In the wake of the murder of Saudi Arabian journalist and dissident Jamal Khashoggi in 2018, The Washington Post reported that Saudi Arabia had conducted some of its transactions with NSO Group through one of the company’s Luxembourg-based entities, Q Cyber Technologies (a spokesperson for NSO Group and Q Cyber neither confirmed nor denied any of the firm’s clients). Questioned by a member of its Parliament on the matter, the government of Luxembourg said in February 2019 that it would consider “the possibility of legislation on the obligation for due diligence for companies registered in Luxembourg.”
In July 2021, the Pegasus Project pointed out that Luxembourg hosted the parent company of NSO Group, OSY.
Two days after the revelations, Luxembourg Minister of Foreign Affairs Jean Asselborn confirmed that NSO Group has “two offices” in the Grand Duchy, but said they did not apply for export licenses of cybersurveillance products. The government of Luxembourg also said that NSO Group was represented by seven additional entities in Luxembourg, and that there was no evidence that the phones of Luxembourgish citizens had been infected using Pegasus. The same day, Asselborn addressed a letter to the managers of NSO Group’s Luxembourg-based entities to say that Luxembourg would not tolerate operations from them that would contribute to the violation of human rights abroad.
In October 2021, the Prime Minister of Luxembourg Xavier Bettel suggested during a live-streamed event that the Luxembourg government had bought Pegasus, saying that “when we bought it, it was for reasons of state security.” The Prime Minister backtracked three days later in an answer to parliamentary questions, stating that he was “referring in a general manner to the purchase of such a tool.
After the U.S. ban of NSO Group, the government of Luxembourg said in late 2021 that the Grand Duchy could not blacklist the company because its legislation “does not provide” for such a procedure.
In September 2022, Direkt36 disclosed that Pegasus was sold to Hungary via a Luxembourg-registered company of NSO Group.
In early 2023, media outlets reported that the management of five Luxembourg-based firms linked to NSO Group was moved to London and that co-founder Omri Lavie had emerged as majority owner via a new Luxembourg-based holding company, Dufresne Holdings.
In May 2023, the PEGA committee stated in its report that Luxembourg “functions as an important business hub for NSO Group.” In June 2023, the European Parliament adopted the PEGA committee’s recommendations with an overwhelingmajority.