Ten years ago, long before it found itself at the center of a global scandal, Israeli spyware maker NSO Group was just a small, ambitious startup with no name recognition, and no clients outside of Israel.
It wasn’t long before NSO caught a huge break. In 2011, a year after it was founded, NSO landed its first overseas client: Mexico. That deal would generate tens of millions of dollars in revenue and open the door for the company to sell its software, known as Pegasus, to the United Arab Emirates, Saudi Arabia, India, and Rwanda, among others. NSO soon faced allegations that Pegasus was being used as a tool of repression against journalists, human-rights activists, and politicians.
Amid the furor over the abuse of NSO’s powerful spyware, the story of how the company landed its first contract with Mexico has largely escaped attention. It’s a deal that might never have come together were it not for the behind-the-scenes efforts of an influential, twice-convicted Republican powerbroker: Elliott Broidy.
A top GOP fundraiser who received a pardon from President Donald Trump for his role in a conspiracy to violate foreign lobbying laws, Broidy played an important early role in NSO’s deal with Mexico. Through Broidy, NSO found a critical intermediary in Mexico, a well-connected, wealthy businessman who would bring Pegasus to the attention of the very top of the country’s leadership, according to documents filed in an Israeli court.
An attorney for Broidy warned, prior to publication, that The Daily Beast was pursuing a “false and potentially defamatory” article. “Mr. Broidy has never done business with NSO Group, nor has he ever been compensated by them,” attorney David Camel wrote. He called The Daily Beast’s description of events, as laid out in an affidavit filed by one of Broidy’s former employees, “false.”
Affidavits, NSO contracts and emails from company officials and outside salesmen that were filed in a lawsuit in Tel Aviv and reviewed by The Daily Beast lay bare the Israeli spyware maker’s deal with Mexico, some details of which remain a state secret in Israel, and open a rare window into NSO’s opaque business practices. Broidy was neither a party nor a witness to the Israeli lawsuit, Camel said.
The documents do, however, raise troubling questions about the Israeli spyware maker’s recent claim that its products are intended for “the sole use of thoroughly vetted and approved governmental agencies charged with maintaining public safety and security.” Broidy’s contact in Mexico—a man nicknamed “Mr. Lambo” for his love of Italian sports cars—later served time in a U.S. federal prison for making illegal foreign contributions in an American election. A document filed by federal prosecutors in San Diego revealed that “Mr. Lambo” was investigated by U.S. authorities for a host of other crimes for which he wasn’t charged, including drug smuggling.
Even in its earliest incarnation, NSO’s Pegasus was a game-changing piece of software that covertly turned a phone into a personal monitoring device. The software allowed NSO’s clients to infiltrate smartphones and reveal intimate details of a target’s life—every email, call, photo, and text. It could remotely turn on a phone’s camera and microphone, all without the user ever realizing someone else was watching and listening.
An investigation published in July by an international team of journalists uncovered 50,000 phone numbers that were apparent targets of NSO’s Pegasus software. The presidents of France, South Africa, and Pakistan were reportedly on the list, along with the wife of murdered journalist Jamal Khashoggi. NSO says the reports were false claims based on uncorroborated theories and a misleading interpretation of the data, that the list of 50,000 phone numbers is not a list of Pegasus targets or potential targets, and that neither President Macron nor Khashoggi’s wife were Pegasus targets.
According to an affidavit filed in court in Tel Aviv, Broidy first learned of NSO and Pegasus in 2010, when he was contacted by one of his former employees who had joined the NSO sales team. Matan Caspi had spent several years working at Broidy Capital Management in Los Angeles. Part of his work involved selling technology to Mexico. Caspi returned to Israel where he co-founded Rayzone Group, an Israeli cybersecurity firm that offers “boutique intelligence-based solutions for national agencies,” according to its website. Caspi did not reply to messages sent to Rayzone and his personal email addresses for this article.
In October 2010, Caspi flew to Los Angeles to meet Broidy and discuss Pegasus. “The meeting with Broidy was successful. Mr. Broidy expressed real interest in NSO’s products and in the chances of success of selling them to the Mexican Army. It was concluded that he would try to use his connections in order to promote such a deal,” Caspi wrote in an affidavit filed in the Tel Aviv lawsuit.
