Everything we know about the secretive NSO Group and its founder Omri Lavie, who are behind the latest iPhone hacks
NSO Group employees' lives must seem no different from others in the Israeli tech scene. They turn up every morning at their office in Herzelia, in Tel Aviv's northern district …
Context & Ripple Effects
This 2016 profile of NSO Group and founder Omri Lavie is the earliest entry point in the coverage arc: at the time, the Herzelia-based firm was best known for the latest iPhone hacks, and almost nothing else was public about it. What followed turned that secrecy into a liability — sources later detailed hundreds of millions of dollars in Pegasus deals across Gulf states, and an Israeli indictment alleged an employee stole the hacking tools' source code to sell for $50M.
By 2021 the same company WaPo framed as an 'Israeli version of a Silicon Valley success story' was facing a very different reckoning: Meta's lawsuit over the 2019 attack on more than 1,400 WhatsApp users ended with NSO found liable and ordered to pay $167 million, while Israeli officials opened their own investigation into Pegasus abuse allegations.
First-order effects
- iPhone users targeted by NSO's exploits face direct compromise of their devices, putting pressure on Apple to harden iOS against attacks sold by a single vendor rather than opportunistic criminals.
- NSO's Gulf-state government clients gain working intrusion capability against iPhones, which the reporting ties to deals worth hundreds of millions of dollars.
Second-order effects
- Meta's successful suit — liability for the 1,400-user WhatsApp attack and the $167M damages order — turns legal exposure into a recurring cost of doing business for NSO, a template other platforms hit by Pegasus can follow.
- Because Pegasus requires an Israeli export license as a classified weapon, Jerusalem gains pricing power over NSO's client list, folding the firm's sales into Israel's diplomatic outreach.
Third-order effects
- If the pattern holds, commercial spyware firms get regulated like arms merchants — export licenses, government audits such as the one at NSO's Tel Aviv office, and court judgments — collapsing the fiction that they are ordinary software companies.
- Secrecy stops being an asset: the source-code theft indictment shows how a leak-prone, high-value toolset forces even the most opaque vendors toward the scrutiny they were built to avoid.
The trend: Commercial spyware is consolidating into a state-supervised weapons trade, where export licenses and platform lawsuits — not market competition — determine which vendors survive.