A criminal investigation has been demanded in Israel, six years after the NSO group sold its Pegasus spyware to Ghana, through a private reseller to whom the responsibility of ensuring compliance with Ghana’s laws and human rights obligations was allegedly illegally outsourced.
On behalf of Israeli parliament’s former speaker, Avrum Burg, prominent sociologist Eva Illouz and 51 other academics and human rights activists, Advocate Eitay Mack wrote to the Attorney General (AG) of Israel, Gali Baharav-Miara, on Sunday, May 22, seeking a probe.
The complaint addressed to the AG asks her “to open a criminal investigation” into the allegedly illegal sale of the defense equipment by NSO to Ghana’s National Communications Authority (NCA) in 2016, through a Ghana-registered private company called Infralocks Development Limited (IDL).
Already under scrutiny in Israel and accused by journalists and activists across several continents of aiding violations of privacy and human rights, the NSO maintains that all its contracts with customers have clauses obliging compliance with all applicable laws – including those to protect human rights and privacy. In the case of Ghana, however, a reading of the contracts of this USD $8 million deal reveals that the NSO had actually placed these obligations, not on the NCA, but on IDL.
This little known private company based in Ghana’s capital Accra did not even possess the license to handle the export of Pegasus, according to the complaint. It further states that neither the NSO nor the officials in the Israeli Ministry of Defense (MOD) and Ministry of Foreign Affairs (MFA), who were involved in approving this sale, had verified whether this company was actually authorized by Ghana’s NCA.
When the equipment was exported to Ghana, set-up and demonstrated by NSO’s engineers in mid-2016, it was not installed in any premises of the NCA, but in a private residence. Yet, no investigation has been conducted by Israeli authorities, the complaint points out.
Years later, in May 2020, Accra High Court ruled that this purchase of Pegasus was corrupt, illegal and unauthorized. Two senior NCA officials involved in the illegal purchase – along with the then National Security Coordinator (NSC) at whose behest the former two had acted – were convicted and imprisoned by this judgment. Noting that the purchase, which had not been budgeted for, had caused significant losses to the state, the court had also ordered the seizure of US$3 million worth of assets from the convicted government officials.
Earlier this year, Channel 13 ‘Hamakor’ report aired footage of the Pegasus equipment in Ghana, along with testimonies of NSO’s engineers who had installed the equipment at the private residence, set-up the software and trained the local staff in operating it. However, no heads have rolled in Israel.
“It is shameful that the former Attorney General, Avichai Mandelblit, did not open an investigation on his own initiative,” Mack stated in the letter. He has asked the AG on behalf of the complainants “to open criminal investigation against the company NSO and the officials in the MOD and MFA because of suspicion for their involvement in conspiracy and corruption in the Republic of Ghana.”
Recounting that in an earlier complaint he had filed in 2018 “on exports to Guatemala, the MOD [had] refused to provide relevant documents to the Ministry of Justice”, Mack has sought measures to prevent concealment of evidence and “disruption of investigation”.
He has asked the AG “to order the immediate seizure of all existing documents in the offices of the MOD and MFA, and in the office of NSO, about the export license to Ghana, the minutes from the discussions that preceded the approval of the license, the transfer and physical assembly of the system in Ghana, and the training and day-to-day services that NSO workers gave for operating the system.”
No contract between NSO and its customer
Central to this case for criminal investigation is the fact the NSO did not enter into a contract with Ghana’s NCA, the end-user to whom Pegasus was being sold. Instead, on December 17, 2015, the NSO’s group’s sales manager Ori Magal signed a contract with IDL’s Director of Business Development, George Oppong. IDL was recognized as the reseller in this contract. IDL in turn signed another end-user contract with Ghana’s NCA. As a result, there was no direct contract between NSO and NCA.
As per the Israeli Defense Export Control Law, 5766-2007, IDL was required to procure an interim-user license to handle export of such equipment. “There is no doubt that the Pegasus system is considered defense equipment as defined in section 2 of the Control Law,” Mack argues. The contract with NSO, however, does not require IDL to procure such a license.
