTA Holdings to its former shareholder in connection with the acquisition of IOTA's subsidiaries, which OSY paid to IOTA's former shareholder in 2015, acquiring the former shareholder's rights under the note, so that OSY carries it as a loan to IOTA (principal USD 116,063,116 at the end of 2024); a revolving credit facility of up to USD 2,000,000 at 3% to Gideon Cyber Systems LLC under an agreement of 31 January 2022 effective from 31 August 2021 (principal USD 1,802,000), listed among other debtors rather than affiliated undertakings and without any description of Gideon's business; and a facility to Westbridge Technologies, Inc. with a principal of USD 1,589,854. They also record pledges to Wilmington Trust (London) Limited over OSY's interests in Westbridge (8 April 2019, New York law), over OSY itself granted by NorthPole Newco (8 April 2019), over the shares OSY holds in an unnamed affiliated undertaking (17 May 2022, Israeli law) and over its shares in Iota Holdings (17 May 2022, Cypriot law); the Israeli-law pledge does not name the company, but Q Cyber Technologies Ltd is the Israeli company that OSY is recorded as owning. NorthPole Newco's accounts add a first-ranking pledge of all OSY shares to Wilmington Trust as collateral agent under an agreement of 14 March 2019.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-062", "src-061" ], "entity_ids": [ "osy", "iota", "gideon", "westbridge", "wilmington", "northpole-newco" ] }, { "id": "display-claim-215a13cba3ecfcba666774a9", "kind": "analysis", "text": "NorthPole Newco's 2024 accounts, filed on 29 July 2025, show amounts owed to credit institutions of USD 713,118,477 (USD 638,678,345 a year earlier) within total creditors of USD 746,156,153, a 2024 loss of USD 79,516,731.27 carried to an accumulated deficit of USD 322,449,975.86, term-loan principal of USD 440,073,128 with accrued interest of USD 177,532,472, and its 100% holding in OSY at a book value of USD 550,885,976 against an internal November 2020 valuation of USD 873,963,000. They record a forbearance agreement of 31 December 2021 among Westbridge and NorthPole Newco as borrowers, the lenders and Wilmington Trust as collateral agent, under which the lenders agreed not to enforce after certain events of default; the borrowers agreed a forbearance fee of USD 23,823,127, and in January 2022 NorthPole Newco paid USD 924,303 to end a currency swap with Jefferies Structured Credit LLC.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-061" ], "entity_ids": [ "northpole-newco", "osy", "westbridge", "wilmington", "jefferies" ] }, { "id": "display-claim-3aaab839705f615ac5b56126", "kind": "analysis", "text": "A Luxembourg company-data site summarising NorthPole Newco's accounts shows net losses of $45.6 million for 2021, $37 million for 2022, $86.8 million for 2023 and $79.5 million for 2024, with equity falling from $208 million in 2021 to $4.35 million in 2024. Luxembourg press in April 2026 described the 2024 accounts as showing bank debt of $713 million at NorthPole Newco and negative equity at OSY, which it gave as €272 million; OSY's accounts state USD 272,166,845.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-032", "src-015" ], "entity_ids": [ "northpole-newco", "osy" ] }, { "id": "display-claim-3d2f7383ca895abcb4338d14", "kind": "analysis", "text": "Triangle Holdings and Square 2 stood above OSY in the holding chain. According to the 2021 NGO report, which states the chain from Luxembourg register publications, after transactions in April 2019 Triangle owned 31.4% of Square 2 and NorthPole Holdco 68.6%, and Square 2 owned NorthPole Bidco, which owned NorthPole Newco, which owned OSY Technologies, the owner of both Q Cyber companies; the earlier and later steps are traced on the 2014 and 2019 pages.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-021" ], "entity_ids": [ "triangle", "square2", "northpole-holdco", "northpole-bidco", "northpole-newco", "osy", "iota", "qcyber-lux", "qcyber", "westbridge", "novalpina" ] }, { "id": "display-claim-b91207553beb5a4e8bd21802", "kind": "analysis", "text": "Triangle Holdings SA is registered in Luxembourg under number B192115 with LEI 54930042RZ0X284GK323, as a holding company, according to aggregator summaries; a register notice records that its registered office moved on 4 July 2023 from 2 rue Edward Steichen to 15 boulevard Friedrich Wilhelm Raiffeisen, the address company-data sites still gave in October 2026. A company-data site summarising its accounts shows equity of $273 million for 2019 and 2020 and negative equity of $4.32 million for 2022, with a 2022 net loss of $4.57 million.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-074", "src-072", "src-017" ], "entity_ids": [ "triangle" ] }, { "id": "display-claim-6f89f75f023cd3b6f5540f68", "kind": "analysis", "text": "UK branch registrations of Triangle Holdings and Square 2, as summarised by a company-data aggregator, record petitions to wind up on 2 May 2024, without naming the petitioner. Winding-up orders followed on 30 May 2024 and liquidators were appointed in June 2024; progress reports in a winding up by the court were published in 2025 and 2026. These concern the UK establishments of the two Luxembourg companies, which continued to file accounts in Luxembourg, Square 2 most recently for 2023 in October 2026.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-017", "src-095" ], "entity_ids": [ "triangle", "square2" ] }, { "id": "display-claim-97f199435153ebd6c72c5959", "kind": "analysis", "text": "Luxembourg press reported in April 2026 that at least seven NSO-affiliated entities remained active or had recently been active in the register, all at 44 rue de la Vallée: Dufresne Holding (B275054), NorthPole Newco (B230411), OSY Technologies (B184226), the Luxembourg Q Cyber Technologies, NorthPole Bidco, Triangle Holdings (B192115) and Square 2. Triangle's own register notice of July 2023 gives a different registered office.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-015" ], "entity_ids": [ "dufresne", "northpole-newco", "osy", "qcyber-lux", "northpole-bidco", "triangle", "square2", "nso" ] }, { "id": "display-claim-b9cd0914c813d828bcf66aee", "kind": "analysis", "text": "On 29 October 2019 WhatsApp Inc. and Facebook, Inc. sued NSO Group Technologies Ltd. and Q Cyber Technologies Ltd. in the US District Court for the Northern District of California, alleging that between about April and May 2019 the defendants used WhatsApp servers in the United States and elsewhere to send malware to approximately 1,400 mobile phones, whose users, according to the complaint, included attorneys, journalists, human rights activists, political dissidents, diplomats and senior foreign government officials. Relying on Israeli register records, the complaint described Q Cyber as NSO's sole active director and majority shareholder and OSY Technologies as Q Cyber's sole shareholder and director. The defendants argued that they were entitled to immunity because they acted for foreign governments, that Pegasus was marketed only to and used only by sovereign governments, and that their role was limited to advice and technical support in setting up, not operating, the technology; the district court and, in November 2021, the Ninth Circuit rejected the immunity defence. The court later granted partial summary judgment on liability, the jury's punitive award of May 2025 was remitted to $4,002,471 in October 2025, a permanent injunction and final judgment followed on 12 November 2025, and the defendants appealed; each step is described below.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-004", "src-030", "src-026", "src-057", "src-056" ], "entity_ids": [ "whatsapp", "facebook", "nso", "qcyber", "osy" ] }, { "id": "display-claim-508adf2392f9a1f0727202c9", "kind": "analysis", "text": "The early procedure was about service and jurisdiction. The clerk entered default against both companies on 2 March 2020, but on 25 March Judge Phyllis J. Hamilton partly granted their motion to set it aside and denied the plaintiffs' request for alternative service; the defendants' filings in March and April 2020 included declarations of Shalev Hulio. On 2 April 2020 the two companies moved to dismiss under Rules 12(b)(1), (2), (6) and (7), and in May 2020 their certificate of interested entities named NSO Group Technologies Limited and OSY Technologies SARL as corporate parents; the US Department of Justice filed sealed exhibits and a declaration of a DOJ attorney in connection with WhatsApp's motion to disqualify defence counsel.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-030" ], "entity_ids": [ "nso", "qcyber", "whatsapp", "facebook", "hulio", "osy" ] }, { "id": "display-claim-821caf002e4b84240e77ec0e", "kind": "analysis", "text": "On 8 November 2021 the Ninth Circuit (No. 20-16408) affirmed the district court's denial of the motion to dismiss on grounds of foreign sovereign immunity. The opinion recorded NSO's own assertion, not a finding, that its customers include the Kingdom of Bahrain, the United Arab Emirates and Mexico and that its product is used only by sovereign governments. NSO Group Technologies and its co-petitioners asked the US Supreme Court to review the decision (No. 21-1338, petition filed 6 April 2022); the Court invited the Solicitor General to express the views of the United States and denied the petition on 9 January 2023.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-026", "src-052" ], "entity_ids": [ "nso", "qcyber", "whatsapp", "facebook", "bahrain", "uae", "mexico" ] }, { "id": "display-claim-d7bc46e684072edbe5cf2470", "kind": "analysis", "text": "According to the district court's order of 17 October 2025, the court had granted partial summary judgment for the plaintiffs on liability under the Computer Fraud and Abuse Act, California's Comprehensive Computer Data Access and Fraud Act and for breach of contract; the evidence showed that the defendants reverse-engineered WhatsApp's code to build a modified client application and used it to install their software on target users' devices through WhatsApp's servers. Among the declarations filed for the defendants were those of Yifa Idisis, attached to an opposition of 20 March 2025, and of NSO's chief executive Yaron Shohat, whose testimony the court cited; Q Cyber's annual report to the Israeli Registrar updated to 7 January 2019 names Yifa Idisis as its financial director, and NSO's report of the same date names a financial director called Idisis. During the case the third parties Westbridge Technologies, Josh Shaner and Terrence DiVittorio also filed a motion for clarification, which WhatsApp and Meta opposed; only the docket description of that motion was retained, so its content is not known.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-057", "src-085", "src-004", "src-056" ], "entity_ids": [ "nso", "qcyber", "whatsapp", "idisis", "shohat", "osy", "westbridge", "divittorio", "facebook" ] }, { "id": "display-claim-caf9e0e273d3e498cab4e023", "kind": "analysis", "text": "On 6 May 2025 a jury unanimously awarded WhatsApp and Meta the full $444,719 in compensatory damages they sought, found that the defendants acted with malice, oppression or fraud, and awarded $167,254,000 in punitive damages; NSO Group Technologies and Q Cyber Technologies moved for a new trial on 29 May 2025. In its order of 17 October 2025 the court held that the punitive award could not exceed a 9:1 ratio and remitted it to $4,002,471, granting the defendants' motion to that extent, and WhatsApp and Meta accepted the remittitur on 31 October 2025.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-056", "src-057" ], "entity_ids": [ "nso", "qcyber", "whatsapp", "facebook" ] }, { "id": "display-claim-be0bf30af8526339432d1ca1", "kind": "analysis", "text": "The same order found that the defendants' conduct caused irreparable harm and that there was no dispute it was ongoing, citing Shohat's August 2024 testimony, and granted a permanent injunction; it directed the plaintiffs to exclude the defendants' sovereign government customers, which were not parties, from its scope, without naming them. The injunction and the final judgment were entered on 12 November 2025.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-056", "src-057" ], "entity_ids": [ "nso", "qcyber", "whatsapp", "shohat" ] }, { "id": "display-claim-507681b3a70beea1bc1d065f", "kind": "analysis", "text": "In their response and objection to the plaintiffs' proposed injunction order, filed on 4 November 2025, NSO Group Technologies and Q Cyber Technologies argued that it was reasonably foreseeable that a US law enforcement or intelligence agency would use Pegasus and that an injunction limiting its use could hinder government operations in a crisis; a footnote stated that in 2018 the FBI licensed the use of Pegasus and the CIA helped Djibouti obtain a Pegasus licence, citing a sealed exhibit (Dkt. 616-2). These are statements of the defendants in court papers.