Export controls, the US Entity List and lobbying by NSO and Q Cyber

analysisNSO Group's 2025 transparency report states that its products are classified as defence articles under Israeli law and that every marketing activity and export transaction requires prior authorisation from the Israeli Ministry of Defense through its Defense Exports Control Agency (DECA), with transaction-specific licences that are subject to renewal and ongoing oversight. A legal opinion published by Novalpina in 2019, as described in the 2021 NGO report, likewise confirmed that all of NSO Group's then products fell within Israel's defence export control regime under the 2007 Defence Export Control Law. These are the company's own description and an opinion published by its then owner. In an open letter of April 2019 to Novalpina, copied to NSO Group and Francisco Partners, a coalition of NGOs including Amnesty International, Access Now, the Committee to Protect Journalists, Human Rights Watch and Privacy International wrote that Novalpina had given background on NSO's compliance with export rules but no data on its export licences; Novalpina had answered the coalition's first letter on 1 March 2019, a reply the NGO report cites but which was not retained. ^{1 2 3}

analysisIn July 2021, as reported by Israeli press, Israel's Defence Ministry said that if NSO's products were found to have been used in violation of the licence conditions or of the purchasing countries' declarations it would take appropriate action, and that the State of Israel has no access to the information collected by NSO's customers. On 6 December 2021 the ministry's export control agency announced that it had tightened control of cyber exports by publishing an updated End User Declaration, which a state seeking a cyber or intelligence system must sign as a condition for the export licence; the announcement does not name NSO, and no retained document records a finding about NSO's licences. ^{4 5}

analysisAccording to NSO's transparency reports as summarised by the press in January 2026, the company said it suspended or terminated six unnamed government customers in 2022–2023 at a revenue loss of $57 million and rejected more than $20 million of new business in 2024 for human rights reasons; these are the company's own figures. The publication noted that the 2025 report, unlike earlier ones, lacks figures on how many customers were rejected, investigated, suspended or terminated over human rights abuses, quoted critics who saw it as part of a campaign to leave the Entity List, and said an NSO spokesperson had not provided comparable figures by its deadline. ⁶

analysisBy a rule published in the Federal Register on 4 November 2021 (document 2021-24123), the US Commerce Department's Bureau of Industry and Security added "NSO Group", at 22 Galgalei Haplada, Herzliya, to the Entity List, requiring a licence for all items subject to the Export Administration Regulations with a presumption of denial. The End-User Review Committee found that NSO Group and Candiru developed and supplied spyware to foreign governments that used it to target government officials, journalists, businesspeople, activists, academics and embassy workers, contrary to US national security and foreign policy interests. The entry names "NSO Group" at the address that both NSO Group Technologies and Q Cyber Technologies gave in their 2019 Israeli annual reports, without either company's register number. ¹

analysisThe official electronic Code of Federal Regulations, read on 20 October 2026, shows the NSO Group entry with its presumption-of-denial licence policy in the version of the Entity List in force from 16 July 2026 with no end date and in each listed version since 26 November 2021, none marking it as removed; this records the entry's presence, not any licensing decisions under it. A screening service checked in October 2026 likewise returned "NSO Group" in the US Consolidated Screening List under the Entity List programme (US-BIS-EL), with the topic export control and country Israel; that result reflects the same designation and is not a separate sanction. ^{2 3 4}

analysisQ Cyber itself retained a US public-affairs firm after the WhatsApp suit. In the Foreign Agents Registration Act filing received on 25 December 2019, Mercury Public Affairs placed its foreign principal Q Cyber Technologies Ltd in the FARA category "controlled by a foreign government, foreign political party, or other foreign principal", explaining that some of its technology offerings were expected to be marketed to government clients and that the Israeli Ministry of Defense may deny such sales. The attached agreement, signed for Q Cyber by its general legal counsel, retained Mercury from 15 December 2019 to 30 November 2020 and month to month thereafter for $120,000 a month plus a one-time compliance fee of $5,000. US public-relations trade press reported in January 2020 that Q Cyber had signed Mercury to a $1.2 million contract for crisis communications, media outreach and government relations concerning the WhatsApp suit, and the 2021 NGO report notes a statement distributed by Mercury for Q Cyber and filed with the Justice Department's FARA unit on 2 October 2020. ^{1 2 3}

analysisAn Israeli investigative outlet reported in July 2022, with a US non-profit newsroom, that after the listing NSO spent hundreds of thousands of dollars on US lobbyists, lawyers and public relations to be removed, and that Israeli government contacts with the US administration were led by Israel's National Security Council, part of the Prime Minister's Office. The White House, as quoted by the outlet, said it was not and had not been involved in considering any request to remove a foreign commercial spyware company from the Entity List. Luxembourg press reported in April 2026 that the listing remained in force and that no decision to remove NSO had been published, and the official register still shows the entry. ^{4 5}

