The hacker-for-hire industry is now too big to fail

NSO Group has been besieged by criticism and charges of abuse for years. In 2016, the United Arab Emirates was caught targeting human rights activist Ahmed Mansoor using NSO Group’s Pegasus, a tool that leverages software flaws to hack iPhones and turn control over to NSO Group’s customers. In that case, the UAE government was seen as the culprit, and NSO walked away unscathed (Mansoor is still in prison on charges of criticizing the country’s regime).

The pattern repeated for years–over and over again, governments would be accused of using NSO hacking tools against dissidents but the company denied wrongdoing and escaped punishment. Then, in mid-2021, new reports emerged of alleged abuse against Western governments. The company was sanctioned by the US in November, and in December Reuters reported that US State Department officials had been hacked using Pegasus. 

Now NSO Group faces expensive public lawsuits from Facebook and Apple. It has to deal with debt, low morale, and fundamental threats to its future. Suddenly, the poster child for spyware is confronting an existential crisis. 

All of this is familiar territory. The secretive hacker-for-hire industry first splashed across international newspaper headlines in 2014, when the Italian firm Hacking Team was charged with selling its “untraceable” spyware to dozens of countries without regard for human rights or privacy violations. 

Hacking Team opened the world’s eyes to a global industry that bought and sold powerful tools to break into computers anywhere. The resulting storm of scandals seemed to eventually kill it. The company lost business and the ability to legally sell its tools internationally. Hacking Team was sold and, in the public’s mind, left for dead. Eventually, however, it rebranded and started selling the same products. Only this time, it was a smaller fish in a much bigger pond.

“The demise of Hacking Team did not lead to fundamental change in the industry at all,” says James Shires, assistant professor at the Institute of Security and Global Affairs at Leiden University. “The same dynamic and demand still exists.”

The industry’s earliest customers were a small set of countries eager to project power around the world through the internet. The situation is far more complex today. Many more countries now pay for the instant capability to hack adversaries both internationally and within their own borders. Billions of dollars are at play, but there’s very little transparency and even less accountability.

While public scrutiny of firms that provide hackers for hire has grown, the global demand for offensive cyber capabilities has escalated too. In the 21st century, a government’s highest-value targets are online more than ever—and hacking is usually the most effective way to get to them.

The result is a growing crowd of countries willing to spend large sums to develop sophisticated hacking operations. 

For governments, investing in cyber is a relatively cheap and potent way to compete with rival nations—and develop powerful tools of domestic control. 

“Especially in the last five years, you have more countries developing cyber capabilities,” says Saher Naumaan, a principal threat intelligence analyst at BAE Systems. 

And more of those countries are looking outside for help. “If you don’t have a way to harness the skills or talent of the people in your country but you have the resources to outsource, why wouldn’t you go commercial?” he says. “That’s an option in a lot of different industries. In that way, cyber is not that different. You’re paying for something you’re not going to build yourself.”

For example, oil-rich countries on the Persian Gulf have historically lacked the considerable technical capability needed to develop domestic hacking power. So they spend on a shortcut. “They don’t want to be left behind,” Naumaan says.

Military contracting giants across the world now develop and sell these capabilities. These tools have been used to commit egregious abuses of power. They’re also increasingly used in legitimate criminal investigations and counterterrorism and are key to espionage and military operations. 

The demand for what private hacking companies are selling isn’t going away. “The industry is both bigger and more visible today than it was a decade ago,” says Winnona DeSombre, a security researcher and fellow at the Atlantic Council. “The demand is rising because the world is becoming more technologically connected.”

DeSombre recently mapped the famously opaque industry by charting hundreds of companies selling digital surveillance tools around the world. She argues that much of the industry’s growth is hidden from public view, including Western companies’ sales of cyber weapons and surveillance technology to geopolitical adversaries.

“The biggest issue comes when this space is primarily self-regulated,” she explained. Self-regulation “can result in widespread human rights abuses” or even friendly fire, when hacking tools are sold to foreign governments that turn around and use the same capabilities against the country of origin.

Alerted to the industry’s increasing impact, authorities around the world now aim to shape its future with sanctions, indictments, and new regulations on exports. Even so, the demand for the tools grows.

Ultimately, the most meaningful change may come when there’s an impact on companies’ revenue. Recent reports show that NSO Group is saddled with debt and struggling to court Wall Street investment.

“This is a commercial industry, after all,” Shires says. “If venture capital firms and big corporate investors see this as a risky bet, they’ll choose to pull out. More than anything else, that can change the industry radically.”