In its approach to Broidy’s Mexican business associate and government officials in Mexico, NSO relied almost entirely on outside salesmen like Caspi, his partner, Eric Banoun, and, for a time, Broidy. NSO’s contract with Banoun, a copy of which is included in the court file, offered a 10 percent commission on the sale of Pegasus to Mexico. A dispute over that seven-figure commission led to the filing of the 2015 lawsuit in Tel Aviv.
At the time he met with NSO’s marketers, Broidy had admitted that he skirted the law to advance his other business interests. He was awaiting sentencing in a “pay-to-play” pension scandal after pleading guilty in 2009 to a felony charge of rewarding official misconduct. He admitted showering New York state pension officials with more than $1 million in gifts in exchange for a $250 million investment in his private equity firm, Markstone Capital Partners, which invested heavily in Israel. (Broidy ultimately received no jail time after a judge reduced the charge to attempting to receive a reward for official misconduct, a misdemeanor.)
Despite his baggage, Broidy had connections in the security world that would prove invaluable to NSO. His firm, Broidy Capital Management, invested in, among other things, privately held defense contracting companies involved in sensitive counterterrorism and intelligence initiatives, according to a declaration Broidy filed in an unrelated U.S. lawsuit. According to Caspi’s court-filed affidavit, Broidy did a good deal of business in Central and South America and had a close connection to a Mexican businessman who sold equipment to Mexico’s intelligence services.
In response to a petition from the Israeli business newspaper Calcalist, a judge in Tel Aviv ruled that Broidy’s name could be disclosed, but the Mexican businessman’s name and the country he represented could not. The Israeli government asked that the information be kept secret for reasons of state security and to prevent harm to Israel’s foreign relations.
However, affidavits, emails, and NSO contracts filed by defendants in the Tel Aviv lawsuit that were obtained by The Daily Beast identify the businessman as Jose Susumo Azano Matsura, a reputed Mexican billionaire of Japanese origin, also known as “Mr. Lambo.” Azano sold eavesdropping technology to Mexico and other foreign governments. His company, Security Tracking Devices SA de CV, based in Jalisco, Mexico claimed to have 2,000 employees in Mexico and Singapore. Azano did not respond to an email seeking comment.
With Broidy’s “blessing,” Caspi wrote in his court-filed affidavit, he contacted Azano and flew to Mexico City in December 2010 for the first of several meetings with the Mexican businessman.
“Mr. Broidy has never heard such an allegation and has no reason to believe that it might be true,” Broidy’s attorney wrote in response to questions from The Daily Beast regarding his client’s relationship with Azano.
Azano would be the key for NSO that unlocked Mexico, “which is known in the cyber industry as a big buyer of defensive and offensive cyber products,” Caspi wrote in an affidavit. But it was no secret that the country’s drug cartels had corrupted the Mexican government, and technology like Pegasus could just as easily end up being used by a drug trafficker as opposed to being used against one.
Whether NSO knew it or not, the company had taken an extreme risk with Azano, its Mexican partner. NSO was marketing Pegasus as a tool to help Mexico win its brutal war against the country’s drug cartels, but Azano had been under investigation by U.S. authorities for years. Prosecutors in San Diego filed documents that reveal that a car stopped at the U.S.-Mexico border in 1996 with 69 pounds of marijuana was registered to a known residence of Azano’s then wife. In 2004 and 2005, those same documents reveal, FBI surveillance units observed Azano meeting with a known drug smuggler; on one occasion, Azano drove to the meeting with the known drug smuggler in a car with no license plates. (Prosecutors in San Diego declined to bring charges related to drug smuggling.)
In 2014, FBI agents arrested Azano at his waterfront home in Coronado, California, for funneling nearly $600,000 in illegal political contributions to buy influence with San Diego’s next mayor. Azano was found guilty at trial in San Diego and was sentenced to three years in a U.S. federal prison.
“Is this a guy who could be trusted with military secrets? I wouldn’t trust him to do my laundry,” said Phil Halpern, a former Assistant U.S. Attorney in San Diego who prosecuted Azano. “This is a sophisticated businessman, adept at finding ways to circumvent the law.”
Nevertheless, NSO relied on Azano to sell its products to the Mexican government. Included in the Tel Aviv court file was an unsigned, undated copy of NSO’s contract with Azano’s company, Security Tracking Devices. In it, STD was granted the exclusive right to distribute NSO’s products and services in Mexico through the end of 2012 in exchange for $500,000. An NSO spokesperson did not answer questions about why the company did not sell directly to the Mexican government or whether the company had similar arrangements in other countries.