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-081", "src-077", "src-085" ], "entity_ids": [ "nso", "qcyber", "fbi", "djibouti" ] }, { "id": "display-claim-e6d5b8e30b3beb4deb7f6ce1", "kind": "analysis", "text": "NSO Group Technologies and Q Cyber Technologies appealed to the Ninth Circuit on 19 November 2025 (No. 25-7380) and moved to stay the injunction. Judge Hamilton denied a stay on 19 December 2025 while extending an administrative stay by 45 days, and the Ninth Circuit denied a stay on 28 January 2026. On 30 January 2026 the court granted the plaintiffs' motion for attorney's fees, which the defendants appealed on 11 February 2026 (No. 26-874); the district court case was terminated on 2 February 2026. The retained records do not show the outcome of the appeals.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-031", "src-030", "src-056" ], "entity_ids": [ "nso", "qcyber", "whatsapp" ] }, { "id": "display-claim-6b0c999327c21d57063f4cc6", "kind": "analysis", "text": "After judgment, Meta Platforms and WhatsApp pursued discovery in aid of enforcement and on 8 June 2026 moved to hold the defendants in contempt; on 16 October 2026 Judge Hamilton denied the contempt motion and issued an order on post-judgment discovery disputes.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-031" ], "entity_ids": [ "whatsapp", "nso", "qcyber", "facebook" ] }, { "id": "display-claim-2b2183867ad00ce25a37e33a", "kind": "analysis", "text": "Apple Inc. sued NSO Group Technologies Limited and Q Cyber Technologies Limited in the Northern District of California on 23 November 2021 (3:21-cv-09078, Judge James Donato). In a certificate of interested entities filed in February 2022 the defendants named OSY Technologies as their corporate parent, and on 3 March 2022 they moved to dismiss. The case was stayed in 2022 pending the Supreme Court's decision on NSO's petition in the WhatsApp case, and a later order of the same court records that it rejected NSO's forum non conveniens challenge in January 2024. On 13 September 2024 Apple moved to dismiss its own suit voluntarily; the defendants responded, and on 12 November 2024 Judge Donato issued an order on the voluntary dismissal and sealing, terminating the case. The terms of that order are not described in the retained docket entries.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-046", "src-047", "src-053" ], "entity_ids": [ "apple", "nso", "qcyber", "osy" ] }, { "id": "display-claim-ae9709f71a5bed7f37a8dd78", "kind": "analysis", "text": "Journalists of the Salvadoran digital newspaper El Faro sued NSO Group Technologies and Q Cyber Technologies in the same court on 30 November 2022 (Dada v. NSO Group Technologies Limited, 3:22-cv-07513, Judge Donato), alleging that Pegasus was used against their iPhones; an amended complaint followed in December 2022 and the case was related to Apple's. The defendants' motion to dismiss of April 2023 was supported by declarations of Roy Blecher and NSO's chief executive Yaron Shohat. On 8 March 2024 Judge Donato dismissed the suit on the ground of forum non conveniens, accepting NSO's argument that the case involved foreign plaintiffs, foreign defendants and foreign conduct, and noting the complaint's statement that virtually all of the attacks occurred in El Salvador in connection with news stories the plaintiffs were covering there.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-046", "src-049", "src-054", "src-053" ], "entity_ids": [ "dada", "nso", "qcyber", "shohat", "apple" ] }, { "id": "display-claim-8566289adb61c57c97b13881", "kind": "analysis", "text": "On appeal (Nos. 24-2179 and 24-3463), the Ninth Circuit in an unpublished memorandum of 8 July 2025, with Judge Bade dissenting, vacated that dismissal and remanded, describing Pegasus, as the plaintiffs alleged, as a spyware system developed and deployed by NSO Group Technologies and Q Cyber Technologies, both incorporated in Israel. After remand the defendants renewed their motion to dismiss in September 2025, and on 30 September 2026 Judge Donato granted it for lack of personal jurisdiction, dismissed the complaint without prejudice, refused further leave to amend and entered judgment against the plaintiffs. The order describes the claims as NSO supplying spyware to an unnamed government outside the United States to access the Apple iPhones of plaintiffs working for a newspaper in El Salvador; the court did not identify the government, and NSO stated in a declaration that all its employees with relevant knowledge reside in Israel.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-054", "src-047", "src-055", "src-067" ], "entity_ids": [ "dada", "nso", "qcyber", "shohat" ] }, { "id": "display-claim-ee549b2c0f2bf78daae92444", "kind": "analysis", "text": "On 15 June 2023 Hanan Elatr Khashoggi, the widow of the journalist Jamal Khashoggi, filed a seven-count complaint in the Eastern District of Virginia (1:23-cv-779) against NSO Group Technologies Limited and Q Cyber Technologies Limited, alleging that their spyware was used by agents of Saudi Arabia and the United Arab Emirates to obtain information from two of her phones that was used in the surveillance and assassination of her husband; these allegations are hers. On 26 October 2023 Judge Leonie M. Brinkema granted the defendants' motion to dismiss with prejudice, deciding only the jurisdictional arguments. A litigation tracker kept by an academic research group reports that the Fourth Circuit dismissed her appeal in May 2025 for lack of jurisdiction.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-058", "src-051" ], "entity_ids": [ "elatr", "nso", "qcyber" ] }, { "id": "display-claim-29b19f151ff12120df9b7a2e", "kind": "analysis", "text": "As recited in the court's memorandum, the complaint described NSO Group as a subsidiary of Q Cyber, a private company also incorporated in Israel, alleged that founder Omri Lavie runs both companies, and called Westbridge Technologies, Inc. an NSO subsidiary headquartered in Virginia and formed for US sales. The defendants argued that Westbridge is not NSO's subsidiary but a corporate affiliate owned by the same ultimate parent company. The court noted that the complaint did not allege that Westbridge was involved in surveilling the plaintiff.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-058" ], "entity_ids": [ "nso", "qcyber", "lavie", "westbridge", "elatr" ] }, { "id": "display-claim-7cfc88deaefd8fa3dfdf06f4", "kind": "analysis", "text": "In May 2022 Gonzalo Boye, a lawyer for Catalan politicians whom the European Parliament inquiry report describes as a Pegasus target, brought a case in Madrid on behalf of at least 19 targets against NSO, its three founders Niv Karmi, Shalev Hulio and Omri Lavie, Q Cyber Technologies and OSY, which the European Parliament inquiry report describes as a subsidiary based in Luxembourg; a research group's litigation tracker lists the defendants as NSO, Q Cyber Technologies, a subsidiary in Luxembourg, OSY and senior officers of these businesses. The sources do not say whether the Israeli Q Cyber Technologies Ltd or the Luxembourg Q Cyber Technologies S.à r.l. was named, and no outcome is recorded in the retained documents. Q Cyber Technologies Ltd's own proceedings in Israel, its withholding-tax appeal and the 2025 suit over control of the group, are described on the tax-appeal and fund-dispute pages.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-066", "src-051" ], "entity_ids": [ "nso", "karmi", "hulio", "lavie", "qcyber-lux", "osy" ] }, { "id": "display-claim-942ad9c25893b4d237b60066", "kind": "analysis", "text": "Luxembourg press reported in April 2026 that in March 2025 a court in Barcelona placed three NSO executives, Shalev Hulio, Omri Lavie and Yuval Somekh, under investigation in the \"Catalangate\" case for their roles in the Luxembourg companies OSY Technologies and Q Cyber Technologies Luxembourg, the first such step against NSO executives in Europe, and asked Luxembourg for cooperation through a European Investigation Order. Being placed under investigation is not a charge or a finding, and no later stage is recorded in the retained documents.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-015" ], "entity_ids": [ "hulio", "lavie", "somekh", "osy", "qcyber-lux" ] }, { "id": "display-claim-a679f64b81985a2382754b91", "kind": "analysis", "text": "Spain's High Court opened its own investigation after the Spanish government stated that Pegasus had been used against ministers including Prime Minister Pedro Sánchez, and in June 2022 called NSO Group's chief executive to testify as a witness, not as a suspect. According to the litigation tracker, which links to the underlying reports while the filings themselves were not retained, the investigation was shelved in July 2023, the judicial authorities citing Israel's lack of cooperation, and was reportedly reopened in 2024. The tracker also reports that in 2025 the association Sentinel Alliance filed a case in Barcelona against Spain's intelligence centre, the Civil Guard, NSO Group and Candiru; no outcome of that case is recorded.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-066", "src-051" ], "entity_ids": [ "nso" ] }, { "id": "display-claim-e9489ba6c686316a29fccde3", "kind": "analysis", "text": "According to the tracker, Omar Abdulaziz sued NSO Group in Israel in 2018, alleging that it helped the Saudi royal court take over his smartphone and spy on his communications with the murdered journalist Jamal Khashoggi; the allegation is his. NSO Group said its products were licensed only to governments and law enforcement agencies to fight terrorism and crime lawfully, after full vetting and licensing by the Israeli government, and that it investigates suspected misuse and may suspend or terminate contracts. In 2020 an Israeli judge rejected NSO's motion to dismiss and its request to hold the trial in secret and ordered it to pay Abdulaziz's legal costs; NSO said it would appeal. The tracker dates the ruling to June 2020, but the press report it links to is dated 16 January 2020, and the suit's final outcome is not recorded.", "qualification": "The Abdulaziz suit is known from a litigation tracker kept by an academic research group, which links to press reports of the case; the court filings were not retained.", "response": "", "outcome": "", "source_ids": [ "src-051" ], "entity_ids": [ "nso" ] }, { "id": "display-claim-297d138fcde987aca986c4ed", "kind": "analysis", "text": "In Administrative Appeal 28312-05-19, 30 petitioners represented by the attorney Eitay Mack and supported by Amnesty International asked the Tel Aviv-Jaffa District Court to order Israel's Defence Export Controls Agency to revoke NSO Group Technologies' export licence, which they said had been used against Amnesty International activists; the case was heard under a gag order, according to a 2021 NGO report. On 12 July 2020 Judge Rachel Barkai rejected the petition, finding no sufficient evidentiary basis that an attempted hacking of a human rights activist's phone had occurred or had been carried out by NSO, declining to say whether NSO held a licence, finding that the agency reviewed licences meticulously and monitored holders closely, and making no order for costs.