“There is no plausible explanation as to why the agreement does not state that NSO must also require an interim-user license for IDL,” the complaint explains. “This reinforces the wonder why a reseller company was required in the first place and encourages suspicion that it was convenient for NSO company and the officials in the MOD and MFA that the IDL will not be part of the official chain of licenses.”
It further states, “Even assuming there was some (unknown) reason to use IDL as a reseller and not directly sign a contract with the NCA, encouraging suspicion, NSO company and the officials in the MOD and MFA did not condition the export of the Pegasus system by IDL” on the confirmation of IDL’s authorization to make representations on behalf of Ghana’s NCA.
In the second contract IDL’s Oppong signed with Ghana NCA’s Director General William Tevie, the NCA did not validate, or even refer to, these representations. For instance, Section 17.5 of the contract between NSO and IDL states:
“The Reseller (IDL) hereby represents that under an agreement to be entered into with the End-User (NCA), the End-User will warrant that it and its respective employees and agents shall: (i) fully comply with all applicable privacy and national security related laws and regulation that are applicable to the use of the System, including by the way of obtaining consents and/or decrees to the extent required by law, and (ii) use the System only for prevention and investigation of crimes and will not be used for human rights violations.”
There is no such commitment made by the NCA in its contract with IDL. Despite the fact that this failure of the NCA to make such a commitment in its contract with the IDL is a contravention of the contract between NSO and IDL, the NSO went ahead with the sale.
This is also a contravention of NSO’s stated position that its clients commit in their contracts with NSO to use Pegasus only for the “legitimate and lawful prevention and the investigation of serious crimes and terrorism”. Its Transparency and Responsibility Report (TRR) of 2021 and Human Rights Policy 2019 reiterate that all its contracts with customers have obligations to not use Pegasus in a manner that violates any of the domestic or other applicable laws, human rights and rights to privacy.
However, as explained before, NSO did not even enter into a contract with its customer in Ghana. The contract its customer had was only with the reseller of its equipment. And no such obligations are placed on the customer in this contract.
“Are private resellers involved in the sale of Pegasus to other countries’ government bodies as well?”, was among the questions Peoples Dispatch had asked the NSO’s spokesperson in an email on April 10. Despite follow-up mails and several calls and messages, NSO’s spokesperson has not provided any response.
The absence of commitment to human rights, privacy rights etc in NCA’s contract with IDL is not the only irregularity, which should have stopped NSO from making the sale. Section 17.1 of the contract between NSO and IDL states:
“Reseller (IDL) hereby represents and warrants that the execution and delivery of this Agreement and the fulfillment of its terms: (i) will not constitute a default under or conflict with any agreement or other instrument to which the End-User (NCA) is a party or by which it is bound; and (ii) other than as specifically set forth in this Agreement, does not require any further consent of any person or entity.”
NSO accepted assurances from unauthorized private businessman
The NCA never gave the aforementioned assurances in its contract with the IDL. The May 2020 judgment of Accra High Court established that all claims made in these representations by IDL on behalf of NCA were false. However, IDL’s Oppong, who made these representations, was the only accused to be acquitted in this case.
The reason stated for his acquittal in the judgment was that he was “not a public servant but a private businessman” who was only “engaged as a reseller of the equipment.. (and) was not in a position to know the internal processes and procedures that NCA had undertaken before NCA embarked on the quest to procure the cyber equipment.”
This line of reasoning that a private businessman cannot be expected to know the internal processes of a government body is fairly obvious. “How do you explain the fact that the NSO had accepted the assurances given by a private businessman regarding a government body which he neither heads, nor is a part of?,” was another question the NSO did not answer.
In case the contract between NSO and IDL is terminated “for any reason”, it is this private businessman who is required by Section 9 to “cause the End-User (NCA) to return to the Company (NSO), all Confidential Information, including all records, products and samples received, and any copies thereof, whether in its possession or under its control”. NSO has not answered on what grounds it had convinced itself that a private businessman will be able to “cause” a government body to do so.
Despite the two contracts contradicting each other and NSO’s stated policy on imposing contractual obligations on its customers, NSO went ahead with the sale, with the evident approval of the MOD.
