Dear Mr. Peel,

I am writing in my capacity as Director of the Citizen Lab in response to your letter dated February 15, 2019 regarding Novalpina Capital’s involvement in the purchase of NSO Group.

Citizen Lab is an interdisciplinary research laboratory based at the University of Toronto’s Munk School of Global Affairs and Public Policy. Since 2016, we have published a total of 11 reports regarding NSO Group’s spyware. These reports provide empirical evidence that NSO Group’s technology has been used abusively and illegally to spy on civil society, human rights defenders, and journalists, among other targets.

We appreciate your commitment—as stated in your letter of February 15, 2019—to “helping NSO Group become more transparent about its business.” As a first step, we ask that Novalpina Capital provide answers to the following questions regarding Novalpina Capital and NSO Group’s human rights due diligence and corporate social responsibility practices:

  • What “extensive due diligence” processes were undertaken by Novalpina Capital prior to the purchase of NSO Group?
  • What criteria were used to determine that Novalpina Capital believes NSO Group “operates with the highest degree of integrity and caution”?
  • What “safeguards” are in place regarding the responsible and appropriate use of NSO Group products? More specifically:
    • How do Novalpina Capital and NSO Group ensure that NSO Group technology is not supplied to customers who have a record of documented human rights abuses and who present a substantial risk of misusing the technology to further violate human rights?
    • How do Novalpina Capital and NSO Group monitor the implementation and use of NSO Group technology by NSO Group customers to ensure that such use is consistent with international human rights norms?
    • How do Novalpina Capital and NSO Group ensure that NSO Group technology is not used by purchasers against illegal targets or obtained by third parties that might engage in such illegal uses?
    • How do Novalpina Capital and NSO Group ensure that its operations are in compliance with the UN Guiding Principles on Business and Human Rights, which require business enterprises to respect human rights?
  • How is Novalpina Capital “comfortable owning” NSO Group when Citizen Lab’s peer reviewed, evidence-based research described above—which, as noted, provides empirical evidence that NSO Group’s technology has been used in violation of international human rights norms—has yet to be challenged or disputed?
  • What investigations have been conducted by Novalpina Capital and NSO Group into the deployment of spyware against individuals who have been unlawfully targeted? Has NSO Group provided support to official investigations into the abuse of NSO Group technology?
  • What remediation efforts have been undertaken in relation to past human rights violations caused or facilitated by NSO Group technology, and what grievance mechanisms will be available going forward to individuals that may be illegally targeted with NSO Group technology?

We note that a number of these concerns—and others—have been raised by numerous non-governmental and advocacy organizations concerned with the abusive deployment of spyware against human rights defenders and civil society. Citizen Lab has also raised similar questions in prior letters to Francisco Partners, NSO Group, and the Blackstone Group.

We are requesting substantiated and detailed responses to the above questions and will not be satisfied with boilerplate responses that NSO Group supplies government authorities who undertake only to use the technology for lawful surveillance activities and that any abuses of the technology are the responsibility of the customer alone. Nor will we be satisfied by assertions of “national security constraints” as a justification for silence and opacity.

As Citizen Lab recently noted in a submission to the United Nations Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, Mr. David Kaye, the fact that NSO Group provides technology to governments engaged in lawful surveillance efforts does not justify a carte blanche approach to human rights and business practices within the surveillance industry.

In accordance with the principles of transparency and accountability, Citizen Lab has published your letter dated February 15, 2019 and our response on our website. We look forward to engaging in a further public discussion with you after receiving written responses to the above questions.

Sincerely,

Professor Ronald J. Deibert, OOnt
Professor of Political Science, Munk School of Global Affairs and Public Policy
Director, the Citizen Lab at the Munk School of Global Affairs and Public Policy, University of Toronto