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-059", "src-021" ], "entity_ids": [ "nso", "deca" ] }, { "id": "display-claim-2007dd4e37cbb713615fccc2", "kind": "analysis", "text": "In July 2018 the Israeli Justice Ministry said a former NSO Group employee had been charged with stealing intellectual property and trying to sell it for $50 million over the Darknet in a manner that could harm state security; the ministry said the former employee's actions \"endangered NSO and could have led to its collapse\".", "qualification": "The charge is known from the same tracker's summary of a Justice Ministry statement; the indictment was not retained.", "response": "", "outcome": "", "source_ids": [ "src-051" ], "entity_ids": [ "nso" ] }, { "id": "display-claim-e54ed550c4ad6e74d9558981", "kind": "analysis", "text": "In France, complaints have been filed against NSO Group by the Gulf Center for Human Rights in July 2021 and by the International Federation for Human Rights, the Ligue des droits de l'homme and the human rights defender Salah Hammouri. The Paris prosecutor also opened an investigation into Pegasus on 20 July 2021 after complaints by the news site Mediapart and two of its reporters that Morocco had spied on them, and 17 more journalists later complained to the prosecutor. No outcome of the French complaints or of the investigation is recorded.", "qualification": "The French complaints and investigation are known from the tracker's links to press and NGO announcements; the filings themselves were not retained.", "response": "", "outcome": "", "source_ids": [ "src-051" ], "entity_ids": [ "nso" ] }, { "id": "display-claim-85bd44c9c73fe57ad0c12002", "kind": "analysis", "text": "The tracker also records a civil suit against NSO Group filed in a Thai court in 2022 with the support of the Thai legal group iLaw, and letters before claim sent on 6 December 2022 to the Bahraini embassy in London and to NSO Group on behalf of the activist Yusuf al-Jamri. A letter before claim precedes a lawsuit and is not itself a proceeding.", "qualification": "The Thai suit and the letters before claim are known from the tracker, which links to the groups' own announcements; the filings themselves were not retained.", "response": "", "outcome": "", "source_ids": [ "src-051" ], "entity_ids": [ "nso" ] }, { "id": "display-claim-69b76e05ac06b6e27f782e9a", "kind": "analysis", "text": "According to the tracker, in September 2024 four individuals filed a criminal complaint in the United Kingdom accusing three companies of violating UK laws: NSO Group, its parent company the Luxembourg-based Q Cyber Technologies, and Novalpina Capital. The tracker calls the Luxembourg company NSO's parent, whereas register records show the Israeli Q Cyber Technologies Ltd as NSO's shareholder; no outcome is recorded.", "qualification": "The UK complaint is known only from the academic research group's litigation tracker, which links to a press report; the complaint itself was not retained.", "response": "", "outcome": "", "source_ids": [ "src-051" ], "entity_ids": [ "nso", "qcyber-lux", "novalpina" ] }, { "id": "display-claim-726738f44c78f39ad952326a", "kind": "analysis", "text": "NSO Group's 2025 transparency report states that its products are classified as defence articles under Israeli law and that every marketing activity and export transaction requires prior authorisation from the Israeli Ministry of Defense through its Defense Exports Control Agency (DECA), with transaction-specific licences that are subject to renewal and ongoing oversight. A legal opinion published by Novalpina in 2019, as described in the 2021 NGO report, likewise confirmed that all of NSO Group's then products fell within Israel's defence export control regime under the 2007 Defence Export Control Law. These are the company's own description and an opinion published by its then owner. In an open letter of April 2019 to Novalpina, copied to NSO Group and Francisco Partners, a coalition of NGOs including Amnesty International, Access Now, the Committee to Protect Journalists, Human Rights Watch and Privacy International wrote that Novalpina had given background on NSO's compliance with export rules but no data on its export licences; Novalpina had answered the coalition's first letter on 1 March 2019, a reply the NGO report cites but which was not retained.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-084", "src-021", "src-108" ], "entity_ids": [ "nso", "deca", "novalpina", "francisco" ] }, { "id": "display-claim-4b7921c5193f80cbaaea09a3", "kind": "analysis", "text": "In July 2021, as reported by Israeli press, Israel's Defence Ministry said that if NSO's products were found to have been used in violation of the licence conditions or of the purchasing countries' declarations it would take appropriate action, and that the State of Israel has no access to the information collected by NSO's customers. On 6 December 2021 the ministry's export control agency announced that it had tightened control of cyber exports by publishing an updated End User Declaration, which a state seeking a cyber or intelligence system must sign as a condition for the export licence; the announcement does not name NSO, and no retained document records a finding about NSO's licences.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-082", "src-078" ], "entity_ids": [ "deca", "nso" ] }, { "id": "display-claim-064079687715cff63df65060", "kind": "analysis", "text": "According to NSO's transparency reports as summarised by the press in January 2026, the company said it suspended or terminated six unnamed government customers in 2022–2023 at a revenue loss of $57 million and rejected more than $20 million of new business in 2024 for human rights reasons; these are the company's own figures. The publication noted that the 2025 report, unlike earlier ones, lacks figures on how many customers were rejected, investigated, suspended or terminated over human rights abuses, quoted critics who saw it as part of a campaign to leave the Entity List, and said an NSO spokesperson had not provided comparable figures by its deadline.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-080" ], "entity_ids": [ "nso" ] }, { "id": "display-claim-d7288bfbf85cd5ecce1770cb", "kind": "analysis", "text": "By a rule published in the Federal Register on 4 November 2021 (document 2021-24123), the US Commerce Department's Bureau of Industry and Security added \"NSO Group\", at 22 Galgalei Haplada, Herzliya, to the Entity List, requiring a licence for all items subject to the Export Administration Regulations with a presumption of denial. The End-User Review Committee found that NSO Group and Candiru developed and supplied spyware to foreign governments that used it to target government officials, journalists, businesspeople, activists, academics and embassy workers, contrary to US national security and foreign policy interests. The entry names \"NSO Group\" at the address that both NSO Group Technologies and Q Cyber Technologies gave in their 2019 Israeli annual reports, without either company's register number.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-025" ], "entity_ids": [ "bis", "nso" ] }, { "id": "display-claim-3cd8c72f4acce30e958fb16f", "kind": "analysis", "text": "The official electronic Code of Federal Regulations, read on 20 October 2026, shows the NSO Group entry with its presumption-of-denial licence policy in the version of the Entity List in force from 16 July 2026 with no end date and in each listed version since 26 November 2021, none marking it as removed; this records the entry's presence, not any licensing decisions under it. A screening service checked in October 2026 likewise returned \"NSO Group\" in the US Consolidated Screening List under the Entity List programme (US-BIS-EL), with the topic export control and country Israel; that result reflects the same designation and is not a separate sanction.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-086", "src-087", "src-008" ], "entity_ids": [ "bis", "nso" ] }, { "id": "display-claim-0ed83b6b84eb11ebf8beec58", "kind": "analysis", "text": "Q Cyber itself retained a US public-affairs firm after the WhatsApp suit. In the Foreign Agents Registration Act filing received on 25 December 2019, Mercury Public Affairs placed its foreign principal Q Cyber Technologies Ltd in the FARA category \"controlled by a foreign government, foreign political party, or other foreign principal\", explaining that some of its technology offerings were expected to be marketed to government clients and that the Israeli Ministry of Defense may deny such sales. The attached agreement, signed for Q Cyber by its general legal counsel, retained Mercury from 15 December 2019 to 30 November 2020 and month to month thereafter for $120,000 a month plus a one-time compliance fee of $5,000. US public-relations trade press reported in January 2020 that Q Cyber had signed Mercury to a $1.2 million contract for crisis communications, media outreach and government relations concerning the WhatsApp suit, and the 2021 NGO report notes a statement distributed by Mercury for Q Cyber and filed with the Justice Department's FARA unit on 2 October 2020.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-064", "src-021", "src-099" ], "entity_ids": [ "qcyber", "mercury", "deca", "sunray", "whatsapp" ] }, { "id": "display-claim-aac76240dfb5ebc1254bef2e", "kind": "analysis", "text": "An Israeli investigative outlet reported in July 2022, with a US non-profit newsroom, that after the listing NSO spent hundreds of thousands of dollars on US lobbyists, lawyers and public relations to be removed, and that Israeli government contacts with the US administration were led by Israel's National Security Council, part of the Prime Minister's Office. The White House, as quoted by the outlet, said it was not and had not been involved in considering any request to remove a foreign commercial spyware company from the Entity List. Luxembourg press reported in April 2026 that the listing remained in force and that no decision to remove NSO had been published, and the official register still shows the entry.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-093", "src-015" ], "entity_ids": [ "nso", "bis" ] }, { "id": "display-claim-d5e6689d500233851a795e19", "kind": "analysis", "text": "A US technology-policy publication reported in March 2026, compiling US business press reporting and lobbying disclosures, that the campaign cost at least $7.6 million in lobbying fees between 2020 and 2024 and at least $190,000 in 2025. It lists firms engaged through Q Cyber, including Mercury Public Affairs (2019–2021) and Arnold & Porter (timing unknown), and Paul, Weiss through Q Cyber's owner OSY Technologies (2019), and names Michael Flynn among earlier advisers, paid nearly $100,000 by NSO's parent companies. According to the same publication, NSO's outreach, including contacts with Jared Kushner and approaches from the Israeli prime minister's office, did not succeed: in May 2025 National Security Council officials turned away Vogel Group lobbyists seeking a meeting on NSO's behalf, and Vogel's lobbying for NSO lasted only a few months.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-101" ], "entity_ids": [ "nso", "qcyber", "mercury", "arnold-porter", "osy", "flynn" ] }, { "id": "display-claim-2d8fd9a9adc1da81a8921446", "kind": "analysis", "text": "In a letter of 6 May 2026 to the Commerce Secretary, Representative Summer L. Lee wrote that since the designation NSO had experienced a \"financial freefall\" and nearly defaulted on $500 million of debt and that in 2023 it reportedly spent nearly $1 million on lobbying, and asked for a briefing on NSO's purchase by an American company and on contacts with David Friedman. The letter relies on press reports and is not a finding of any agency.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-077" ], "entity_ids": [ "nso", "friedman", "bis" ] }, { "id": "display-claim-489f08652dcea2debe10110c", "kind": "analysis", "text": "NSO Group told the 2021 NGO report's authors that NSO Group Technologies, Q Cyber Technologies Ltd., Convexum, Wayout and the Bulgarian group companies export products and obtain licences for all products that require them, that group entities export from Israel, Bulgaria and Cyprus, and that each of those countries had at some point denied group licence applications. Novalpina said in March 2019 that some NSO products are exported from the EU, from Bulgaria or Cyprus, after consultation with the competent authority. The 2023 European Parliament report records that NSO denies that Pegasus is exported from Cyprus or Bulgaria and that the Cypriot and Bulgarian governments deny granting export permits to NSO companies; it calls the Bulgarian and Novalpina statements contradictory.