These Twitter accounts act like NSO groupies. Are they real?

Read More

The Israeli cyberespionage company NSO Group is still trying to contend with a massive wave of condemnations from across the globe over alleged misuse of its spyware by repressive regimes against journalists and human rights activists.

On social media, however, standing shoulder to shoulder with NSO, are a small yet vocal group of users ready to defend the firm’s practices and amplify its messaging.

These pro-NSO activists are active on Twitter and use anonymous profiles. One user called Ahad Ha’am, for instance, wrote in April 2020: “Remember how Facebook noisily actually sued NSO for allegedly harming its users’ privacy? Well, it seems this same Facebook itself approached NSO and asked to buy its technology to monitor innocent users.”

The tweet was a reference to a claim made by NSO’s founder as part of a legal dispute in 2020. Shalev Hulio claimed that the social media giant sought NSO’s spyware services in the past: “In October 2017, NSO was approached by two Facebook representatives who asked to purchase the right to use certain capabilities of Pegasus,” he said, adding that Facebook already made use of “spyware” for other purposes.

In another tweet, the same user responded to criticism of NSO, saying, “You’re talking nonsense without knowing any of the facts about what the company actually does.”

NSO Group founders Shalev Hulio and Omri Lavie. NSO is facing a string of serious challenges. This week’s massive Project Pegasus investigation is only one of many issues they face??? ?????

Ahad Ha’am has also retweeted real users, for example a post by Omri Lavie, one of NSO’s founders, that said that “NSO saves lives, remember that!.” The wording is the same as the one used by NSO during the recent LinkedIn campaign. The user even added their own comment. In fact, Ahad Ha’am has come out in defense of Lavie’s new cybersecurity company, too.

Another user, who goes by the name “Echad She’lo Yodaya” (a reference to one of the “four children” of Passover), was active in responding to the accusations and revelations made as part Project Pegasus – the global investigation led by Forbidden Stories in which Haaretz also participated. The investigation involved a consortium of news outlets investigating a leaked list of 50,000 phone numbers selected as potential targets for NSO’s Pegasus software, including such names as French President Emaneual Macron and even the Dalia Lama, as well as over 180 journalists.

‘You have no idea how important NSO is for Israel and for your own lives,’ one of the pro-NSO users tweeted. The accounts may be sockpuppets, experts sayScreen capture

In one response, the user wrote that “the story has crumbled.” To back up the claim he retweeted another Twitter user who shared the debunked claim that “Amnesty [International] admitted that NSO has no connection with the 50,000 telephone numbers cited [in the investigation].” In reality, Amnesty made no such claim.

‘The story is falling apart,’ one of the pro-NSO users tweeted, sharing a misleading and debunked report about Amnesty backtracking from Project Pegasus’ findingsScreen capture

Echad She’lo Yodaya also responded to Haaretz’s espionage and intelligence writer Yossi Melman, who wrote, “the days of the company and its offensive Pegasus software will soon be over” by tweeting: “Don’t hurry to eulogize, Yossele. More than that, don’t obfuscate – you have no idea what you’re talking about …”

Yossi Melman wrote that the “days of the firm and its Pegasus software will soon be over.’ A user called ‘He who doesn’t know’, responded: ‘Don’t be so quick to eulogize, Yossele’Screen capture

Echad She’lo Yodaya has also sought to deflect criticism of NSO to the big global tech companies, whom he calls “the world’s biggest personal-data thieves and violators of privacy, who won’t cooperate with governments to help them fight terrorism and crime but attacked the company that helps government fight terror.”

After spyware scandal, Israeli NSO touts ‘proud family of workers saving lives’

Bahrain used Israeli NSO spyware to target pro-democracy activists, report finds

Why Israelis don’t care about the NSO scandal

He also “likes” users who support NSO and has even written: “It’s good that they killed Khashoggi,” referring to the Saudi dissident Jamal Khashoggi. Reports and the investigation have said NSO’s spyware may have been used by the Saudis to keep track of the journalist before his murder at the Saudi embassy in Istanbul.

Echad She’lo Yodaya has even echoed Omri Lavie’s tweets and he often responds to him. It may be worth noting that Ahad Ha’am identifies himself as a supporter of former Prime Minister Benjamin Netanyahu while Echad She’lo Yodaya says he was anti-Netanyahu.

Another Twitter account has come to the aid of NSO in a different way. Calling himself “Echad M’Shelanu,” they have tried in a number of tweets to deflect the attention on NSO towards another Israeli cyberattack company called Paragon, which hacks instant-messaging software. “You missed it – there’s one Israeli company with hypersonic weapons, in cybersecurity terms, that leaves NSO in the dust,” he replied to this reporter, “Paragon.”

Echad M’Shelanu isn’t the only one. Ahad Ha’am has also tried to drag Paragon’s name through the mud, as well as that of its head, Ehud Schneerson. “Schneerson took with him all Unit 8200’s most senior section chiefs and that annoyed its current head, who decided to take revenge against Schneerson by deciding that anyone working in the offensive cyber industry won’t be called back to reserve duty.”

Who are you?

So, what do we have here? Three users with the usernames including the Hebrew word for “one” – Ahad Ha’am, Ehad She’lo Yodaya and Ehad M’Shelanu – all of whom tweet content in support of NSO. The three have a clear line: Backing the company, attacking global tech giants and deflecting attention to another cyberattack company. In addition, not only are the user names similar, they set up their accounts about the same time (although not exactly the same time) and began tweeting at the end of 2019.

Israeli cyber firm NSO Group’s exhibition stand at “ISDEF 2019”, an international defense and homeland security expo, in Tel Aviv, June 2019. STRINGER/ REUTERS

It is important to say that this is not a huge network of bots here or that there’s a coordinated influence campaign that can be pointed to.

But what can be said, after examining the connections between the users, iss that they can be linked with NSO employees. Ahad Ha’am and Echad She’lo Yodaya have mutual follow me-follow you relations, but they also have the same with Omri Lavie, Anat Lavie (presumably his wife) and Isaac Zack, an entrepreneur who helped found NSO and was once a shareholder. Zack is also involved in Lavie’s new startup.

When Anat Lavie tweeted something about Omri Lavie’s new company, it got 12 likes, two of which came from Ahad Ha’am and Echad She’lo Yodaya. It should be noted that Echad M’Shelanu is outside this circle.

Could these users simply be people who like NSO? “The more I look at their posts, the more I feel that they are really different people – they tweet about other things and express themselves differently,” said an expert on the subject who asked to remain anonymous.

Again, it doesn’t appear to be a big paid-for campaign of influence. The number of tweets is limited, not scores of them. In any case, there is no evidence that NSO is behind the tweets or paying for them.

It could be that these are anonymous accounts of people who really like and respect NSO for whatever reason or they belong to NSO employees who have come to its defense at their own initiative. But the proximity of the names, dates and messages suggests that there may indeed be something beyond this – a number of “sock puppets” (fake accounts) aimed at changing public opinion in favor of NSO.