Appendix I: NSO Group’s Response

“We have received your letter of 9 June 2020, regarding the alleged targeting of a human rights defender by authorities in Morocco using our technology. Due to the confidentiality constraints detailed below, we cannot confirm or deny that such authorities use our technology. We appreciate your bringing this issue to our attention. Consistent with our Human Rights Policy, NSO Group takes seriously its responsibility to respect human rights, and is strongly committed to avoiding causing, contributing to, or being directly linked to negative human rights impacts.

We are deeply troubled by the allegations in your letter, and will immediately review the information therein and initiate an investigation if warranted. While you have provided certain information regarding the alleged misuse, to investigate the issue thoroughly, we need certain details, such as a phone number, the name of the individual, or a MSISDN (Mobile Station International Subscriber Directory Number) as set out in our public Whistleblowing Policy. Absent that information, our inquiries will be substantially constrained. If you would provide some or all of that information, it would greatly facilitate our ability to determine whether our products have been used in a manner inconsistent with our policies, any commercial agreements that may exist, international norms, or applicable domestic laws. In accordance with our policies we shall maintain this information in strict confidence and not divulge it other than as required to conduct a thorough investigation.

Your letter also poses several questions regarding any relationship NSO Group might have with Moroccan authorities, and the actions we undertook following a report by Amnesty International into alleged misuse of NSO's products by those authorities. While we seek to be as transparent as feasible in response to allegations that our products have been misused, because we develop and license to States and State agencies technologies to assist in combatting terrorism, serious crimes, and threats to national security, we are obligated to respect state confidentiality concerns and cannot disclose the identities of customers. However, the attached correspondence with UN Special Rapporteur David Kaye contains a fulsome description of how we address human rights due diligence, measures that we may require in individual customer relationships to mitigate or prevent the risk of human rights impacts, our investigatory steps when we receive allegations of potential misuse, and a range of responses when a misuse is identified. We can assure you that we followed this approach with respect to your previous report, though due to the aforementioned confidentiality constraints we are unable to provide further details.

We do hope you will provide us with further details, as noted above, to allow us to investigate the disconcerting allegations described in your letter.
Best Regards,
Chaim Gelfand, Adv. Head of Compliance NSO Group"