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-021", "src-066" ], "entity_ids": [ "nso", "qcyber", "convexum", "novalpina" ] }, { "id": "display-claim-cb5e37549340499b35132066", "kind": "analysis", "text": "According to the NGO report, Circles Bulgaria EOOD and Magnet Bulgaria EOOD, held through IOTA Holdings, a subsidiary of OSY, are registered to obtain Bulgarian export licences; NSO Group said Magnet Bulgaria is inactive, that its registration with the Bulgarian export control authority lapsed in 2020, and that it never obtained licences to export the products named Vole or Pixcell. In June 2026 an international human rights organisation and a European news outlet reported, from Bulgarian licensing records for 2018–2023 that they reviewed but did not publish, that Bulgaria licensed Circles BG, a Sofia-based company affiliated with NSO, to sell interception systems, mobile-tracking tools and surveillance infrastructure to intelligence agencies in Azerbaijan, Serbia, Malaysia and Mexico; the human rights organisation said the records also show licensed exports to Q Cyber Technologies and NSO Group in Israel, and the news outlet reported that in at least one case involving Brazil an export transited through the Luxembourg Q Cyber Technologies; the organisation noted that the licences do not show whether the technology was actually exported. The outlet reported that NSO bought technology from Circles for $119,941 in October 2021, later transferred to the Home Front Command of Israel's Defence Ministry. The human rights organisation describes Q Cyber Technologies as the umbrella company formed when Circles was bought in 2014, whereas the Israeli company was incorporated in December 2013 as L.E.G.D. Company Ltd and renamed Q Cyber Technologies Ltd in 2016; the reporting does not establish that any export was unlawful. Circles did not respond to repeated requests for comment from either outlet. Bulgaria's foreign ministry said the documentation provided by Circles showed the technologies were intended for crime and terrorism investigation and search and rescue, and that all relevant circumstances, including end-use documents, are assessed when examining applications.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-021", "src-088", "src-089", "src-004" ], "entity_ids": [ "circles", "iota", "osy", "nso", "qcyber", "qcyber-lux" ] }, { "id": "display-claim-6ea7f44c0c2dd584eb2dcd09", "kind": "analysis", "text": "In a 2026 reply to an access-to-information request, annexed to the human rights organisation's report, Bulgaria's Ministry of Economy and Industry provided copies of surveillance export permits with the exporter, end user, product type and permit numbers deleted as commercially sensitive, so they do not show which company was the exporter; an appeal against the restricted access was pending in court.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-100" ], "entity_ids": [ "bulgaria-ministry" ] }, { "id": "display-claim-0230aa8bcd09b27c90a5f513", "kind": "analysis", "text": "Luxembourg's foreign ministry and economy minister stated in February 2019, according to the NGO report, that the Luxembourg entity linked to NSO had never sought an export licence in Luxembourg. The European Parliament report records that after the 2021 NGO report identified nine NSO-related companies in Luxembourg in June 2021, Foreign Minister Jean Asselborn wrote to each, and that none was authorised to export cyber-surveillance products from Luxembourg; NSO Group replied, according to Luxembourg press cited in the report, that it exports its spyware only from Israel with the Israeli government's consent, which Asselborn said in October 2021 he could not verify. Written question No. 3833, \"Activities of NSO Group in Luxembourg and possible links with Togo\", was tabled on 23 March 2026 by the deputies Sven Clement and Marc Goergen and answered in writing on 28 April 2026 by the economy minister Lex Delles and the foreign minister Xavier Bettel; Luxembourg press reported that the answer confirmed that the export control office had received no requests from the nine entities since the July 2021 letters. The text of the answer is not on the retained page.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-021", "src-066", "src-015", "src-028" ], "entity_ids": [ "nso", "qcyber-lux", "lux-gov" ] }, { "id": "display-claim-3c250ffad4d6f2549f1d0313", "kind": "analysis", "text": "In an opposition filed in the WhatsApp case on 4 November 2025, NSO Group Technologies and Q Cyber Technologies stated that all of NSO's customers are sovereign governments, as confirmed by the auditing firm EY, and that contracts and Israeli Defence Ministry licences require Pegasus to be used only against terrorism and serious crime; they referred to major US allies, including Western European democracies, among their foreign sovereign customers without naming them. These are the defendants' statements in court papers. According to answers NSO gave the European Parliament's inquiry committee in 2022, Pegasus was initially sold to 22 end users in 14 EU member states under Israeli marketing and export licences, and contracts with end users in two member states were later terminated; the committee could not confirm which states these were and assumed the two were Poland and Hungary. NSO did not name the member states.", "qualification": "The 22 end users and the two terminated contracts are NSO's answers as stated in the European Parliament's 2023 inquiry report, which relies on the sources it cites.", "response": "", "outcome": "", "source_ids": [ "src-081", "src-066" ], "entity_ids": [ "nso", "qcyber" ] }, { "id": "display-claim-11f90368cee30740e4fcc62b", "kind": "analysis", "text": "The only customer contract in the retained documents is an agreement dated 17 December 2015, filed by the plaintiffs as an exhibit to the WhatsApp complaint. It provides for Infraloks Development Limited, a Ghanaian company (registration number CA-66,115) reselling and supplying cyber intelligence solutions developed by NSO Group Technologies, to supply a system to the National Communication Authority of the Republic of Ghana as end user; the system description refers to the System Provider's Pegasus system operating on Ghana mobile numbers, and an attached service level agreement is between NSO Group Technologies and Infralok Development Limited. The retained copy is a scanned text with recognition errors.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-004" ], "entity_ids": [ "infraloks", "nso", "ghana-nca" ] }, { "id": "display-claim-32ad57a3ca37ad661c91402a", "kind": "analysis", "text": "The Polish government, after initially denying it, confirmed the purchase of spyware in January 2022; the former head of the Supreme Audit Office, Krzysztof Kwiatkowski, presented to the Senate two invoices confirming a purchase for the Central Anti-Corruption Bureau (CBA) for PLN 25 million from the Justice Ministry's Justice Fund, issued by Matic Sp. z o.o. as intermediary. The report states that Hungary's Interior Ministry bought Pegasus for EUR 6 million in 2017 indirectly, through Communication Technologies Ltd, from NSO's company in Luxembourg, which it does not name, a purchase acknowledged in November 2021 by Lajos Kósa, chair of the parliamentary defence and law enforcement committee; Communication Technologies later sued the journalist Szabolcs Panyi after he investigated it. Hungary's data protection authority, which had access to the secret contract, said its inquiry found nothing inconsistent with NSO's terms of sale, though according to the report it verified only the authorisation procedure, not the substance of the use.", "qualification": "The Polish invoices and the Hungarian purchase are stated in the European Parliament's 2023 inquiry report from the Senate testimony, press and the Hungarian authorities it cites.", "response": "", "outcome": "", "source_ids": [ "src-066" ], "entity_ids": [ "cba", "matic", "nso", "hungary-moi", "comm-tech" ] }, { "id": "display-claim-db4cb3d39834e4f6ac654cbc", "kind": "analysis", "text": "It was reported in September 2021 that Germany's Federal Criminal Police Office (BKA) had acquired Pegasus in late 2020; according to the report NSO at first declined to modify the software to comply with German law but later agreed, so the BKA acquired a modified version, a purchase confirmed by the then BKA vice-president Martina Link in a closed parliamentary session. The report also states that in October 2021 Luxembourg's Prime Minister Xavier Bettel confirmed that Luxembourg bought and used Pegasus for reasons of state security. A Luxembourg business publication's headline of 28 October 2021 states that Bettel appeared to confirm the purchase but later backtracked on his comments; the article's text was not retained.", "qualification": "The German and Luxembourg accounts are stated in the inquiry report from press and a closed parliamentary session it cites.", "response": "", "outcome": "", "source_ids": [ "src-066", "src-015" ], "entity_ids": [ "bka", "nso", "lux-gov" ] }, { "id": "display-claim-5ba689bc14b45413ef18ccbc", "kind": "analysis", "text": "Other governments' positions recorded in the report differ. Austria's government stated on 22 September 2021 that Austria had not been an NSO client; France's foreign ministry denied holding talks with NSO, although media reported that a French purchase was suspended in 2021; Belgium's justice minister declined to confirm whether Belgian intelligence was a client after a former Israeli intelligence official said Belgian police used Pegasus; and the Dutch government refused to comment on media reports of June 2022 that its intelligence service had used Pegasus to help the police track down a serious-crime suspect. These are denials, reports and refusals to comment, not records of contracts. The report concluded that, given the secrecy, it could not be determined whether the Spanish government concluded contracts with NSO or acquired and used Pegasus; Shalev Hulio, then NSO's chief executive, told a US magazine in April 2022 that Spain's use was legitimate given its respect for the rule of law and the requirement of Supreme Court authorisation, a remark about use rather than a contract.", "qualification": "The governments' positions and Hulio's remark are those recorded in the inquiry report, which relies on the ministerial answers and press it cites.", "response": "", "outcome": "", "source_ids": [ "src-066" ], "entity_ids": [ "nso", "hulio" ] }, { "id": "display-claim-519639a40311d4ed2784c472", "kind": "analysis", "text": "Citing press, the report states that Estonia negotiated with NSO in 2018 and made a down payment on a USD 30 million deal, after which Israel's Defence Ministry blocked it from using the spyware against Russian devices, and that in January 2020 NSO submitted to Greece an official proposal for a government-to-government agreement of EUR 50 million, an arrangement that was eventually called off; neither government's contract is in the retained documents. The report also cites a book alleging that a former NSO employee working for a company of Tal Dilian trained Cyprus's intelligence service in the use of Pegasus and that the Cypriot government bought equipment from Dilian's company. Cyprus's government told the committee that NSO holds no shares in Cypriot companies, that Pegasus did not appear to have been developed in or officially exported from Cyprus, and that NSO board members had set up or bought six companies there.", "qualification": "The Estonian, Greek and Cypriot accounts come from press and a book cited by the inquiry report, set against Cyprus's own answer to the committee.", "response": "", "outcome": "", "source_ids": [ "src-066" ], "entity_ids": [ "nso" ] }, { "id": "display-claim-424b4515c84d21e21683f7d2", "kind": "analysis", "text": "Citing a book and Israeli press, the report states that in 2017 NSO officials presented Pegasus 3 to Saudi Arabian customers at the Four Seasons Hotel in Limassol, Cyprus, and that the Saudi customers bought it for USD 55 million; the report adds that a year later Saudi Arabia killed Jamal Khashoggi after surveilling people close to him with Pegasus, which NSO disputes. It also records a document from the Cypriot party AKEL alleging that NSO exported Pegasus through a Cypriot subsidiary to a company in the United Arab Emirates against an invoice of USD 7 million, which the report says cannot be confirmed. In a March 2025 US court filing, Treo NOAL GP, general partner of the fund that bought NSO in 2019, said that information it obtained after the 2021 Entity List designation showed NSO had been heavily dependent on collections from new sales to high-risk customers such as Saudi Arabia. These are unconfirmed allegations and a party's statement; no contract is in the retained documents. A British business newspaper reported in April 2022, citing three people with knowledge of the matter, that Mubadala Capital, a unit of an Abu Dhabi state fund chaired by Crown Prince Sheikh Mohammed bin Zayed al-Nahyan, was one of the largest investors in the €1 billion private equity fund that bought NSO in 2019, and that the Abu Dhabi government internally discussed buying NSO outright in autumn 2021, discussions that did not progress beyond preliminary conversations; Mubadala's stake in the fund is not quantified.", "qualification": "The Limassol meeting and the AKEL document are stated in the inquiry report from a book, Israeli press and a party's document it cites.", "response": "", "outcome": "", "source_ids": [ "src-066", "src-106", "src-107", "src-096" ], "entity_ids": [ "nso", "treo-gp", "mubadala", "noal" ] }, { "id": "display-claim-a16d9f077bd34742cff1952b", "kind": "analysis", "text": "According to US public radio as cited in the report, Morocco had a licence for about 100,000 phone numbers, making it one of NSO's largest Pegasus clients. A 2026 investigation by an international journalism network, based on a former officer of Morocco's DGST intelligence service and a second former intelligence source, reported that the DGST procured and administered Pegasus through a private intermediary, which the reporters identified from the former officer's description as FSSYS Maroc in Rabat; no contract is in the retained documents, and the reporters found no evidence that the intermediary itself carried out infections. Morocco called the Pegasus Project accusations erroneous and has long denied using Pegasus, and Moroccan authorities, NSO and the chairman of FSSYS Maroc did not respond to the 2026 investigation's questions.