Luxembourg must act if links to spyware company shown, Asselborn says
Foreign minister emphasised that Luxembourg never purchased or allowed exports of NSO Group surveillance software
Woman holding a phone in front of NSO Group offices in Israel © Photo credit: AFP
Luxembourg must respond if links are established between the country and an Israeli software company whose product has been used to spy on journalists, politicians, activists and lawyers, Foreign Minister Jean Asselborn said on Tuesday.
While he is already aware of two NSO Group business entities operating in Luxembourg, Asselborn described them as mere "back offices" and emphasised that none of the company's surveillance software had been exported from Luxembourg.
"I can only say that if it turns out - without being able to say it now - that Luxembourg has been used for the human rights violations committed by NSO, then Luxembourg must respond to this", Asselborn said at a press conference on companies and human rights.
He did not detail what the reaction could be, or what other proof might be necessary to prompt government action beyond the fact that some company operations are based in the Grand Duchy.
NSO Group in 2019 described itself as headquartered in Luxembourg, yet the country's government called it an Israeli company when it denied responsibility for the Grand Duchy to investigate its connection to the killing of Saudi dissident and journalist Jamal Khashoggi the previous year.
Khashoggi's fiancee, wife and son, along with dissidents and journalists from Hungary to Mexico to India were targeted by NSO spyware that allowed its government clients to take control of targeted smartphones, a global investigation by journalists found. The software allowed users to collect data from the mobile devices as well as turn on its microphone and camera, turning them into surveillance tools, the journalistic consortium reported in a series of articles released this week.
Amazon Web Services shut down infrastructure and accounts linked to NSO Group on Monday in reaction to the press reports, Amazon said in a statement.
Luxembourg has never granted an export licence to NSO Group nor received a request from the company, Asselborn said, repeating what he told parliament in 2019. The foreign minister said he had spoken to Israel's ambassador to the Grand Duchy this week and was told that Israel is looking into any allegations the company's software was misused. NSO Group needs approval from both the Israeli defence and foreign ministries to export its surveillance software, Asselborn said.
An Amnesty International report this year showed the complex multilayered structure of NSO Group entities in the Grand Duchy, with an overall figure well above the two entities Asselborn says he is aware of.
A Luxembourg company created in 2014 to become the main shareholder of NSO Group Technologies, later renamed Q Cyber Technologies, "acts as a commercial distributor for the products of the Group companies, as such it signs contracts, issues invoices and receives payments from Group customers", NSO Group said in response to Amnesty's inquiries earlier this year.
Former US President Trump's first national security advisor, Michael Flynn, worked for Luxembourg-based OSY Technologies of NSO Group and was paid a salary by it, Tageblatt reported in 2017, citing Flynn's public financial disclosure report.
Members of the Obama and Biden administrations have also worked for NSO, The Washington Post reported on Monday.
"NSO's parent, OSY, which is headquartered in Luxembourg, also paid Obama's homeland security secretary, Jeh Johnson, to review the company’s new Human Rights Policy", the Post writes.
Q Cyber Technologies, "which NSO says it is a subsidiary of, has also benefited from the legal services of Dan Jacobson, whom the Biden administration in March named general counsel for the Office of Administration", the Post writes.
Luxembourg currently lacks due diligence legislation, unlike France, which requires the government to probe companies according to their human rights and environmental record. On Tuesday, Asselborn proposed a voluntary scheme through which companies can clean up their human rights records and get government support in doing so.
However, Luxembourg prefers an EU-wide solution instead of binding national legislation on due diligence. Whether any such law requiring due diligence by the government would extend to holding companies like those NSO Group operates in Luxembourg is unclear. Government ministers indicated that is unlikely, according to a response to questions from parliament members.
