Sometime in 2019, one of Israel’s top law firms, which advises almost all Israeli defence companies, was engaged by Stephen Peel, one of the founders of Novalpina, a London-based equity firm to seek legal advice on a particular issue. Novalpina was set up by Peel and two others, Stefan Kowski and Bastian Lueken in 2017.

The subject matter in the present case was a spying firm, the Tel Aviv-based NSO group (which owns the Pegasus software), that was acquired by Novalpina in February 2019 from its existing owners for $1 billion.

In its correspondence with Novalpina, the law firm shared its legal advice on two questions that were put to it by Peel on behalf of Novalpina—“Legal rules applicable to NSO regarding sharing of information related to defence exports”, and secondly, “What information relating to such exports can be shared with third parties, especially non-Israeli third parties”.

The Sunday Guardian has accessed this correspondence. The firm, in its advice to Peel, stated that the defence export control regime in Israel is administered by the Defence Export Control Agency (DECA), a body under the Ministry of Defence (MoD). It further made it clear that all of NSO’s products come under the defence export control regime and hence their exports and sharing of information related to it were governed by DECA or more specifically the Israeli MoD. Those Israeli companies who make such products that come under DECA, have to go through a four-stage process to get the exporting licence—register itself with the Defence Exporters Registry that is managed by DECA, register all their products, what it does, how it does, with DECA, then they become eligible to apply for a marketing licence after which a licence to export is given to them.

Simply put, no Israeli defence product, including Pegasus that is made by NSO, can be allowed to go outside the country without the permission of the officials at the Israeli MoD. During the licensing process, as per the use of the product or services, it is classified as “unclassified”, “confidential”, “secret” and “top secret”, which is the highest classification.

As per the information accessed by The Sunday Guardian, Pegasus was classified as a “top secret” product. The Sunday Guardian’s queries to the Israeli MoD on the specific classification that was awarded to Pegasus and related queries did not elicit any response. Novalpina, too, chose not to respond to the queries on the issue.

The NSO group, in its response to The Sunday Guardian, stated: “The list is not a list of targets or potential targets of Pegasus. The numbers in the list are not related to the NSO group. Any claim that a name in the list is necessarily related to a Pegasus target or Pegasus potential target is erroneous and false. NSO is a technology company. We do not operate the system, nor do we have access to the data of our customers, yet they are obligated to provide us with such information under investigations. NSO will thoroughly investigate any credible proof of misuse of its technologies, as we always had, and will shut down the system where necessary.”

The legal advice shared by the law firm further went on to state that in the situation the licence for the product has been classified as “confidential” or of a higher category, all of its content would be deemed as “secret information” under Israeli law.

Consequently, providing any such information to an unauthorized third party (Israeli or otherwise) would be a violation of Section 113 of the Israeli Penal Law (similar to Official Secrets Act of India) and invite criminal proceedings. More importantly, the law firm warned Novalpina that even if the product was of “unclassified” category, then also its content cannot be shared with anyone as per the directions of DECA.

DECA or the Israeli MoD has, in fact, totally prohibited sharing of any information related to the licence or the product with any third party without the express written and prior authorization of DECA. This means that even if an Indian private individual moves the Supreme Court to force the NSO group to share the kind of work it does in India or whether its software was used to spy on Indian individuals, the NSO group will first need the written permission of the Israeli MoD before responding to any such question by the Supreme Court.

Significantly, the legal firm, in its advice, stated that it was aware of several cases in which the DECA’s confidentiality was invoked by NSO where it faced international investigations and court proceedings. As a result of this, the NSO group was saved from sharing any information about its products.

The same confidentiality clause was used by other defence companies to seek exemption from divulging details to Israeli banks who had sought the same for the purpose of anti-money laundering verifications. In fact, the same confidentiality clause was used by the Israeli MoD to refuse to share details about the security agreements between Sri Lanka and Israel.

The law firm then makes it clear that any violation of DECA clauses could result in serious consequences, including revocation of licence and registration, monetary fines and in cases, initiation of criminal proceedings. To put in the present context, if the NSO were to share the details of its clients—which it had already shared with the Israeli MoD—with the Indian media, then it would find itself in serious trouble, including prison time for its directors. The law firm further told Stephen Peel that top DECA officials had confirmed to them that they expected strict compliance of the confidentiality requirement by the defence exporters that included the NSO.

In its summary, the law firm advised Peel that it is strictly prohibited for the Israeli exporters to share information relating to any licence received from the Israeli MoD, while adding that the prohibition is wide in scope and ensures that nothing, including customer information, product information, number of licences issued or the names of the customer country, is divulged to anyone.

The ownership of the NSO group is structured through multiple layers. NSO group or Q cyber technologies is wholly-owned by OSY Technologies, a Luxembourg company. OSY, in turn, is wholly-owned (via multiple intermediate holding companies) by Square 2. Square 2 is approximately 32% owned by Triangle Holding, a Luxembourg company, and approximately 68% owned by North Pole Holdco, another Luxembourg company. North Pole is wholly-owned by Novalpina Capital Partners.