On May 3, 2026, the head of Israel's National Fraud Investigations Unit, deputy commissioner Eli Makmal, closed the file on NSO Group's sale of Pegasus spyware to Ghana, citing "a lack of evidentiary basis" and declining to investigate any Israeli party. The decision, first reported in detail by The Wire, lands roughly six years after a Ghanaian court convicted three officials over the same transaction — and after the case had been passed between the State Attorney, the police investigations division, and a special Defence Ministry unit, none of which wanted it.
The underlying facts are not in dispute. In May 2020, an Accra court convicted and jailed three former officials — Salifu Osman, William Tetteh Tevie, and Eugene Baffoe-Bonnie — for causing the state a roughly $4 million loss in procuring Pegasus for Ghana's National Communications Authority through a reseller, without proper authorisation. It is believed to be the first time any government officials anywhere were jailed for doing business with NSO. The Ghanaian side was adjudicated in open court. The Israeli side — who authorised the export, who profited, whether the licensing was clean — has now been formally set aside.
The case for closing the file
The strongest argument for the police decision deserves to be stated plainly. Export licensing of cyber tools is a sovereign national-security and foreign-policy function, and prosecutors are not obliged to open a criminal probe every time a foreign buyer is later convicted at home for procurement fraud. The crime adjudicated in Ghana was a Ghanaian one: officials breaching their own country's procurement and anti-corruption rules. If Israeli investigators genuinely found no evidence that an Israeli committed an offence under Israeli law, declining to prosecute is the lawful and proper outcome. Fishing expeditions into a licensed defence export — potentially exposing classified intelligence-cooperation channels — are not costless, and a presumption of restraint has real merit.
That case is coherent. What undermines it is the procedural history the police decision sits on top of.
Why the process, not the verdict, is the problem
A "lack of evidentiary basis" is a credible finding when an arms-length regulator reaches it after looking. It is far less credible when, as here, the file shuffled between three bodies that each cited their proximity to NSO as a reason to pass it along. NSO operates under Defence Ministry export licences; the Ministry's own units are therefore structurally conflicted in judging whether those licences were lawfully granted. When the entity that authorised the export is also positioned to decide whether authorising it was a crime, "no evidence" and "no independent look" become impossible to tell apart. As far back as January 2024, Israel's attorney general was publicly chided by activists and academics for the same non-investigation.
This is not an argument that NSO is guilty. It is an argument that opacity is corrosive — and corrosive first of all to the legitimate Israeli cyber sector, which is exactly the constituency a pro-innovation publication should care about protecting.
Impunity is bad industrial policy
Israel's offensive-cyber industry is a genuine national asset, and there is a defensible market for lawful-intercept tools sold to rule-of-law democracies under court supervision. But that market only survives if buyers, partners, and allied governments believe abuses get investigated. The alternative is what the world has already begun delivering: blunt, sector-wide punishment.
In November 2021, the US Commerce Department's Bureau of Industry and Security added NSO Group to its Entity List, finding the company "developed and supplied spyware to foreign governments that used these tools to maliciously target government officials, journalists, businesspeople, activists, academics, and embassy workers." In March 2023, the White House went further with Executive Order 14093, barring US agencies from using commercial spyware that poses counterintelligence or human-rights risks. Notably, that order is not a blanket ban — it carves out testing, research, and criminal investigations of spyware misuse. It is, in other words, a model of proportionate regulation: targeted at abuse, not at the technology.
That contrast is the whole point. The American response is transparent, rule-bound, and reviewable. The Israeli response — discretionary export licensing administered by the same ministry that benefits from exports, with criminal accountability quietly declined — looks like capture. Even Israel's own 2022 freeze on offensive-cyber export licences pending review (reported by The Times of Israel in February 2022) was an internal administrative act, not an independent inquiry.
A better path
Proportionate regulation does not mean defending Pegasus, and it does not mean an export ban that would punish hundreds of legitimate Israeli cybersecurity firms for one company's record. It means the unglamorous middle: an investigatory body independent of the licensing authority; published licensing criteria and refusal statistics; and a credible commitment to actually prosecute when a deal turns out to be tainted.
Closing the Ghana file the way Israel did achieves the opposite. It tells allies that Israeli accountability stops at the water's edge, and it hands ammunition to those who would rather blacklist the whole sector than trust it to police itself. For an industry whose long-term licence to operate depends on being trusted, that is the most expensive kind of short-term relief.