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-066", "src-083" ], "entity_ids": [ "nso", "fssys" ] }, { "id": "display-claim-7f860e1850814350558a0d9b", "kind": "analysis", "text": "A 2026 investigation by an international journalism network reported that NSO sold Pegasus to Panama in 2012, with Shalev Hulio signing the contract with the Panamanian government, and that in 2023 Panama's Supreme Court sentenced two former officials to 50 months in prison for breaches of confidentiality and of the right to privacy related to Pegasus. It also reported that Panamanian migration records show Hulio entering Panama on 3 December 2013 on a diplomatic passport issued by Israel, with his profession given as \"diplomat\", a use that a former senior Panamanian official confirmed, and presented this as raising questions about the firm's stated independence from the Israeli state. Hulio called the allegations concerning a diplomatic passport and his purported role as a representative of Israel entirely false and categorically denied them; Israel's defence and foreign ministries did not respond. The contract, the Panamanian judgment and the migration records were not retained.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-079" ], "entity_ids": [ "nso", "panama", "hulio" ] }, { "id": "display-claim-c84585a200f9d28affeb25b2", "kind": "analysis", "text": "The European Parliament report, citing an international human rights organisation, names 14 non-EU countries whose authorities are most likely responsible for many cases of technically proven Pegasus infection: El Salvador, Mexico, Thailand, Morocco, India, Rwanda, Saudi Arabia, Bahrain, Jordan, Kazakhstan, Togo, the United Arab Emirates, Israel and Azerbaijan. This attributes infections to states; it does not document contracts with NSO. The report also states that Ability Ltd, founded by Anatoly Hurgin, cooperated with NSO on Pegasus and handled the network side of NSO's operations, and that in 2017 Ability was under investigation by the US Securities and Exchange Commission over alleged misstatements of its finances.", "qualification": "The list of 14 states and the account of Ability are stated in the inquiry report, which relies on a human rights organisation's research and other sources it cites.", "response": "", "outcome": "", "source_ids": [ "src-066" ], "entity_ids": [ "nso", "ability" ] }, { "id": "display-claim-7436d15e4064c0cdad84adad", "kind": "analysis", "text": "According to the 2021 NGO report, NSO Group Technologies was founded by the businessmen Niv Carmi, Shalev Hulio and Omri Lavie, whose first initials make up the name NSO, with the venture capitalist Eddy Shalev as an initial investor; the European Parliament report likewise gives 2010 as the year the group was founded by Hulio, Lavie and Niv Karmi, the spelling of the name varying between sources for the same person. NSO Group told the report's authors that Carmi was no longer affiliated with the group, and Israeli business press reported in 2025 that he had left NSO after less than a year.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-021", "src-092", "src-066" ], "entity_ids": [ "nso", "karmi", "hulio", "lavie", "eddy-shalev" ] }, { "id": "display-claim-0389432f032c448168649698", "kind": "analysis", "text": "A profile on a company-data site lists Shalev Hulio, who appears in Luxembourg and UK records as \"Shalev Holy\", as NSO's co-founder and vice-president of marketing from December 2009, its chief executive from March 2016 and a partner of the investment firm Founders Group. According to the European Parliament report he stepped down as chief executive in August 2022 and was replaced by Yaron Shohat, after which NSO, according to press cited in the report, changed policy to focus only on NATO members. A company-data profile records Shohat as NSO's former chief operating officer; he was also reported to be chief executive of Q Cyber Technologies, testified as NSO's chief executive in August 2024 and, according to press in January 2026, stepped down after the 2025 change of ownership. No register record of Shohat's offices was retained.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-076", "src-020", "src-066", "src-071" ], "entity_ids": [ "hulio", "nso", "founders-group", "shohat", "qcyber" ] }, { "id": "display-claim-ba0bbdf6fac0ff8d91fc47d1", "kind": "analysis", "text": "According to the European Parliament inquiry report, after public pressure over NSO's hiring of the private intelligence firm Black Cube against its opponents, Shalev Hulio, NSO's former chief executive, admitted to hiring Black Cube in at least one situation in Cyprus; the admission itself is not retained.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-066" ], "entity_ids": [ "hulio", "black-cube", "nso" ] }, { "id": "display-claim-2c213d7b29f06cb081ed98d0", "kind": "analysis", "text": "After leaving NSO, Hulio co-founded the cyber-defence and artificial-intelligence company Dream (Dream Security) with former Austrian chancellor Sebastian Kurz and Gil Dolev, the brother of NSO Group president Shiri Dolev. The European Parliament report dates its launch to October 2022, whereas Israeli press gives 2023, and records that its early investors included Adi Shalev, also an early NSO investor (the records do not show whether this is the Eddy Shalev named among NSO's first investors); Israeli press reported in June 2026 that Dream had raised $260 million at a valuation of $3 billion. Lavie also co-founded the Tel Aviv cyber-risk company Orchestra Group, founded in 2009 according to a company-data profile; in a 2017 press interview Lavie and his investment partner Issac Zack said Orchestra was being financed by their investment firm Founders Group, whose chief executive was Hulio.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-066", "src-111", "src-044", "src-112", "src-119" ], "entity_ids": [ "hulio", "dream", "kurz", "gil-dolev", "shiri-dolev", "nso", "lavie", "orchestra", "founders-group" ] }, { "id": "display-claim-4ba590f40f0319f3c7a3d997", "kind": "analysis", "text": "Niv Karmi later founded Polus Tech in Zug, Switzerland, in 2016, with investment from Elta Systems of Israel Aerospace Industries, according to Israeli business press. Swiss commercial-register data list him as a board member of POLUS Tech. (Switzerland) Ltd and as president of the board of Therian Labs Technologies AG, a Zug company whose purpose includes selling software solutions in Asia, in particular Indonesia. A Swiss arms-export monitoring site reported that Therian Labs received Swiss export permits for Indonesia worth CHF 4.84 million in 2022 in the dual-use category 5A001.f, covering mobile interception and jamming equipment; the permit records themselves were not retained. These are Karmi's own companies, not NSO or Q Cyber companies.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-092", "src-041", "src-065", "src-110", "src-123" ], "entity_ids": [ "karmi", "polus", "therian" ] }, { "id": "display-claim-4f5e5cca0e24b07e086ce85f", "kind": "analysis", "text": "Francisco Partners Management, L.P. is a US investment adviser registered with the SEC (CRD 160272) that advises private funds; its Form ADV, read from a company-data site's copy, states that it managed about $47.05 billion of fund assets at 31 December 2025. Eran Gorev is a partner and president of Israel at Francisco Partners, which he joined in 2014, according to the firm's website; a company-data profile lists him as NSO's chairman from 2014 to 2019, and Luxembourg register publications, as summarised by an aggregator, list him as a manager of OSY Technologies between publications of 16 December 2014 and 12 April 2019 and of Q Cyber Technologies S.à r.l. from its registration in January 2016 until a publication of August 2019.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-022", "src-019", "src-094", "src-005" ], "entity_ids": [ "francisco", "gorev", "nso", "osy", "qcyber-lux" ] }, { "id": "display-claim-50d52af9d4cbc9436080476a", "kind": "analysis", "text": "Under Francisco Partners' ownership, according to the firm's statement to the 2021 NGO report, NSO's business ethics committee reviewed all potential sales and blocked tens of millions of dollars of sales that would otherwise have been legally permitted; Novalpina described it as a committee of NSO's board with three NSO executives and four external members, which media reports said included Daniel Reisner of the Israeli law firm Herzog Fox & Neeman. After the 2019 buyout it was replaced by a governance, risk and compliance committee which, according to NSO Group, is a board-level committee appointed by OSY's board that oversees investigations into credible allegations of misuse. These are the statements of Francisco Partners, Novalpina and NSO Group.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-021" ], "entity_ids": [ "francisco", "nso", "novalpina", "osy" ] }, { "id": "display-claim-016d7a938d27bc0bb029323d", "kind": "analysis", "text": "According to the European Parliament report, citing press, Jeremy Bash, a former chief of staff at the CIA (2009–2011) and the US Department of Defense (2011–2013), was hired through his firm Beacon Global Strategies to advise NSO through Francisco Partners and was reportedly one of eight members of the business ethics committee with a vote on proposed sales, a count that differs from the seven members in Novalpina's own description above; Beacon ended its work with NSO after the group pursued sales to Saudi Arabia. Bash served on the President's Intelligence Advisory Board from 2022 to 2025, according to an encyclopedia entry, and a sanctions and PEP data service lists him as a politically exposed person, with no sanctions or crime topics. US press reported in 2017 that, according to his financial disclosure forms, Michael Flynn received $40,280 in 2016 as an advisory board member of OSY Technologies; Francisco Partners' general counsel told another publication that Flynn was paid a little more than $40,000 by OSY and less than $100,000 by Francisco, had served in a relatively limited advisory role and that the firm routinely engages consultants to understand the industries it invests in. Flynn's lawyer did not respond to requests for comment.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-066", "src-109", "src-122", "src-104", "src-119" ], "entity_ids": [ "bash", "beacon", "nso", "francisco", "flynn", "osy" ] }, { "id": "display-claim-37b5e639b788c01c4491765c", "kind": "analysis", "text": "NSO Group announced in April 2020 that it had appointed Asher Levy, chief executive of Orbotech from 2013 to 2019, as executive chairman, an appointment approved by the board earlier that year and effective on 1 April 2020; a market-data profile lists him as former chairman of N.S.O. Group Technologies Ltd. He left the chairmanship at the start of January 2022, saying he had represented Novalpina and was making way for BRG's appointee, and denied that his departure had anything to do with NSO's legal and financial troubles. These are a company announcement, an aggregator profile and a press account.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-090", "src-070", "src-118" ], "entity_ids": [ "asher-levy", "nso", "novalpina", "brg" ] }, { "id": "display-claim-eb3360656d03fbc55693e36f", "kind": "analysis", "text": "Register summaries record Yuval Somekh as a manager of Q Cyber Technologies S.à r.l. from its registration in 2016 and of NorthPole Newco; according to the 2021 NGO report he was type B manager of Emerald LIE and Diamond LIE, which NSO Group said were created to grant stock options, with Gaëtan Dumont as type A manager. Register publications of 4 and 26 November 2021, as summarised by an aggregator, record that Somekh was no longer a manager of OSY and of NorthPole Newco and Q Cyber Technologies S.