Novalpina Capital
CC: NSO Group, Francisco Partners
……..
February 18, 2019
We, the undersigned organizations, release this open letter to Novalpina Capital regarding the recent announcement of the buyout of NSO Group from Francisco Partners.
We call on Novalpina to publicly address our serious concerns regarding accountability for NSO Group’s involvement in previously documented spyware abuses, Novalpina’s current approach to addressing human rights impacts associated with NSO Group’s products and services, and the future trajectory of the company.
Spyware abuses associated with NSO Group & international standards
Research has documented the use of NSO Group’s Pegasus spyware to target a wide swath of civil society, including at least 24 human rights defenders, journalists and parliamentarians in Mexico, an Amnesty International employee, Omar Abdulaziz, Yahya Assiri, Ghanem Al-Masarir, award-winning human rights campaigner Ahmed Mansoor, and allegedly, the targeting of Jamal Khashoggi.
These individuals and organizations appear to have been targeted solely as a result of their criticism of governments that utilized the spyware or because of their work bearing on human rights issues of political sensitivity to those governments. Thus, this targeting is in violation of internationally recognized human rights.
Although a federal investigation into abuses associated with NSO Group’s spyware was opened by the Mexican government in 2017, the lawyers of the victims with access to the file report that NSO Group has so far failed to adequately cooperate with investigators, and the investigation has since stalled.
It is also of serious concern that in the past month, six members of civil society who were investigating, reporting on, or are involved in legal action where NSO Group is a defendant were targeted by private operatives. Reports suggest that these private operatives were employed by Black Cube, an Israeli private investigation firm. The intimidation of civil society in this way signals a deeply worrying escalation of the targeting of civil society, as well as the interference with the work of those engaged in uncovering human rights abuses across the world.
Under globally-accepted standards such as the United Nations Guiding Principles on Business and Human Rights (“Guiding Principles”), corporations such as Novalpina and NSO Group have the responsibility to respect human rights including by carrying out due diligence to identify and address their potential and actual human rights impacts and remediating any harm to which they have caused or contributed. Principle 17 of the Guiding Principles states that companies have a responsibility to “initiate as early as possible in the development of new activity or relationships” measures to “identify, prevent, mitigate and account for how they address their adverse human rights impacts,” and to this end, “business enterprises should carry out human rights due diligence.” Under Principle 22 of the Guiding Principles, businesses that have caused or contributed to adverse impacts “should provide for or cooperate in their remediation through legitimate processes.”
Addressing concerns
We note that Novalpina Capital has communicated to some civil society organisations its willingness to engage and develop a dialogue regarding concerns related to its acquisition of NSO Group, including through an on-the-record meeting. We are disappointed, however, that Novalpina Capital did not consult with any of the undersigned civil society groups prior to its acquisition, and are therefore concerned about its willingness to fully take into account our expertise and recommendations.
As a result, and prior to any on-the-record meeting, we call on Novalpina Capital to:
- Confirm an immediate end to the sale or further maintenance of NSO Group products and services to governments that have been accused of intentionally infringing human rights through communications surveillance;
- Commit to fully engaging with relevant investigations into abuses associated with NSO Group’s spyware in Mexico, and publicly outline what steps will be taken to cooperate with investigations to provide accountability and remediation;
- Detail what human rights due diligence steps were taken ahead of making the decision to proceed with the acquisition, report publicly on what risks were identified through any such due diligence process and how they were addressed;
- Disclose additional information about the new corporate structure, including what percentage of shares of NSO Group Novalpina Capital now owns or controls; the precise terms of this deal; NSO Group’s new corporate structure; and the membership of NSO Group’s board of directors, executive leadership, and management team.
- Describe its position on the human rights impact of NSO Group’s technology, and how it plans on mitigating the risks made evident by NSO Group’s past failures and preventing abuses in the future;
- Provide details about the membership and deliberations of NSO Group’s Business Ethics Committee, and the standards against which they evaluate potential or past business;
- Issue a statement condemning the targeting, by private investigators, of civil society who were investigating, reporting on, or involved in legal actions against NSO Group;
- Provide data on which export licenses NSO Group has received from Israeli and other government authorities, and commit to regular transparency reporting on export licensing data;
- Provide details on end-use agreements that NSO Group has in place with its clients protecting people from arbitrary surveillance, if any, and what steps the company takes to monitor their compliance. If no end-use agreements are in place, provide information about how NSO Group ensures its products are not misused against human rights defenders, journalists, and other members of civil society.
We appreciate Novalpina Capital’s expressed willingness to engage in this important discussion and regard a response as an important step to providing necessary transparency to enable an informed dialogue, as well as a gesture of good faith by Novalpina.
We look forward to a prompt response and continuing dialogue on the basis of transparency.
Sincerely,
Access Now
Amnesty International
Human Rights Watch
Privacy International
R3D: Red en Defensa de los Derechos Digitales
Reporters Without Borders
Robert L. Bernstein Institute for Human Rights, NYU School of Law and Global Justice Clinic, NYU School of Law*
*Communications from NYU clinics and institutes do not purport to reflect the school’s institutional views, if any.