analysisA US technology-policy publication reported in March 2026, compiling US business press reporting and lobbying disclosures, that the campaign cost at least $7.6 million in lobbying fees between 2020 and 2024 and at least $190,000 in 2025. It lists firms engaged through Q Cyber, including Mercury Public Affairs (2019–2021) and Arnold & Porter (timing unknown), and Paul, Weiss through Q Cyber's owner OSY Technologies (2019), and names Michael Flynn among earlier advisers, paid nearly $100,000 by NSO's parent companies. According to the same publication, NSO's outreach, including contacts with Jared Kushner and approaches from the Israeli prime minister's office, did not succeed: in May 2025 National Security Council officials turned away Vogel Group lobbyists seeking a meeting on NSO's behalf, and Vogel's lobbying for NSO lasted only a few months. ⁶

analysisIn a letter of 6 May 2026 to the Commerce Secretary, Representative Summer L. Lee wrote that since the designation NSO had experienced a "financial freefall" and nearly defaulted on $500 million of debt and that in 2023 it reportedly spent nearly $1 million on lobbying, and asked for a briefing on NSO's purchase by an American company and on contacts with David Friedman. The letter relies on press reports and is not a finding of any agency. ⁷

analysisNSO Group told the 2021 NGO report's authors that NSO Group Technologies, Q Cyber Technologies Ltd., Convexum, Wayout and the Bulgarian group companies export products and obtain licences for all products that require them, that group entities export from Israel, Bulgaria and Cyprus, and that each of those countries had at some point denied group licence applications. Novalpina said in March 2019 that some NSO products are exported from the EU, from Bulgaria or Cyprus, after consultation with the competent authority. The 2023 European Parliament report records that NSO denies that Pegasus is exported from Cyprus or Bulgaria and that the Cypriot and Bulgarian governments deny granting export permits to NSO companies; it calls the Bulgarian and Novalpina statements contradictory. ^{1 2}

analysisAccording to the NGO report, Circles Bulgaria EOOD and Magnet Bulgaria EOOD, held through IOTA Holdings, a subsidiary of OSY, are registered to obtain Bulgarian export licences; NSO Group said Magnet Bulgaria is inactive, that its registration with the Bulgarian export control authority lapsed in 2020, and that it never obtained licences to export the products named Vole or Pixcell. In June 2026 an international human rights organisation and a European news outlet reported, from Bulgarian licensing records for 2018–2023 that they reviewed but did not publish, that Bulgaria licensed Circles BG, a Sofia-based company affiliated with NSO, to sell interception systems, mobile-tracking tools and surveillance infrastructure to intelligence agencies in Azerbaijan, Serbia, Malaysia and Mexico; the human rights organisation said the records also show licensed exports to Q Cyber Technologies and NSO Group in Israel, and the news outlet reported that in at least one case involving Brazil an export transited through the Luxembourg Q Cyber Technologies; the organisation noted that the licences do not show whether the technology was actually exported. The outlet reported that NSO bought technology from Circles for $119,941 in October 2021, later transferred to the Home Front Command of Israel's Defence Ministry. The human rights organisation describes Q Cyber Technologies as the umbrella company formed when Circles was bought in 2014, whereas the Israeli company was incorporated in December 2013 as L.E.G.D. Company Ltd and renamed Q Cyber Technologies Ltd in 2016; the reporting does not establish that any export was unlawful. Circles did not respond to repeated requests for comment from either outlet. Bulgaria's foreign ministry said the documentation provided by Circles showed the technologies were intended for crime and terrorism investigation and search and rescue, and that all relevant circumstances, including end-use documents, are assessed when examining applications. ^{1 3 4 5}

analysisIn a 2026 reply to an access-to-information request, annexed to the human rights organisation's report, Bulgaria's Ministry of Economy and Industry provided copies of surveillance export permits with the exporter, end user, product type and permit numbers deleted as commercially sensitive, so they do not show which company was the exporter; an appeal against the restricted access was pending in court. ⁶

analysisLuxembourg's foreign ministry and economy minister stated in February 2019, according to the NGO report, that the Luxembourg entity linked to NSO had never sought an export licence in Luxembourg. The European Parliament report records that after the 2021 NGO report identified nine NSO-related companies in Luxembourg in June 2021, Foreign Minister Jean Asselborn wrote to each, and that none was authorised to export cyber-surveillance products from Luxembourg; NSO Group replied, according to Luxembourg press cited in the report, that it exports its spyware only from Israel with the Israeli government's consent, which Asselborn said in October 2021 he could not verify. Written question No. 3833, "Activities of NSO Group in Luxembourg and possible links with Togo", was tabled on 23 March 2026 by the deputies Sven Clement and Marc Goergen and answered in writing on 28 April 2026 by the economy minister Lex Delles and the foreign minister Xavier Bettel; Luxembourg press reported that the answer confirmed that the export control office had received no requests from the nine entities since the July 2021 letters. The text of the answer is not on the retained page. ^{1 2 7 8}