NSO Group Co-Founder Traveled on Israeli Diplomatic Passport, Investigation Finds

A co-founder of NSO Group, the Israeli company behind the Pegasus spyware, traveled to Panama in 2013 using an Israeli diplomatic passport, according to a document uncovered by the Organized Crime and Corruption Reporting Project (OCCRP).

Diplomatic passports are normally reserved for government officials and are meant to grant holders immunity and expedited treatment when crossing borders. Their use by a private businessman running a commercial spyware firm is unusual, and it has reignited a long-running question: how close is NSO Group, really, to the Israeli state?

"This raises questions about NSO's connections to the Israeli state," John Scott-Railton, a senior researcher at Citizen Lab, told OCCRP, according to Citizen Lab's own reporting on the finding.

NSO Group has spent years insisting it operates as an ordinary private company, selling Pegasus only to vetted government clients for counterterrorism and law enforcement purposes. Israeli authorities have likewise maintained that spyware exports are handled through standard defense-licensing channels, not covert state operations. A diplomatic passport in the hands of one of the firm's founders complicates that framing, suggesting a level of state facilitation that goes beyond an arms-export license.

Pegasus reached the people investigating Pegasus

Citizen Lab's own forensic work adds another layer. The lab found that Stelios Kouloglou, a former Member of the European Parliament, was hacked with Pegasus spyware while he sat on the European Parliament's PEGA committee, the body created specifically to investigate Pegasus and other spyware abuses across Europe.

That detail is not a footnote. According to Citizen Lab's forensic analysis, whoever compromised Kouloglou's device could have gained access to confidential PEGA committee documents and internal deliberations, meaning the surveillance tool at the center of the investigation may have been used to surveil the investigation itself.

Citizen Lab has not confirmed exactly what, if anything, was exfiltrated from Kouloglou's device, and the lab describes the access as a capability its forensic review identified rather than proof of specific stolen material. Still, the implication is stark: a spyware maker with apparent links to Israeli state apparatus, and a European oversight body trying to hold spyware makers accountable, wound up on opposite ends of the same intrusion.

Why it matters

NSO Group has already been sanctioned by the U.S. Commerce Department and sued by WhatsApp over Pegasus abuses documented worldwide, from journalists to human rights defenders to heads of state. The diplomatic passport finding does not prove direct Israeli government control over NSO's operations. But it adds documentary weight to years of allegations that Israel's surveillance export industry functions as an extension of state power, deployed globally with limited accountability, even against the very lawmakers tasked with reining it in.