What the Records Show
An investigation published July 16, 2026 by OCCRP, Código Morse, and Shomrim — with reporting partner Haaretz — found that NSO Group co-founder Shalev Hulio entered Panama on December 3, 2013, via Copa Airlines using an Israeli diplomatic passport. Immigration paperwork lists his profession as "diplomat," his purpose as "recreation," and his address as the Israeli embassy in Panama City. The name recorded, "Shalev Holy," matches a signature on an NSO Pegasus contract; the personal ID number and birth date match corporate filings tied to Hulio in the UK and Luxembourg.
Hulio denies it outright: "Allegations concerning a diplomatic passport and my purported role as a representative of the State of Israel are entirely false and categorically denied." But Citizen Lab's John Scott-Railton told reporters the finding "raises questions about NSO's connections to the [Israeli] state," and Israeli attorney Eitay Mack was blunter, calling the government-NSO separation "a smokescreen" and describing the firm as "one of Israel's main tools" for building foreign intelligence relationships.
Why This Matters Beyond One Passport
NSO has spent a decade insisting it is an ordinary private vendor: it builds Pegasus, vets buyers, and hands over a product it does not operate. That framing has mattered legally and diplomatically — it is the basis on which NSO has resisted lawsuits (including from WhatsApp) arguing it merely sells software, not conducts surveillance itself. A diplomatic passport used by a company founder while apparently representing Panama's embassy interests, around the time — per the same investigation — Panama paid roughly $8 million for a 2012 Pegasus deal licensing up to 300 device infections, cuts against that framing. It suggests Israeli state infrastructure was, at least once, placed directly at NSO's disposal for a commercial sales relationship.
The same investigation ties Morocco's Pegasus use (internally codenamed "Morgan" since 2017) to confirmed infections on the phones of journalist Omar Radi and historian Maati Monjib, and links it to French and Spanish findings that Pegasus reached the devices of a French deputy minister and Spanish Prime Minister Pedro Sánchez along with two of his ministers. Reporting notes Israel's Defense Ministry later blocked a Moroccan purchase from a different spyware maker, QuaDream, partly because of Morocco's prior misuse against France and Spain — evidence the ministry does exercise real discretion, at least after the fact.
The Case for Tighter State Accountability
The strongest argument for treating this as a state-conduct story, not just a corporate-ethics one, is straightforward: under Israel's Defense Export Control Law, 5766-2007, every foreign Pegasus sale already requires approval from the Defense Export Controls Agency (DECA) within the Ministry of Defense. If a DECA-licensed product is sold with what looks like direct diplomatic facilitation, then Israel isn't a passive licensor watching a private company operate — it is a participant in placing offensive cyber capability into foreign hands, and it owns some share of what follows, including hacks of a sitting Spanish prime minister and French officials. Critics are right that a light-touch, after-the-fact licensing regime cannot absorb that kind of exposure; it invites exactly the deniability NSO and, implicitly, Israeli officials have relied on.
Why the Answer Is Enforcement, Not a New Ban
That case is real, but it argues for closing an accountability gap, not for treating commercial cyber-intelligence tools as inherently illegitimate. DECA's licensing framework already asks the right questions — end use, human-rights exposure, geopolitical risk — and the Defense Ministry has shown it will act, freezing Morocco's follow-on purchase after confirmed misuse. The Panama passport finding is damaging precisely because it suggests those controls were bypassed through informal state assistance, not because the underlying export-licensing model is broken. A blanket spyware ban would also cut off legitimate counterterrorism and serious-crime investigation uses that the license conditions are explicitly designed to permit, per the Ministry's own stated licensing terms restricting exports to "government figures only for legal purposes and to prevent and investigate crimes and to combat terrorism."
The proportionate fix is narrower and more enforceable: require disclosure when NSO or comparable firms' personnel use diplomatic channels, facilities, or documents in the course of a sale; mandate that DECA's end-use declarations be independently auditable rather than self-certified by purchasing governments; and give Israeli courts or the Knesset's Foreign Affairs and Defense Committee standing to review specific licensing decisions when credible misuse allegations surface — as they now have, repeatedly, across Morocco, Spain, and France. That keeps the export-control system intact while removing the ambiguity a diplomatic passport creates. The industry doesn't need to disappear; the state relationship behind it needs to stop hiding in plain sight.