à r.l. respectively. NSO Group told the 2021 NGO report that Hulio, Lavie, Somekh and Asher Levy were directors in the group and that Dumont was a professional director in five of its eight Luxembourg companies, holding no other position in the group. A register publication of 20 August 2019, as summarised by an aggregator, lists Charline de Maigret as a manager of Q Cyber Technologies S.à r.l. Anthony Levy has been a manager of NorthPole Newco, OSY and Q Cyber Technologies S.à r.l. since 15 March 2023, having earlier been a class B manager of NorthPole Newco from 22 December 2021 to 16 January 2023, and has been the Luxembourg Q Cyber's delegate for day-to-day management since 5 June 2023, with a professional address in Luxembourg.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-021", "src-010", "src-006", "src-005", "src-061", "src-043", "src-038" ], "entity_ids": [ "somekh", "dumont", "qcyber-lux", "northpole-newco", "emerald", "diamond", "hulio", "lavie", "asher-levy", "nso", "de-maigret", "anthony-levy", "osy" ] }, { "id": "display-claim-06874c2a7820c901f0fd4155", "kind": "analysis", "text": "NSO Group told the NGO report's authors in 2021 that the former employee Kevin Wilson was then a shareholder in Triangle Holdings, that the former consultant Alexei Voronovitsky no longer held shares in any group company, that OSY Holdings Ltd. and Global Seven Group LP held no shares or other interest in Triangle, and that the group had no companies in the Cayman Islands or the British Virgin Islands.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-021" ], "entity_ids": [ "kevin-wilson", "triangle", "voronovitsky", "osy-holdings", "global-seven", "nso" ] }, { "id": "display-claim-45ceff5fb9b610cba3b76652", "kind": "analysis", "text": "According to his witness biography published by the US House of Representatives, David M. Friedman was appointed on 10 November 2025 executive chairman of the Luxembourg holding company that owns NSO Group and of a Delaware subsidiary of that company, neither of which the biography names, and a register notice published on 30 December 2025 records his appointment as a manager of OSY Technologies with effect from 15 December 2025. Friedman was US ambassador to Israel from March 2017 to January 2021; before joining the State Department he practised law at Kasowitz, Benson, Torres & Friedman LLP, which he co-founded in 1994. A sanctions and PEP data service lists him as a politically exposed person on that basis and as named on the Iranian foreign ministry's own sanctions list, a measure by Iran against US individuals rather than a Western sanction. Robert Bruce Simonds Jr., according to Israeli business reporting, joined the board of the holding company shortly after the 2023 transfer, at the lenders' initiative to raise financing, tried to acquire NSO in June 2023 and left the board in August 2023 after five months, when the attempt had failed; the August 2023 report suggested, as its own speculation rather than a recorded decision of the ministry, that he may have been forced out for lack of Israeli Defence Ministry approval, possibly because of business ties to China. Israeli press reported in November 2025 that a group of US investors led by Simonds had bought a controlling stake in NSO in October 2025 and that the founders were no longer shareholders; the other investors were not named, and no retained register notice names Simonds as an owner. He is a film producer and founder and chairman of STX Entertainment, according to an online encyclopedia, and Luxembourg press reported that in January 2026 he sold his production company, Crown Productions, which it described as the film-financing subsidiary of the insurance platform A-CAP.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-016", "src-037", "src-121", "src-013", "src-091", "src-027", "src-023", "src-015" ], "entity_ids": [ "friedman", "osy", "nso", "simonds", "dufresne", "stx", "karmi", "hulio", "lavie" ] }, { "id": "display-claim-761342e72f262a3ed161e0a4", "kind": "analysis", "text": "According to records described in the 2021 NGO report, Westbridge Technologies Inc. was incorporated in Delaware on 22 July 2014 with Omri Lavie named as president or vice-president in corporate documents, had branches registered in Maryland in 2016 (dissolved in June 2019) and Virginia in 2019, and was described in the professional profile of its former president Terry DiVittorio as the US affiliate of Q Cyber Technologies. It was then registered as an active US federal contractor (CAGE code 7FQ39) whose registration gave its immediate owner as Francisco Partners GP III Management, LLC; NSO Group told the authors that there is no relationship between Westbridge and Francisco Partners, that Westbridge's ownership passed in the 2019 Novalpina transaction and that the registration naming Francisco Partners was incorrect.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-021" ], "entity_ids": [ "westbridge", "lavie", "divittorio", "qcyber", "francisco", "nso", "novalpina" ] }, { "id": "display-claim-05446b31a59fa28a10a19077", "kind": "analysis", "text": "OSY's accounts place Westbridge under OSY. Francisco Partners said it never held a direct interest in Westbridge and that its indirect interest through OSY Holdings and Triangle ended on 18 March 2019; OSY Technologies' accounts record OSY's equity interests in Westbridge Technologies, Inc., pledged to the lenders' collateral agent since April 2019; and NSO Group and Q Cyber told the Eastern District of Virginia in 2023, in the Khashoggi case, that Westbridge is an affiliate owned by the same ultimate parent as NSO Group rather than NSO's subsidiary.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-062", "src-021", "src-058" ], "entity_ids": [ "westbridge", "francisco", "osy-holdings", "triangle", "osy", "nso", "qcyber" ] }, { "id": "display-claim-2de1b724c933e2253e32994b", "kind": "analysis", "text": "The WhatsApp complaint described Westbridge as NSO Group's US marketing and sales arm. A 2020 report based on records obtained through public-records requests said a Westbridge brochure called the company \"the North American branch of NSO Group\", stressed that it was based in Bethesda, Maryland and then majority owned by an American private equity firm, and marketed a product called Phantom, which a former NSO employee described as the US brand of Pegasus; a 2022 report said Westbridge pitched the spyware to US law enforcement. An NSO spokesperson told the 2020 publication that NSO products sold to foreign sovereigns cannot be used for cyber-surveillance within the United States and that no customer has ever been given technology to target phones with US numbers. According to the 2020 report, the US Drug Enforcement Administration, to which Westbridge had demonstrated the technology, and the San Diego police did not buy it because of its cost. These are an allegation in the complaint and press accounts.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-004", "src-103", "src-098" ], "entity_ids": [ "westbridge", "nso" ] }, { "id": "display-claim-2b67d64879dad874c3fbee73", "kind": "analysis", "text": "According to the 2021 NGO report, NSO Group Technologies acquired the Israeli counter-drone company Convexum Ltd. in February 2020 for $60 million; one of Convexum's previous shareholders was F2 Capital Ltd., chaired by the NSO investor Eddy Shalev, and NSO Group said Convexum develops and exports the Eclipse anti-drone system. Israeli business reporting said that in January 2022, at the request of BRG as NSO's controlling shareholder, the Tel Aviv District Court appointed a temporary trustee of Convexum, which had in practice been controlled by Triangle, owned 70% by Novalpina and 30% by NSO's management and employees; BRG's court papers put NSO's debts at $460 million. A year later it reported that the proceedings had ended with Convexum's separation from NSO, which NSO's management had opposed. These are press accounts of court filings.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-021", "src-114", "src-060" ], "entity_ids": [ "nso", "convexum", "eddy-shalev", "brg", "triangle", "novalpina" ] }, { "id": "display-claim-dedd577bae78673b3805d9b1", "kind": "analysis", "text": "UK Companies House records PFOS Technologies Limited, company number 08521034, incorporated in England on 9 May 2013 and dissolved on 30 November 2021; the NGO report states, from UK filings, that NSO Group Technologies was its sole shareholder and that its principal activity was marketing services for its parent.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-063" ], "entity_ids": [ "pfos", "nso" ] }, { "id": "display-claim-8b95cb7f6c9f5b7bbef0b807", "kind": "analysis", "text": "Relying on NGO research, the European Parliament report states that the NSO group has had a corporate presence in Israel, the United Kingdom, Luxembourg, the Cayman Islands, Cyprus, the United States, the Netherlands, Bulgaria and the British Virgin Islands, and, citing NGO research, that between November 2014 and December 2016 the group operated through two Dutch companies, Shapes 1 BV and Shapes 2 BV, financial holding companies later liquidated.", "qualification": "", "response": "", "outcome": "", "source_ids": [ "src-066" ], "entity_ids": [ "nso", "shapes1", "shapes2" ] } ], "sources": [ { "id": "src-001", "title": "Court record source · src-001", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "court_record", "publisher_type": "corporate", "url": "" }, { "id": "src-002", "title": "Corporate registry source · src-002", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "corporate_registry", "publisher_type": "nonprofit", "url": "" }, { "id": "src-003", "title": "Corporate registry source · src-003", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "corporate_registry", "publisher_type": "corporate", "url": "" }, { "id": "src-004", "title": "Court record source · src-004", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "court_record", "publisher_type": "unknown", "url": "" }, { "id": "src-005", "title": "Corporate registry source · src-005", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "corporate_registry", "publisher_type": "corporate", "url": "" }, { "id": "src-006", "title": "Corporate registry source · src-006", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "corporate_registry", "publisher_type": "corporate", "url": "" }, { "id": "src-007", "title": "Corporate registry source · src-007", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "corporate_registry", "publisher_type": "corporate", "url": "" }, { "id": "src-008", "title": "Sanctions list source · src-008", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "sanctions_list", "publisher_type": "corporate", "url": "" }, { "id": "src-009", "title": "Company statement source · src-009", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "company_statement", "publisher_type": "corporate", "url": "" }, { "id": "src-010", "title": "Corporate registry source · src-010", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "corporate_registry", "publisher_type": "corporate", "url": "" }, { "id": "src-011", "title": "Media source · src-011", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "media", "publisher_type": "media", "url": "" }, { "id": "src-012", "title": "Media source · src-012", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "media", "publisher_type": "media", "url": "" }, { "id": "src-013", "title": "Media source · src-013", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "media", "publisher_type": "media", "url": "" }, { "id": "src-014", "title": "Corporate registry source · src-014", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "corporate_registry", "publisher_type": "corporate", "url": "" }, { "id": "src-015", "title": "Media source · src-015", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "media", "publisher_type": "media", "url": "" }, { "id": "src-016", "title": "Witness biography: Ambassador David M. Friedman", "publisher": "US House of Representatives", "date": "2026-07-22", "locator": "Witness biography for a committee hearing", "basis": "Retained copy of the document in the frozen case database, read in the passages cited by the claims.", "source_type": "regulatory_record", "publisher_type": "government", "url": "https://www.congress.gov/119/meeting/house/119487/witnesses/HHRG-119-FA13-Bio-FriedmanD-20260722.pdf" }, { "id": "src-017", "title": "Corporate registry source · src-017", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "corporate_registry", "publisher_type": "corporate", "url": "" }, { "id": "src-018", "title": "Corporate