“Even after we have completed our internal human rights processes, we are closely regulated by export control authorities in the countries from which we export our products: Israel, Bulgaria and Cyprus,” NSO’s TRR states, implying that, in case of violations, the buck does not stop at its doorstep.
“The Defense Export Controls Agency (DECA) of the Israeli Ministry of Defense strictly restricts the licensing of Pegasus, conducting its own analysis of potential customers from a human rights perspective,” it adds.
The complaint addressed to the AG on Friday states “an investigation is needed against the director of the Defense Exports Control Agency (DECA) in the Ministry of Defense, and the head of the defense exports unit in the Ministry of Foreign Affairs, who were together responsible on regulating the export of the Pegasus system to Ghana.”
MOD’s regulatory authority is also recognized in Section 5.1 of both contracts, which subject fulfillment of the contract to several conditions, including “the approval of the IMOD for the provision of the License, System and the Services [to NCA] as set forth herein (the “Approval”)”. Section 5.2 adds. “For the avoidance of any doubt, no products, licenses, equipment or services shall be provided.. until.. the Approval is obtained.”
A six months-leeway is provided in the same section, which explains that if the Approval is not obtained within six months of signing, or if the Approval is denied, canceled or suspended, NSO retains the right to terminate the agreement. Before the end of these six months, on June 10, 2016, in a “Letter of Confirmation” to EcoBank Ghana Limited and to the NSO (written to fulfill a requirement for the processing of the payment of second installment of US$3 million to NSO), NCA stated:
“…as of June 10, 2016, the following terms were fully completed and accomplished:
- The Hardware Equipment was delivered to the End-User’s site and installed on premises.
- The Company (NSO) performed the Deployment, provided software set-up, installation and configuration services (the “Software Services”).
- The Company (NSO) presented to the End User, on site, the capabilities of the system on a sample of two devices per each Operating System (i.e Android, IOS and Blackberry)”.
This letter, read in conjunction with the section 5.1 and 5.2 of the two contracts, indicates that since “products, licenses, equipment or services” were provided to the End-User, the MOD did give the Approval.
In an email on April 10, Peoples Dispatch asked the MOD to explain why it had given the Approval despite all the above stated irregularities. While assuring a response on follow-up phone calls, a month and half since the email, Peoples Dispatch is yet to receive a response. The article will be updated to reflect the same when and if responses are provided.
Was technical equipment operated in Ghana?
The letter and the contracts have come to public domain because, later in December that year, the ruling National Democratic Congress (NDC), which had signed the contract to purchase this spyware a year before election, was voted out. The new government formed by the New Patriotic Party (NPP) initiated an investigation in 2017, since when the matter had been brought before the Accra High Court, which gave its order in May 2020.
A five year jail term was handed to Salifu Osman, the National Security Coordinator at the time, and to William Tevie, who signed the contract with IDL’s Oppong as NCA’s Director General. NCA board’s chairman at the time of the purchase, Eugene Baffoe-Bonnie, who had profited US$200,000 from the deal, was given a prison sentence of six years.
Subsequently, when NSO’s spokesperson was contacted by Channel 13 before publishing their report in January 2022, his initial response was “NSO has never operated systems in Ghana.” The complaint points out that only after realizing that Channel 13 was in possession of footage, the NSO updated its response with:
“The chain of events in Ghana illustrates well the strict implementation of the ethics and human rights policy that the company has enshrined in its banner. After receiving all legal permits, the company installed the technical equipment in Ghana without operating it. A few months later, during the training for the client, significant questions arose from the Israeli training team regarding the ethics and manner of Ghana’s future use of the system. After the inspection, it was decided in an unusual manner not to allow the customer to operate the system.”
However, this claim that the technical equipment was never operated contradicts the letter on July 10, 2016, in which NCA confirmed otherwise to Eco Bank and to NSO. The Accra High Court’s judgment also established the fact that the equipment had been operated, by noting that the second installment of US$3 million, to process which the July 2016 letter was sent, was to be made only after Eco Bank receives:
“written confirmation signed by the end user confirming that the hardware equipment had been delivered together with assurance that NSO had performed the deployment, software set-up, installation and configuration services.”
