The US-Israel war with Iran has brought Muslim Middle Eastern countries into a very awkward position: they neither want war with Iran nor can they afford to engage in it. Yet Israel obliged a few of these Middle Eastern countries by providing them with the infamous Pegasus Surveillance System to target their opponents years before the war.
Israeli private company NSO’s Pegasus surveillance system ‘zero-click’ exploits allow the client countries of Pegasus to control a phone without any engagement on the part of the phone user. Once successfully installed on the phone, Pegasus spyware gives NSO clients complete device access and the ability to bypass even encrypted messaging apps like Signal, WhatsApp, and Telegram. Pegasus operators are able to remotely record audio and video, extract data from messaging apps, and use the GPS for location tracking. Spying governments have moved in recent years toward a more ‘hit-and-run’ strategy to avoid detection.
However, massive media investigations exposed that Pegasus targeted more than 50,000 cell phones, including more than 1,000 politicians and government officials, Arab royal family members, business executives, journalists, human rights activists, and dissidents.
In response, Israeli private company NSO clarified that the Pegasus system has been provided to target terrorists, money launderers, drug traffickers, smugglers, criminal lords, and mafias only after the approval of the Israeli Ministry of Defence. But media reports claimed that subsequently, the same system was not used against terrorists and criminals but against the opponents of the client countries of the Pegasus system.
We are listing only those Middle Eastern countries, including Saudi Arabia, the UAE, Bahrain, and Jordan, which are not directly engaged in the ongoing US-Israel war with Iran, but are at the receiving end and are also clients of NSO’s Pegasus system. These countries include specifically Saudi Arabia, the UAE, and Bahrain.
It is worth noting that three Middle Eastern countries have spent the most money acquiring the Pegasus spyware system and on its running costs, which is evident from the fact that out of a total estimated cost of 11 billion euros for ten countries of the world, 4,720 million euros is the cost of three Middle Eastern countries—including Saudi Arabia, the UAE, and Bahrain—over a period of five years, according to French media house Le Monde.
| Country | Number of Phones Targeted | Duration of Operation (Years) | Estimated Cost (Euros) |
| Saudi Arabia | 10,000 | 5 | 2,070 million |
| UAE | 10,000 | 5 | 2,070 million |
| Bahrain | 3,000 | 3 | 372.6 million |
| Total | 23,000 | From 3 to 5 years | 4,720 million |
According to The Guardian’s estimate, which relies on internal documents from NSO Group dating back to 2016, a licence to monitor 50 smartphones cost 20.7 million euros per year at that time. Similarly, a licence for monitoring 100 smartphones costs 41.4 million euros per year. It remains uncertain whether these prices have changed since 2016 or if NSO Group has offered discounts or rebates to certain clients.
The most devastating aspect of the UAE's misuse of the Pegasus system is that, instead of tracing and locating terrorists and criminal lords, it targeted a few women members of the royal family of the UAE
According to French Le Monde, Saudi Arabia targeted about 15,000 phone numbers with Pegasus. The calculated average cost of targeting one phone can be as high as Rs 70 lakh. As per past estimates, for spying on just 10 people using Pegasus, NSO Group charges a minimum of around Rs 9 crore. The Washington Post also reported that the FBI confirmed Saudi Arabia started using Pegasus in 2018 and 2019.
The steps taken to facilitate the contract for the Pegasus system saw many favourable conditions against the norms and rules. After several months of negotiations, Saudi Arabia signed a contract worth $55 million, most likely NSO Group’s largest contract. NSO paved the way even before Israel signed the Abraham Accords with the Gulf countries, a normalisation pact between Israel, Saudi Arabia, the UAE, and Bahrain. In July 2017, news outlets in Israel reported that one chief of NSO, Shalev Hulio, had travelled to Riyadh without the required clearance or permission of passage documents to negotiate a contract for Pegasus with the Saudis. The Israeli delegation escaped any legal consequences, thanks to their contacts at the highest level of the Saudi and Israeli states.
Adnan Khashoggi, a Saudi-origin journalist for The Washington Post, was murdered on 2 October 2018 and was also allegedly targeted by the Pegasus system by the Saudi Arabian government, making headlines around the world. In addition to Khashoggi, his wife, his son, his lawyer, and even the Turkish prosecutor’s phones were targeted by Pegasus.
According to French Le Monde, the United Arab Emirates is one of the most aggressive users of the spyware, having targeted journalists, activists, lawyers, and politicians, as well as foreign heads of state and government. Canadian organisation Citizen Lab reported that the UAE is one of the oldest customers of NSO Group.
The UAE has long been in bed with Israeli spying technology—as evidenced by a mass civil surveillance system called Falcon Eye installed in Abu Dhabi by an Israeli-owned company. A 2015 Middle East Eye article quoted a source close to Falcon Eye on its functions: “Every person is monitored from the moment they leave their doorstep to the moment they return to it. Their work, social, and behavioural patterns are recorded, analysed and archived.”
The most devastating aspect of the UAE's misuse of the Pegasus system is that, instead of tracing and locating terrorists and criminal lords, it targeted a few women members of the royal family of the UAE:
- Princess Haya bint al-Hussein, daughter of King Hussein of Jordan and the estranged wife of the Amir of Dubai, Sheikh Mohammed bin Rashid al-Maktoum—she was divorced in 2019.
- Princess Latifa, one of over two dozen children of Dubai’s ruler, Sheikh Mohammed bin Rashid al-Maktoum.
- Juan Mayer, an aerial photographer who recorded her skydives.
- Lynda Bouchikhi, events manager.
- Sioned Taylor, her British match teacher.
However, according to a person familiar with the operations of NSO, the company subsequently terminated its contracts with Saudi Arabia and the UAE over human rights concerns. Precise reasons were not given for the UAE, but targeting high-level royal officials was a factor in NSO’s decision.
The Washington Post and French Le Monde reported that Bahrain has been using the spyware since 2020 to target dissidents, human rights defenders, and members of the royal family, having signed a contract with the company in 2016. In its report on Bahrain, Citizen Lab noted that “under the pretext of addressing COVID-19, the Bahraini government has imposed further restrictions on freedom of expression.”
Israel’s definition of terrorism is strange, as it has been bombing Palestinian civilians and is now bombing Iran, including civilian centres. Indeed, export of traditional armaments as well as cybersecurity products and other repressive expertise, all battle-tested on real-life Palestinians. Never mind that several of these outfits have themselves been implicated in the censorship of Palestinian journalists and activists, or that Microsoft once invested in an Israeli facial recognition firm that secretly surveilled West Bank Palestinians.
Shalev Hulio, Omrie Lavie, and Niv Carmi created NSO in 2010, and the trio (Niv, Shalev, and Omrie, or NSO, for short) operated with clear roles: Hulio and Lavie, with military training backgrounds, handled the business, and Niv Carmi, a former senior officer of Unit 8200 of the Israeli intelligence agency, handled the technology.