registry source · src-018", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "corporate_registry", "publisher_type": "corporate", "url": "" }, { "id": "src-019", "title": "Company statement source · src-019", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "company_statement", "publisher_type": "corporate", "url": "" }, { "id": "src-020", "title": "Other source · src-020", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "other", "publisher_type": "nonprofit", "url": "" }, { "id": "src-021", "title": "Research source · src-021", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "research", "publisher_type": "nonprofit", "url": "" }, { "id": "src-022", "title": "Regulatory record source · src-022", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "regulatory_record", "publisher_type": "corporate", "url": "" }, { "id": "src-023", "title": "Other source · src-023", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "other", "publisher_type": "nonprofit", "url": "" }, { "id": "src-024", "title": "Media source · src-024", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "media", "publisher_type": "nonprofit", "url": "" }, { "id": "src-025", "title": "Addition of Certain Entities to the Entity List (2021-24123)", "publisher": "US Department of Commerce, Bureau of Industry and Security (Federal Register)", "date": "2021-11-04", "locator": "86 FR 60759", "basis": "Retained copy of the document in the frozen case database, read in the passages cited by the claims.", "source_type": "regulatory_record", "publisher_type": "government", "url": "https://www.federalregister.gov/documents/2021/11/04/2021-24123/addition-of-certain-entities-to-the-entity-list" }, { "id": "src-026", "title": "WhatsApp Inc. v. NSO Group Technologies Limited, No. 20-16408, opinion", "publisher": "US Court of Appeals for the Ninth Circuit", "date": "2021-11-08", "locator": "Opinion", "basis": "Retained copy of the document in the frozen case database, read in the passages cited by the claims.", "source_type": "court_record", "publisher_type": "government", "url": "https://cdn.ca9.uscourts.gov/datastore/opinions/2021/11/08/20-16408.pdf" }, { "id": "src-027", "title": "Media source · src-027", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "media", "publisher_type": "media", "url": "" }, { "id": "src-028", "title": "Written question No. 3833: Activities of NSO Group in Luxembourg and possible links with Togo", "publisher": "Chamber of Deputies of Luxembourg", "date": "2026-04-28", "locator": "Question and ministerial answer", "basis": "Retained copy of the document in the frozen case database, read in the passages cited by the claims.", "source_type": "regulatory_record", "publisher_type": "government", "url": "https://www.chd.lu/fr/question/30549" }, { "id": "src-029", "title": "Media source · src-029", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "media", "publisher_type": "media", "url": "" }, { "id": "src-030", "title": "Court record source · src-030", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "court_record", "publisher_type": "nonprofit", "url": "" }, { "id": "src-031", "title": "Court record source · src-031", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "court_record", "publisher_type": "nonprofit", "url": "" }, { "id": "src-032", "title": "Corporate registry source · src-032", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "corporate_registry", "publisher_type": "corporate", "url": "" }, { "id": "src-033", "title": "RESA publication RESA_2026_048.374: NorthPole Newco S.à r.l.", "publisher": "Luxembourg Business Registers", "date": "2026-02-26", "locator": "Transfer of shares", "basis": "Retained copy of the document in the frozen case database, read in the passages cited by the claims.", "source_type": "corporate_registry", "publisher_type": "registry_operator", "url": "https://gd.lu/resa/4NGfvf" }, { "id": "src-034", "title": "RESA publication RESA_2025_277.1590: NorthPole Newco S.à r.l.", "publisher": "Luxembourg Business Registers", "date": "2025-12-22", "locator": "Transfer of shares", "basis": "Retained copy of the document in the frozen case database, read in the passages cited by the claims.", "source_type": "corporate_registry", "publisher_type": "registry_operator", "url": "https://gd.lu/resa/4jPpV6" }, { "id": "src-035", "title": "RESA publication RESA_2025_242.307: NorthPole Newco S.à r.l.", "publisher": "Luxembourg Business Registers", "date": "2025-11-07", "locator": "Extract of shareholder decisions", "basis": "Retained copy of the document in the frozen case database, read in the passages cited by the claims.", "source_type": "corporate_registry", "publisher_type": "registry_operator", "url": "https://gd.lu/resa/5H0k95" }, { "id": "src-036", "title": "Corporate registry source · src-036", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "corporate_registry", "publisher_type": "corporate", "url": "" }, { "id": "src-037", "title": "RESA publication RESA_2025_282.256: Osy Technologies S.à r.l.", "publisher": "Luxembourg Business Registers", "date": "2025-12-30", "locator": "Appointment of manager", "basis": "Retained copy of the document in the frozen case database, read in the passages cited by the claims.", "source_type": "corporate_registry", "publisher_type": "registry_operator", "url": "https://gd.lu/resa/cBcvjz" }, { "id": "src-038", "title": "RESA publication RESA_2025_235.223: Osy Technologies S.à r.l.", "publisher": "Luxembourg Business Registers", "date": "2025-10-30", "locator": "Changes of managers", "basis": "Retained copy of the document in the frozen case database, read in the passages cited by the claims.", "source_type": "corporate_registry", "publisher_type": "registry_operator", "url": "https://gd.lu/resa/fDdxHV" }, { "id": "src-039", "title": "Corporate registry source · src-039", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "corporate_registry", "publisher_type": "corporate", "url": "" }, { "id": "src-040", "title": "Corporate registry source · src-040", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "corporate_registry", "publisher_type": "corporate", "url": "" }, { "id": "src-041", "title": "Corporate registry source · src-041", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "corporate_registry", "publisher_type": "corporate", "url": "" }, { "id": "src-042", "title": "Corporate registry source · src-042", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "corporate_registry", "publisher_type": "corporate", "url": "" }, { "id": "src-043", "title": "RESA publication RESA_2025_233.613: Q Cyber Technologies (B203124)", "publisher": "Luxembourg Business Registers", "date": "2025-10-28", "locator": "Changes of managers", "basis": "Retained copy of the document in the frozen case database, read in the passages cited by the claims.", "source_type": "corporate_registry", "publisher_type": "registry_operator", "url": "https://gd.lu/resa/1gSDVs" }, { "id": "src-044", "title": "Company statement source · src-044", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "company_statement", "publisher_type": "corporate", "url": "" }, { "id": "src-045", "title": "Media source · src-045", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "media", "publisher_type": "media", "url": "" }, { "id": "src-046", "title": "Court record source · src-046", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "court_record", "publisher_type": "nonprofit", "url": "" }, { "id": "src-047", "title": "Court record source · src-047", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "court_record", "publisher_type": "nonprofit", "url": "" }, { "id": "src-048", "title": "Media source · src-048", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "media", "publisher_type": "media", "url": "" }, { "id": "src-049", "title": "Court record source · src-049", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "court_record", "publisher_type": "nonprofit", "url": "" }, { "id": "src-050", "title": "Media source · src-050", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "media", "publisher_type": "media", "url": "" }, { "id": "src-051", "title": "Research source · src-051", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "research", "publisher_type": "academic", "url": "" }, { "id": "src-052", "title": "Docket No. 21-1338: NSO Group Technologies Limited, et al. v. WhatsApp Inc., et al.", "publisher": "Supreme Court of the United States", "date": "2023-01-09", "locator": "Docket", "basis": "Retained copy of the document in the frozen case database, read in the passages cited by the claims.", "source_type": "court_record", "publisher_type": "government", "url": "https://www.supremecourt.gov/docket/docketfiles/html/public/21-1338.html" }, { "id": "src-053", "title": "Court record source · src-053", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "court_record", "publisher_type": "nonprofit", "url": "" }, { "id": "src-054", "title": "Court record source · src-054", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "court_record", "publisher_type": "corporate", "url": "" }, { "id": "src-055", "title": "Court record source · src-055", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "court_record", "publisher_type": "nonprofit", "url": "" }, { "id": "src-056", "title": "Court record source · src-056", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "court_record", "publisher_type": "nonprofit", "url": "" }, { "id": "src-057", "title": "Court record source · src-057", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "court_record", "publisher_type": "nonprofit", "url": "" }, { "id": "src-058", "title": "Court record source · src-058", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "court_record", "publisher_type": "nonprofit", "url": "" }, { "id": "src-059", "title": "Court record source · src-059", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "court_record", "publisher_type": "academic", "url": "" }, { "id": "src-060", "title": "Media source · src-060", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "media", "publisher_type": "media", "url": "" }, { "id": "src-061", "title": "Annual accounts 2024: NorthPole Newco S.à r.l. (filing L250250760)", "publisher": "Luxembourg Business Registers", "date": "2025-07-29", "locator": "Balance sheet and notes", "basis": "Retained copy of the document in the frozen case database, read in the passages cited by the claims.", "source_type": "corporate_registry", "publisher_type": "registry_operator", "url": "https://gd.lu/rcsl/ffVdlj" }, { "id": "src-062", "title": "Annual accounts 2024: Osy Technologies S.à r.l. (filing L250268646)", "publisher": "Luxembourg Business Registers", "date": "2025-08-05", "locator": "Balance sheet and notes", "basis": "Retained copy of the document in the frozen case database, read in the passages cited by the claims.", "source_type": "corporate_registry", "publisher_type": "registry_operator", "url": "https://gd.lu/rcsl/b2VbVh" }, { "id": "src-063", "title": "Company record: PFOS Technologies Limited (08521034)", "publisher": "Companies House", "date": "", "locator": "Company overview", "basis": "Retained copy of the document in the frozen case database, read in the passages cited by the claims.", "source_type": "corporate_registry", "publisher_type": "registry_operator", "url": "https://find-and-update.company-information.service.gov.uk/company/08521034" }, { "id": "src-064", "title": "Exhibit A and agreement, FARA registration No. 6170 (Mercury Public Affairs, LLC)", "publisher": "US Department of Justice, FARA Registration Unit", "date": "2019-12-25", "locator": "Exhibit A and attached consulting agreement", "basis": "Retained copy of the document in the frozen case database, read in the passages cited by the claims.", "source_type": "regulatory_record", "publisher_type": "government", "url": "https://efile.fara.gov/docs/6170-Exhibit-AB-20191225-73.pdf" }, { "id": "src-065", "title": "Corporate registry source · src-065", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "corporate_registry", "publisher_type": "corporate", "url": "" }, { "id": "src-066", "title": "Report of the investigation of alleged contraventions and maladministration in the application of Union law in relation to the use of Pegasus and equivalent surveillance spyware (A9-0189/2023)", "publisher": "European Parliament", "date": "2023-05-22", "locator": "Committee of inquiry report", "basis": "Retained copy of the document in the frozen case database, read in the passages cited by the claims.", "source_type": "regulatory_record", "publisher_type": "intergovernmental", "url": "https://data.europarl.europa.eu/distribution/reds_iPlRp/A-9-2023-0189/A-9-2023-0189_en.pdf" }, { "id": "src-067", "title": "Court