U.S. Blacklists NSO Group and 3 Others for Selling Spyware, Hacking Tools

The Commerce Department’s Bureau of Industry and Security banned U.S. persons from dealing with four companies—including Israel’s NSO Group—that they say acted against national security interests by trading in hacking tools and selling spyware to foreign governments.

The other listed companies include Israel’s Candiru, Singapore’s Computer Security Initiative Consultancy and Russia’s Positive Technologies.

“The United States is committed to aggressively using export controls to hold companies accountable that develop, traffic, or use technologies to conduct malicious activities that threaten the cybersecurity of members of civil society, dissidents, government officials, and organizations here and abroad,” Secretary of Commerce Gina Raimondo said in a press release Wednesday about the companies addition to Commerce’s Entity List.

While the list often features additions from adversarial nations, Israel and Singapore are notable U.S. allies on cybersecurity. Key lawmakers have even proposed legislation for the Department of Homeland Security to issue grants to cybersecurity-related companies in Israel as long as they were part of a joint venture with a corresponding U.S. entity.

“We are not taking action against countries or governments where these entities are located,” the State Department noted in its press release.

Wednesday’s action and a related interim rule Commerce recently issued come after years of the U.S. trying to determine the right controls over technologies that can be used for legitimate cybersecurity purposes or as weapons by adversaries and intelligence-gathering operations. The interim rule describes how the U.S. finally plans to issue Authorized Cybersecurity Exceptions to control such technology and join 42 other nations that have already been enforcing regulations on hacking tools under the Wassenaar Arrangement.  

But Commerce said U.S. entities would not be issued any such exception for dealing with the four companies listed Wednesday.

Decisions to add or remove companies from the Entity List are made by members of an End-user Review Committee that is chaired by Commerce and includes the departments of State, Energy, Defense and, if…