“Due to contractual and national security considerations, NSO cannot confirm or deny the identity of our government customers, as well as the identity of customers of which we have shut down systems,” the spokesperson said in a statement provided by Mercury Public Affairs.
After several meetings with Caspi, Azano prepared a demonstration of Pegasus in the spring of 2011 for “the secretary of defense and president,” according to an email from another of NSO’s salesmen that was submitted to the Israeli court. Mexico’s president at the time was Felipe Calderon.
Court documents don’t specify how NSO showed Mexico’s leadership what its software could do. A few years later, NSO would reportedly record a phone conversation of the editor of a London-based Arab newspaper to impress a client, the United Arab Emirates. Whatever NSO showed Mexico’s leaders, it worked. Azano’s company quickly reached a deal to buy NSO’s Pegasus for $15 million, according to court documents. Azano then resold Pegasus to the Mexican military at an even higher price, earning himself millions of dollars in commissions, according to a 2012 report by Calcalist.
From 2011 to 2018, Mexico spent more than $60 million on NSO’s Pegasus spyware, Mexico’s top security official said Wednesday. Public Safety Secretary Rosa Icela Rodríguez said many of the contracts were signed with front companies, which are often used in Mexico to pay kickbacks or avoid taxes. Last week, Mexican officials reported that bills for programs like Pegasus appeared to have included excess payments that may have been funneled back to government officials as kickbacks.
While NSO has never publicly identified Mexico as a client, company officials have privately hinted that their software was used in the capture of cartel leader Joaquin Guzman, better known as “El Chapo,” a claim some cybersecurity experts said was exaggerated.
In an overview prepared for Azano, NSO touted the ability of its Pegasus software to crack the BlackBerry—the favorite phone of Mexico’s drug lords, including El Chapo. The Pegasus technology in 2011 was referred to in emails filed with the Israeli court as BB and BBM—the acronym for BlackBerry’s instant-messaging application. Penetrating BlackBerry’s encrypted messaging system “was considered the ‘wet dream’ of the intelligence world,” Caspi wrote in an affidavit.
Underscoring the broader problems with NSO, Pegasus proved to be too great a temptation to be used only for tracking down elusive cartel leaders. Citizen Lab, the Canadian research group, published a series of reports beginning in 2017 that found Pegasus was used to target Mexican human rights lawyers, journalists and anti-corruption activists.
“It’s no accident that some companies gravitate toward big ticket customers like Mexico but it’s clear to everyone in that market that if you sell to Mexico, you can almost guarantee misuse,” John Scott-Railton, a senior researcher at Citizen Lab, told The Daily Beast. “Clearly, NSO isn’t bothered by the harm they inflict. But why are they so confident that they can go into a market where there is such high risk of something going wrong and not worry about suffering any consequences?”
More recently, the Guardian reported that Mexican President Andres Manuel Lopez Obrador’s inner circle was a potential target for surveillance by a government client of NSO—a report the Israeli spyware maker strongly denied. Obrador took office in 2018 and vowed to never use spyware.
As for Elliott Broidy, his alleged efforts in helping NSO land its deal with Mexico would come to naught.
In April 2011, he hosted a meeting in Los Angeles with NSO’s founders Shulev Hulio and Omri Lavie, according to Caspi’s court-filed affidavit. Caspi subsequently got wind that his former boss was trying to go behind his back and create a direct connection to NSO. Caspi said he took steps to “neutralize” him and the deal was ultimately signed without Broidy’s participation.
Broidy went on to serve as the Republican Party’s deputy finance chairman in 2017 until reports of a hushed-up affair forced his resignation. The Wall Street Journal revealed that Broidy paid a former Playboy model $1.6 million after he had gotten her pregnant. The deal was negotiated by Trump’s then attorney Michael Cohen.
In 2020, Broidy admitted that, in exchange for millions of dollars, he agreed to do the bidding of a foreign government and foreign individual and lobby President Trump and others for the removal of a Chinese dissident, Guo Wengui, and to drop a case related to an embezzlement scheme from a Malaysian government bank. President Trump pardoned Broidy in his final hours in the White House.
Broidy would himself be the victim of what he claimed was a government-sponsored hacking attempt. Broidy sued Qatar and its agents in 2018 for allegedly hacking into his computer servers, stealing his confidential information, and leaking it to the media in an effort to neutralize Broidy’s criticism of the country. A federal judge dismissed the case. The lesson is an important one in a world of spyware for sale: The hunters can become the hunted.