record source · src-067", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "court_record", "publisher_type": "nonprofit", "url": "" }, { "id": "src-068", "title": "Corporate registry source · src-068", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "corporate_registry", "publisher_type": "unknown", "url": "" }, { "id": "src-069", "title": "Company statement source · src-069", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "company_statement", "publisher_type": "corporate", "url": "" }, { "id": "src-070", "title": "Other source · src-070", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "other", "publisher_type": "corporate", "url": "" }, { "id": "src-071", "title": "Other source · src-071", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "other", "publisher_type": "corporate", "url": "" }, { "id": "src-072", "title": "Corporate registry source · src-072", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "corporate_registry", "publisher_type": "corporate", "url": "" }, { "id": "src-073", "title": "RESA publication RESA_2023_004.529: Triangle Holdings", "publisher": "Luxembourg Business Registers", "date": "2023-01-04", "locator": "Directors", "basis": "Retained copy of the document in the frozen case database, read in the passages cited by the claims.", "source_type": "corporate_registry", "publisher_type": "registry_operator", "url": "https://gd.lu/resa/bLSz0q" }, { "id": "src-074", "title": "RESA publication RESA_2023_142.1382: Triangle Holdings", "publisher": "Luxembourg Business Registers", "date": "2023-07-07", "locator": "Transfer of registered office", "basis": "Retained copy of the document in the frozen case database, read in the passages cited by the claims.", "source_type": "corporate_registry", "publisher_type": "registry_operator", "url": "https://gd.lu/resa/4nwDhH" }, { "id": "src-075", "title": "Corporate registry source · src-075", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "corporate_registry", "publisher_type": "corporate", "url": "" }, { "id": "src-076", "title": "Other source · src-076", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "other", "publisher_type": "corporate", "url": "" }, { "id": "src-077", "title": "Letter of Representative Summer L. Lee to the Secretary of Commerce regarding NSO Group", "publisher": "US House of Representatives (office of Rep. Summer L. Lee)", "date": "2026-05-06", "locator": "Letter", "basis": "Retained copy of the document in the frozen case database, read in the passages cited by the claims.", "source_type": "regulatory_record", "publisher_type": "government", "url": "https://summerlee.house.gov/sites/evo-subsites/summerlee.house.gov/files/evo-media-document/2026-05-06.lee-letter-to-commerce-re-nso-group.pdf" }, { "id": "src-078", "title": "MOD tightens control of cyber exports", "publisher": "Israel Ministry of Defense", "date": "2021-12-07", "locator": "Press release", "basis": "Retained copy of the document in the frozen case database, read in the passages cited by the claims.", "source_type": "regulatory_record", "publisher_type": "government", "url": "https://www.gov.il/en/pages/mod-tightens-control-of-cyber-exports-6-december-2021" }, { "id": "src-079", "title": "Media source · src-079", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "media", "publisher_type": "media", "url": "" }, { "id": "src-080", "title": "Media source · src-080", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "media", "publisher_type": "media", "url": "" }, { "id": "src-081", "title": "Court record source · src-081", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "court_record", "publisher_type": "nonprofit", "url": "" }, { "id": "src-082", "title": "Media source · src-082", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "media", "publisher_type": "media", "url": "" }, { "id": "src-083", "title": "Media source · src-083", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "media", "publisher_type": "media", "url": "" }, { "id": "src-084", "title": "Company statement source · src-084", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "company_statement", "publisher_type": "corporate", "url": "" }, { "id": "src-085", "title": "Court record source · src-085", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "court_record", "publisher_type": "nonprofit", "url": "" }, { "id": "src-086", "title": "Electronic Code of Federal Regulations: search for \"NSO Group\" (version history)", "publisher": "Office of the Federal Register (eCFR)", "date": "", "locator": "Supplement No. 4 to Part 744, versions from 2021", "basis": "Retained copy of the document in the frozen case database, read in the passages cited by the claims.", "source_type": "regulatory_record", "publisher_type": "government", "url": "https://www.ecfr.gov/api/search/v1/results?query=%22NSO%20Group%22&per_page=20" }, { "id": "src-087", "title": "Electronic Code of Federal Regulations: search for \"NSO Group\" as of 20 October 2026", "publisher": "Office of the Federal Register (eCFR)", "date": "2026-10-20", "locator": "Supplement No. 4 to Part 744, current version", "basis": "Retained copy of the document in the frozen case database, read in the passages cited by the claims.", "source_type": "regulatory_record", "publisher_type": "government", "url": "https://www.ecfr.gov/api/search/v1/results?query=%22NSO%20Group%22&date=2026-10-20&per_page=5" }, { "id": "src-088", "title": "Media source · src-088", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "media", "publisher_type": "media", "url": "" }, { "id": "src-089", "title": "Research source · src-089", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "research", "publisher_type": "nonprofit", "url": "" }, { "id": "src-090", "title": "Company statement source · src-090", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "company_statement", "publisher_type": "corporate", "url": "" }, { "id": "src-091", "title": "Media source · src-091", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "media", "publisher_type": "media", "url": "" }, { "id": "src-092", "title": "Media source · src-092", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "media", "publisher_type": "media", "url": "" }, { "id": "src-093", "title": "Media source · src-093", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "media", "publisher_type": "media", "url": "" }, { "id": "src-094", "title": "Other source · src-094", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "other", "publisher_type": "corporate", "url": "" }, { "id": "src-095", "title": "Corporate registry source · src-095", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "corporate_registry", "publisher_type": "corporate", "url": "" }, { "id": "src-096", "title": "Media source · src-096", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "media", "publisher_type": "media", "url": "" }, { "id": "src-097", "title": "Company statement source · src-097", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "company_statement", "publisher_type": "corporate", "url": "" }, { "id": "src-098", "title": "Media source · src-098", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "media", "publisher_type": "media", "url": "" }, { "id": "src-099", "title": "Media source · src-099", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "media", "publisher_type": "media", "url": "" }, { "id": "src-100", "title": "Regulatory record source · src-100", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "regulatory_record", "publisher_type": "nonprofit", "url": "" }, { "id": "src-101", "title": "Media source · src-101", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "media", "publisher_type": "media", "url": "" }, { "id": "src-102", "title": "NOAL SCSp and others v. Novalpina Capital LLP and others [2025] EWHC 1392 (Ch)", "publisher": "High Court of England and Wales (The National Archives)", "date": "2025-06-06", "locator": "Judgment", "basis": "Retained copy of the document in the frozen case database, read in the passages cited by the claims.", "source_type": "court_record", "publisher_type": "government", "url": "https://caselaw.nationalarchives.gov.uk/ewhc/ch/2025/1392" }, { "id": "src-103", "title": "Media source · src-103", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "media", "publisher_type": "media", "url": "" }, { "id": "src-104", "title": "Media source · src-104", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "media", "publisher_type": "media", "url": "" }, { "id": "src-105", "title": "Media source · src-105", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "media", "publisher_type": "media", "url": "" }, { "id": "src-106", "title": "Court record source · src-106", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "court_record", "publisher_type": "media", "url": "" }, { "id": "src-107", "title": "Media source · src-107", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "media", "publisher_type": "media", "url": "" }, { "id": "src-108", "title": "Research source · src-108", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "research", "publisher_type": "nonprofit", "url": "" }, { "id": "src-109", "title": "Other source · src-109", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "other", "publisher_type": "nonprofit", "url": "" }, { "id": "src-110", "title": "Corporate registry source · src-110", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "corporate_registry", "publisher_type": "corporate", "url": "" }, { "id": "src-111", "title": "Media source · src-111", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "media", "publisher_type": "media", "url": "" }, { "id": "src-112", "title": "Other source · src-112", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "other", "publisher_type": "corporate", "url": "" }, { "id": "src-113", "title": "Corporate registry source · src-113", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "corporate_registry", "publisher_type": "nonprofit", "url": "" }, { "id": "src-114", "title": "Media source · src-114", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "media", "publisher_type": "media", "url": "" }, { "id": "src-115", "title": "Media source · src-115", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "media", "publisher_type": "media", "url": "" }, { "id": "src-116", "title": "Other source · src-116", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "other", "publisher_type": "corporate", "url": "" }, { "id": "src-117", "title": "Media source · src-117", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "media", "publisher_type": "media", "url": "" }, { "id": "src-118", "title": "Media source · src-118", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "media", "publisher_type": "media", "url": "" }, { "id": "src-119", "title": "Media source · src-119", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "media", "publisher_type": "media", "url": "" }, { "id": "src-120", "title": "Media source · src-120", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "media", "publisher_type": "media", "url": "" }, { "id": "src-121", "title": "Sanctions list source · src-121", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "sanctions_list", "publisher_type": "corporate", "url": "" }, { "id": "src-122", "title": "Sanctions list source · src-122", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "sanctions_list", "publisher_type": "corporate", "url": "" }, { "id": "src-123", "title": "Media source · src-123", "publisher": "", "date": "", "locator": "", "basis": "Source classification retained; identifying metadata omitted.", "source_type": "media", "publisher_type": "nonprofit", "url": "" }, { "id": "src-124", "title": "Officers: Triangle Holdings S.A. (FC040779)", "publisher": "Companies House", "date": "2026-10-22", "locator": "Officer list", "basis": "Retained copy of the document in the frozen case database, read in the passages cited by the claims.", "source_type": "corporate_registry", "publisher_type": "registry_operator", "url": "https://find-and-update.company-information.service.gov.uk/company/FC040779/officers" } ], "atlas": { "version": "1.0", "reference": "dudil-report-assembler/2.19.0", "default_view": "target_overview", "hypotheses_default": true, "path_policy": "evidence_first", "context_entity_ids": [ "qcyber", "nso", "osy", "francisco", "osy-holdings", "triangle", "square2", "noal", "novalpina-luxco", "northpole-holdco", "northpole-bidco", "emerald", "northpole-newco", "diamond", "dufresne", "novalpina", "brg", "lavie", "schremer", "hippocrene", "qcyber-lux", "westbridge", "whatsapp", "bis", "friedman", "hulio" ] }, "case_id": "q-cyber-technologies", "version": "1.0", "as_of": "2026-10-22" }