After these conditions were met by NSO, the NCA paid USD $3 million to IDL, and IDL initiated the payment of the same to NSO. However, Ecobank did not process the payment. It sought more documentation to be in compliance with the Foreign Exchange Act. While this was being sorted with back and forth correspondences between the bank and the NSO, the government changed and investigation began.
“Contrary to the NSO response that it stopped its services in Ghana because of its ‘strict ethics’, according to the convicting ruling, it is clear that even after NSO realized that there was a problem transferring the balance of payments to its bank account and that its system was installed in a private apartment, the company and the officials in the IMOD and IMFA did not report to the Ghanaian authorities that they suspect something was wrong,” the complaint states.
“NSO’s decision to discontinue its services appears to have been only due to the cessation of payments, and in any case since it chose not to file in its own initiative a complaint and to conceal its suspicions, there is an impression that NSO preferred that no investigation be opened into a transaction in which it was involved,” adds the complaint filed by Mack on behalf of the parliament’s former speaker Avrum Burg and 52 other academics.
It is to be noted, however, that this discontinuity in services does not necessarily imply that Pegasus is presently not in use in Ghana.
Where is the Pegasus equipment now?
Ghana Business News reported in January 2022 that among those potentially targeted with the spyware in Ghana last year was Stanislav Dogbe, former aide to president John Mahama, under whose NDC-led government Pegasus was purchased in 2016. Others potential targets named in this report were NDC General Secretary’s son, Kweku Asiedu-Nketia, and David Tamakloe, editor in chief of Whatsup News, whom the report describes as “a known sympathizer of the NDC”.
Emmanuel Dogbevi, chief editor of the news portal and author of this report confirmed to Peoples Dispatch that all three had received an Apple alert notification, titled “State Sponsored attackers may be targeting your iPhone” in November 2021. Attempts to collect more information from Dogbe and Tamakloe in February have not been successful.
Several journalists and activists Peoples Dispatch spoke to are of the opinion that the Pegasus remains in use in Ghana. However, many opined, there is a sort of an omerta – a vow of silence – on the question of what happened to the equipment after the investigation and whether it is in use. Because the ruling NPP, which is reportedly using it against the opposition, as well as the largest opposition party NDC, under whose former government Pegasus was illegally purchased, are both now in the same boat. Rocking it is not in the interest of either.
Peoples Dispatch had also contacted Ghana’s NCA in February to inquire under whose authority or control is the Pegasus equipment currently placed, and whether NCA has any existing contracts with the NSO. Nana Badu, Director of Consumer and Corporate Affairs of NCA, replied, “The NCA respectfully refrains from responding to the questions.”
Section 9 of both agreements require that in case the agreement is terminated, the Pegasus equipment, along with any data gathered using it, should be returned to the NSO, and any copies made of this data should be erased. Neither the NSO nor the NCA has confirmed that the equipment has been returned.
If the Attorney General of Israel orders the criminal investigation demanded in this complaint, it could cause further trouble to NSO which is already under scrutiny. Prime Minister Naftali Bennett had said in February that the Deputy Attorney General was “looking quickly into” the well-documented allegations that police in Israel are using this military grade spyware on its own citizens, without securing any court order. Public security minister, Omer Barlev, also said that he would open an inquiry.
A complaint was filed in France in April by French-Palestinian human rights defender Salah Hammouri, whose phone was illegally infiltrated with this spyware. The International Federation for Human Rights (FIDH) and the Ligue desdroits de l’homme (LDH) are his fellow-complainants in this case.
Reporters Without Borders (RSF), along with two French-Moroccan journalists, Omar Brouksy and Maati Monjib, who had been facing persecution by the Moroccan government also filed a case in France last year.
“Other complaints will follow in other countries. The scale of the violations that have been revealed calls for a major legal response,” RSF secretary-general Christophe Deloire had said at the time. 17 other targeted journalists from seven countries including India, Mexico, Spain, Hungary, Azerbaijan, Morocco and Togo subsequently joined this complaint. The RSF has also referred all these cases to the UN.
