When Downing Street was recently named as the suspected victim of a phone hack by the United Arab Emirates using the Israeli-made spyware, Pegasus, few were surprised at who was behind the discovery.
The Citizen Lab at the University of Toronto has for years been a thorn in the side of the NSO Group, deciphering the company’s sophisticated hacking tools and – crucially – identifying victims of the spyware.
Ron Deibert, the longtime director of the Canadian research group, is one of the world’s leading experts on identifying digital threats against civil society.
John Scott-Railton, a senior researcher at Citizen Lab, is among a relatively small group of experts globally who can identify which iPhones and Android devices have been infected with Pegasus, and which government clients are likely to have been responsible.
It is unsurprising, then, that the pair were an intense focus at Novalpina, the London-based private equity group which took over NSO Group in 2019, and quickly sought to stem its reputation for enabling repressive governments to commit widespread human rights abuses.
Using UK data protection laws, Deibert and Scott-Railton last year sought the personal data held on them by Novalpina. The results of their so-called subject access requests, recently shared with the Guardian, contain snippets of hundreds of emails and attachments that included their names.
The released data, combined with information from other sources, sheds light on an apparent attempt by Novalpina partner Stephen Peel to gather information on and undermine Citizen Lab. In one case, he even reached out to George Soros, whose foundation is an important Citizen Lab donor, and complained about the researchers.
Peel, a former British Olympic rower, was the architect of a drive to “establish a new benchmark for transparency and respect for human rights” when Novalpina acquired NSO in early 2019.
Citizen Lab, meanwhile, had since 2016 been at the forefront of exposing the human rights abuses perpetrated by NSO Group’s customers, revealing, for example, how Saudi Arabia had used the company’s spyware to hack the mobile phone of a dissident who was a close associate of Jamal Khashoggi months before the journalist was murdered.
Novalpina’s lawyers said in letters released to Deibert and Scott-Railton that they found 473 emails that contained Deibert’s personal data, which included some duplicates. 223 emails named Scott-Railton.
They reveal how in February 2019, Novalpina and NSO retained the services of Vivek Krishnamurthy, who at the time was a lawyer with expertise in corporate social responsibility practice at the American law firm Foley Hoag. A source familiar with the matter said NSO paid the firm about $220,000 (£170,000) for its work.
Krishnamurthy was recruited as a “specialist external adviser” to align NSO’s governance framework with the UN’s guiding principles on business and human rights (UNGP).
However, the documents suggest there may have been another motive as well: Krishnamurthy was an alumnus of the University of Toronto, and years earlier had worked as a research assistant for Deibert, who had helped him secure a Rhodes scholarship. As a result, he was well-placed to try to cosy up to the NSO critic.
A February 2019 proposal by Foley Hoag to provide legal services to NSO said Krishnamurthy’s prior relationship with Deibert meant he was in a “unique position to conduct outreach to Citizen Lab should the NSO Group find it desirable to do so”. The proposal acknowledged that NSO had “reputational challenges” and said: “Our goal is to help the NSO Group become seen as the world’s most ethical company in the surveillance space by establishing systems, policies, and procedures to ensure that it operates in a rights-respecting manner.”
In a 1 March 2019 exchange, Peel emailed Krishnamurthy telling the lawyer it was time to “reach out to Deibert to find out what is going on”. The lawyer promptly replied that he would, adding: “He can be prickly, and he’s clearly worked up about NSO.”
The following day, Krishnamurthy sent an email to his former mentor, explaining he had been hired to work on NSO’s human rights policies.
He told Deibert he had “thought long and hard” about whether to work for NSO, especially in light of Citizen Lab’s recent work.
“I would probably have said no were it not for my good friend Sir Mark Stephens,” he wrote, referring to the British lawyer – who is a CBE but not a knight – as “one of the world’s foremost human rights lawyers”.
He said Stephens, a celebrated British lawyer who frequently acts in high-profile cases, with former clients including Julian Assange, Salman Rushdie, and Greenpeace, had assured him of Peel’s “deep personal commitment to human rights, and of his desire to see NSO operate in a rights-respecting manner”.
