Operating from the Shadows: Inside NSO Group’s Corporate Structure

In this briefing, Amnesty International, PI and The Centre for Research on Multinational Corporations (SOMO) discuss the corporate structure of NSO group, one of the surveillance industry's well-known participants. The lack of transparency around NSO Group’s corporate structure and the lack of information about the relevant jurisdictions within which it operates are significant barriers in seeking prevention of, and accountability for, human rights violations reportedly linked to NSO Group’s products and services. The aim of this report is to give researchers, journalists, lawyers and HRDs information on NSO Group’s corporate structure. By documenting its structure, we shed light on the workings of this company, and provide an illustrative case study of the risks and corporate dynamics that characterise the broader surveillance industry.

As a form of government surveillance, government hacking presents unique and grave threats to our privacy and security. It has the potential to be far more intrusive than any other surveillance technique, permitting the government to remotely and surreptitiously access our personal devices and all the intimate information they store. It also permits the government to conduct novel forms of real-time surveillance, by covertly turning on a device's microphone, camera, or GPS-based locator technology, or by capturing continuous screenshots or seeing anything input into and output from the device.

Although it is possible that some governments manufacture tools to conduct targeted digital surveillance themselves, many states buy the sophisticated technology enabling such surveillance from private companies. They justify the procurement of these technologies as essential for maintaining law and order. Some of these surveillance companies manufacture and sell spyware or other such tools to state actors, who have, in addition to legitimate purposes, used surveillance to shrink the space for dissent by targeting human rights defenders, in violation of their internationally recognised human rights.

Little is known about the surveillance industry, as it operates from the shadows despite repeated calls for more transparency and accountability. This lack of transparency is a foundational challenge to human rights accountability. Without more information being made publicly available about the surveillance industry – for example identities and ownership of the companies facilitating government surveillance; the capabilities on offer; the scale of deployment; or details of company due diligence or remediation efforts – the international community is unable to ascertain the full scope of the human rights risks presented, mitigate those risks, or seek remedy when abuses occur.

PI, Amnesty International and SOMO recommend that states:

(a) implement the UN Special Rapporteur’s call for an immediate moratorium on the global sale and transfer of the products of the private surveillance industry until rigorous human rights safeguards are put in place to regulate such practices;

(b) adopt and enforce a legal framework requiring private surveillance companies to conduct human rights due diligence in their global operations, supply chains and in relation to the use of their products and services;

(c) adopt and enforce a legal framework requiring transparency in the key areas noted above by private surveillance companies;

(d) disclose contracts with such companies and implement human rights-based procurement standards;

(e) effectively regulate the export of surveillance technologies in a manner that prevents human rights abuses;

(f) adopt and enforce domestic legal frameworks that create human rights safeguards against surveillance abuses and accountability mechanisms for victims of such abuses; and

(g) participate in key multilateral efforts (e.g. in support of the UN Special Rapporteur’s call for an immediate moratorium on the sale, transfer and use of surveillance technology) to integrate human rights standards in the development, sale and transfer, and use of surveillance technology.

We further recommend that surveillance companies implement a broad range of human rights due diligence, transparency, and accountability measures, in accordance with the UN Guiding Principles on Business and Human Rights and the OECD Guidelines for Multinational Enterprises. We finally recommend that investors assess whether their investment portfolios include or may in the future include surveillance companies, and demand that any such portfolio companies fulfil their responsibilities to respect human rights in accordance with the UN Guiding Principles and OECD Guidelines.