Explained: The significance of US putting NSO Group on its Entity List

The United States Department of Commerce has added Israeli spyware company NSO Group, the maker of Pegasus, to its Entity List. What does mean, and does it have implications for India?

A logo adorns a wall on a branch of the Israeli NSO Group company, near the southern Israeli town of Sapir on Aug. 24, 2021. (AP Photo/Sebastian Scheiner, File)

Written by: Pranav Mukul, Aashish Aryan

3 min readNew DelhiNov 4, 2021 03:36 PM IST First published on: Nov 4, 2021 at 09:22 AM IST

Israeli spyware company NSO Group, the maker of phone-hacking tool Pegasus, has been added to a federal blacklist by the US Department of Commerce, thereby restricting it from accessing America-made technologies.

What has the US government done?

The US government has added Israel’s NSO Group and Candiru, alongside Russian cybersecurity firm Positive Technologies and Singapore-based Computer Security Initiative Consultancy Pte, to its Entity List. In particular, the Israeli companies were added to the list “based on evidence that these entities developed and supplied spyware to foreign governments that used these tools to maliciously target government officials, journalists, businesspeople, activists, academics, and embassy workers”.

What are some of the other companies added to the Entity List?

Chinese technology firm Huawei was added to the list in May 2019 by the Donald Trump-administration on the basis of information that provided “a reasonable basis to conclude that Huawei is engaged in activities that are contrary to US national security or foreign policy interests and its non-US affiliates pose a significant risk of involvement in activities contrary to the national security of the United States”.

Additionally, Hong Kong-based textile maker Esquel’s unit in Xinjiang district in China was also added to the Entity List over allegations of ties to forced labour. The company, one of the world’s largest shirt makers, supplied to top brands such as Nike and Tommy Hilfiger.

What is the significance of the US government’s move?

Being added to the Entity List means the companies will not be able to access American hardware and software. However, given that companies like NSO Group and Candiru operate covertly, unlike public facing products of companies like Huawei, enforcement of the restrictions remain unclear.

Trade experts, though, have argued that this is an important flag planted by the US, given that most decisions earlier to put companies on the Entity List involved China, with which the US was embroiled in a trade war at the time. However, this time, the US has taken a stance on a company being operated out of Israel — a long time US ally.

In a statement, US Secretary of Commerce Gina M. Raimondo said: “The United States is committed to aggressively using export controls to hold companies accountable that develop, traffic, or use technologies to conduct malicious activities that threaten the cybersecurity of members of civil society, dissidents, government officials, and organizations here and abroad.”

Does this decision mean anything for India?

An official from the Indian Ministry of Electronics and Information Technology said that though addition of companies to the list does not outright bar any non-US company or country from doing business with such companies, most “avoid” doing business for the “fear of sanctions”.

Last month, the Supreme Court of India appointed a committee presided by Justice (Retd.) R V Raveendran to inquire into the Pegasus revelations.

Newsletter | Click to get the day’s best explainers in your inbox