Deibert declined the meeting. He told the Guardian he did not believe NSO Group or its owners had shown good faith in responses to Citizen Lab’s correspondence and questions, and did not wish to appear to legitimise the company.
He also turned down an attempt three months later by Krishnamurthy to secure a face-to-face meeting with his old university mentor when – following an exchange with Peel informing him he would again seek out a meeting with Deibert – Krishnamurthy told Deibert by email that he wanted to see him while on family trip to Toronto: “You’d be having a drink with me in my capacity as your former student, and not as anything else!”
Deibert said he found it “deeply troubling and disappointing” that Novalpina had employed a former student and research assistant seemingly to “surreptitiously weasel their way into gathering information on our activities”.
Krishnamurthy, a faculty member at the University of Ottawa who was recently appointed to a Canadian government advisory committee on online safety, denied he was hired for that reason, but conceded that his prior relationship with Deibert was relevant for the work he could do for Novalpina “as a good faith broker” with the NGO community.
He expressed “regret” that his work for NSO’s financial backers damaged his relationship with Deibert, describing his work for for the company as “the weirdest matter I’ve ever handled”.
Stephens, who described Peel as a friend, confirmed that he suggested Krishnamurthy to the Novalpina executive, but he said he was unaware at the time of Krishnamurthy’s prior relationship with Deibert. He said he had previously worked for Peel, but not for Novalpina or NSO.
Stephens praised Peel and criticised Citizen Lab for disproportionately focusing on NSO.
“The practical result of what they [Citizen Lab] have done is to ignore and effectively divert attention from the other players in this marketplace and they have given them a completely free pass and I think that’s reprehensible,” Stephens said.
Citizen Lab has, in fact, produced reports on a range of other cyber surveillance companies, and published reports on other digital threats to civil society, including Chinese government censorship and vulnerabilities in Covid-related applications.
Its work has attracted funding from the Ford Foundation, Hewlett Foundation, and the Open Society Foundations, which was created by the billionaire philanthropist George Soros. The Novalpina documents released to Deibert include one email from Soros’s office that was forwarded by Peel to NSO in Israel.
The document was redacted, but well-placed sources and other emails seen by the Guardian suggest the outreach to Soros may have been part of an ultimately unsuccessful attempt by Peel to undermine Citizen Lab’s funding.
In May 2019, Peel is understood to have raised Citizen Lab at a dinner with Soros in New York. He later followed up with emails in which he sought to discredit the Canadian research group.
In one, he lambasted Citizen Lab’s research, claiming it was “an organisation unknown except for its attack on NSO”. He questioned the group’s motivations, tactics, and objectives, which he described as “a little less pure than we might of hoped”.
One person familiar with the matter said they believed Peel’s unspoken aim could have been to get Soros to withhold his charity’s financial support for the researchers. A second well-placed source said they could not judge Peel’s motive, but they could not rule out that was his intention.
Soros was ultimately unmoved by the criticism of Citizen Lab. A month after the dinner, the Hungarian-born billionaire advised Peel he should probably extricate himself from the NSO investment.
Lawyers for Peel said these were “tenuous and unsubstantiated allegations” and that Peel was committed to “good governance and human rights”.
Deibert said the documents suggested Novalpina’s commitment to aligning NSO with human rights principles seemed to be a figleaf.
“We have seen enough of their obviously absurd denials in the face of evidence of abuse to understand they do not appear genuinely interested in human rights due diligence as much as making money and crafting a seemingly palatable public-facing image,” he said.
“One can only conclude that the bottom line matters more than human rights for those lining their pockets from NSO Group’s sales – including, their executives, owners, and high-priced lawyers.”
Krishnamurthy said in a written statement to the Guardian that he and his colleagues had believed when they were retained that Novalpina was serious about making “real changes at NSO”.
“However, the NSO Group’s subsequent record of complicity in gross human rights violations shows how wrong we were. I regret my brief time advising Novalpina in 2019,” he said.
Krishnamurthy added that he hoped leaders like Deibert and Citizen Lab would “succeed in bringing NSO’s extremely harmful activities to an end”.
A US consultancy called Berkeley Research Group (BRG) took over management of the fund that owns NSO last July after an internal dispute between the founding partners of Novalpina.
