Oregon’s public pension fund, which manages tens of billions of dollars in retirement savings, appears to have privately given its blessing to a 2019 deal by an investment fund to acquire NSO Group, the controversial spyware company.
A source with close knowledge of the matter and emails seen by the Guardian suggest that a senior official at the pension fund signalled his strong support for the takeover of NSO as early as 2018, months before the deal was announced.
Last month, Oregon officials said they were “deeply disturbed” by reports that NSO Group “enabled widespread human rights violations”.
However, it now appears that the Oregon pension fund, one of the most prominent in the US, gave its tacit approval over an investment in NSO several years ago – at a time when security researchers were already publicly raising alarms about the company.
NSO, which is based in Israel, was recently blacklisted by the Biden administration and accused of acting against the national security interests of the US.
The US commerce department said in November 2021 it was adding NSO to the so-called Entity List based on evidence that the company had developed and supplied spyware to foreign governments that used the tools to “maliciously target government officials, journalists, businesspeople, activists, academics and embassy workers”.
A spokesperson for Tobias Read, the Democratic Oregon state treasurer who has oversight of the pension fund, issued a statement in December supporting the administration’s decision. The statement was significant because Oregon invested $233m in a private equity firm, Novalpina Capital, in 2017. Novalpina’s fund then acquired a controlling stake in NSO in 2019, making the Oregon fund the largest indirect investor in the spyware company.
A spokesperson for Read, who has oversight of public investments but does not personally manage relationships with private equity managers, said in the December statement that the treasurer supported the sanctioning of technology companies that “facilitate human rights violations and the oppression of journalists by selling technology to authoritarian regimes.”
The spokesperson said that Oregon was a limited partner in private equity fund investments and did not participate in the “selection or operation of private equity portfolio companies” held by it private equity investors. “We’ve been deeply disturbed by reports about developments concerning NSO Group,” the statement said.
An investigation by the Guardian suggests that a senior official at the Oregon pension fund was briefed on Novalpina’s desire to buy NSO – and appears to have indicated to partners there that he supported the deal – as early as 2018.
Records suggest that Michael Langdon, director of private markets at the Oregon State Treasury’s investment division, met the three founding partners at Novalpina in London on 15 June 2018. According to a source familiar with the matter, Langdon voiced his support for Novalpina to pursue the acquisition. A 24 June 2018 email that was sent by a person involved in the talks described Novalpina as discussing the opportunity “in detail” with the private equity firm’s three largest investors, who had voiced “strong support” for the transaction.
At the time, Langdon is said to have already been familiar with NSO and what insiders sometimes called the “noise” – or bad publicity – around the company because the Oregon pension fund was also an investor in Francisco Partners, a California-based firm whose fund previously owned a majority stake in NSO.
“He was very supportive throughout,” said one investor who asked not to be named, describing Langdon’s approach to the Novalpina fund’s takeover of NSO.
A spokesperson for the Oregon treasury declined to answer the Guardian’s questions. In an emailed statement, the spokesperson said: “Our role as a limited partner means we can’t comment on specifics related to our active investments, and as we have said before, we do not participate in the selection, operation, or control of portfolio companies.”
Concerns about the possible abuse of NSO’s hacking software by its government clients date back to 2016. By 2018, researchers at Citizen Lab had issued reports that said there appeared to be a “lack of due diligence by NSO Group concerning the sale of their spyware, and widespread misuse of the spyware by several government clients”. Researchers had delved into allegations that journalists and human rights activists in Mexico and the UAE had their phones hacked by governments using Pegasus.
Then, in October 2018, new allegations emerged that a Saudi dissident who was based in Canada, a close associate of the murdered journalist Jamal Khashoggi, had been targeted and infected with NSO spyware by a client of the company. NSO denied the claim. The controversy did not affect the takeover of the Israeli firm by Novalpina’s fund.
Months later, after the acquisition of a majority stake in NSO became public, an announcement of the deal appears to have been sent to Langdon by Stephen Peel, co-founder of Novalpina. The senior Oregon official responded on 21 March 2019: “This is great. Thanks. Let’s keep in touch on this.”
As allegations of misuse of NSO’s technology by the company’s government clients multiplied, a spokesperson for the Oregon pension fund responded to inquiries from the Guardian by saying it was against the fund’s policy to comment on specific portfolio investments given its role as a limited partner.
It did issue a statement after the Biden administration announced that it was adding NSO to a US blacklist.
A spokesperson for Tobias Read said in December that the Oregon treasury had been working with the fund’s new manager, which replaced Novalpina in 2021, to obtain a “full accounting” of the prior fund manager’s investment activities over the past several years, and had reached out to Oregon’s attorney general on “various legal options”. The spokesperson did not elaborate on what was meant by “various legal options”.
Novalpina’s three co-founding partners, Stefan Kowski, Stephen Peel and Bastian Lueken, did not respond to requests for comment from the Guardian.
