Researchers: NSO Group used location data from thousands of unsuspecting people while pitching its COVID-19 contact-tracing tech to governments and journalists
Researchers say NSO's use of real data “violated the privacy” of thousands of people. — Spyware maker NSO Group used real … Tweets: @evacide , @josephfcox , @marietjeschaake , @zackwhittaker , and @profcarroll Tweets: Eva / @evacide : This is your regular reminder that NSO Group is bad and @zackwhittaker is good. https://techcrunch.com/... Joseph Cox / @josephfcox : Beyond their misleading earlier statement, why would they not use real location data to demonstrate a product. The billion dollar location data industry with dozens of companies is based on very real location data, trading this information everyday. https://twitter.com/... Marietje Schaake / @marietjeschaake : What standards to expect from hackers for hire? ↘️ https://twitter.com/... Zack Whittaker / @zackwhittaker : The researchers said if the data is real, then NSO “violated the privacy” of 32,000 individuals across Rwanda, Israel, Bahrain, Saudi Arabia and the United Arab Emirates (all said to have used NSO's spyware). NSO, predictably, denied the allegations.
Context & Ripple Effects
NSO Group's contact-tracing pitch began as a product story: in April 2020 it marketed software that uses mobile phone data to predict COVID-19 spread, claiming countries were already testing it. Two months later researchers found the underlying system — codenamed Fleming — sitting unprotected on the internet, which NSO dismissed as merely a demo.
This new reporting closes that loop awkwardly for NSO: the 'demo' was running on real location data from some 32,000 people who never consented, shown to the very governments and journalists being courted as buyers. It lands on a company whose core Pegasus business had already generated hundreds of millions in Gulf-state deals and is now documented in human-rights databases of authoritarian misuse.
First-order effects
- The 32,000 people whose location trails were used without consent are directly harmed, and NSO's denial puts it on record contradicting researchers over what its own flagship health-surveillance demo actually ran on.
- Governments and journalists who saw Fleming demonstrations now know the data behind the pitch was real individuals' movements, undermining the trust a sale depends on.
Second-order effects
- The finding feeds directly into the documentation effort around NSO's other products — a database of 60+ Pegasus abuses against dissidents — giving campaigners a second, consent-based line of attack rather than only a targeting one.
- It also complicates NSO's Washington push: after millions spent on lobbying were rebuffed by US law enforcement agencies, evidence of casual handling of civilians' location data gives hesitant buyers another reason to stay out.
Third-order effects
- If the pattern holds, commercial spyware firms expanding into public-health surveillance will face the same scrutiny as their espionage products, collapsing the distinction between 'health analytics' and intelligence tooling in procurement reviews.
- Consent becomes the battleground: a vendor caught repurposing real location data for demos hands regulators a template argument that applies to the broader location-brokerage ecosystem Fleming-style tools sit atop.
The trend: Commercial surveillance vendors are stretching from targeted spyware into population-scale health and location analytics just as researchers and rights groups close the documentation gap around them.