UK-Israel deal: Why spyware scandals won't stop cybersecurity partnership
Israel will officially become a “tier-one cyber partner for the UK”, Israeli Foreign Minister Yair Lapid and British Foreign Minister Liz Truss said on Monday in a newspaper article announcing a new trade and defence deal between the countries.
However, experts say cyber security efforts between the two countries - largely intelligence and knowledge sharing - have run deep for years: back in 2018, British officials were already describing Israel as “a first order partner” on cyber security.
Even then, according to a research paper from the Britain Israel Communications and Research Centre (Bicom) lobby group, several major British banks and other financial institutions were protected by Israeli cyber security companies and technologies.
So what is new now? For one, it comes as the UK has faced as many ransomware attacks in the first quarter of this year than it had in all of 2020 which itself had three times the number of attacks of 2019, according to the National Cyber Security Centre’s annual review.
Israel, it seems, is looking to lead international efforts with Israeli Prime Minister Naftali Bennett declaring in July that the country was establishing “a global cyber defence shield” of countries working together on cyber security and had already signed up a dozen nations.
But the UK-Israeli agreement has also been made just months after allegations emerged that around 400 British citizens and residents were targeted with Pegasus spyware from the Israeli-based firm NSO Group, including two members of the House of Lords.
That was one of three cases that have emerged since July of Israeli spyware allegedly targeting UK citizens and entities. Cybersecurity experts have said the other two - including an attack on the London-based Middle East Eye - involved systems either made by or "strongly linked" to Candiru, another Israeli firm. A Candiru executive told MEE the company's products are meant to fight terror and crime, not to hack websites.
The deal also comes weeks after it emerged that the Israeli military has been surveilling Palestinians in the occupied West Bank with facial recognition technology and that Palestinians working for six aid agencies critical of Israel had been targeted with Pegasus spyware, many believe by the Israeli government.
A former minister told Middle East Eye that he thought the cyber security cooperation between the two countries was useful, but objected to the lack of acknowledgement by the British government of the “maltreatment and persecution of the Palestinians by the Israeli Defence Force and government”.
'Given Israel’s record, it is extremely dangerous for the UK to be embracing its high-tech sector'
- Chris Doyle, Council for Arab-British Understanding
“There are security threats in the region so if it is shared with the right motives, that’s good. I just don’t like the fact that it’s Palestine that gets ignored and suffers. Everything else is fine. Israel is a country. That’s good. All of that’s fine. But I object to the ethnic cleansing of Palestinians basically.”
Others like Chris Doyle, director of the Council for Arab-British Understanding, said the deal showed the British government had “sold out on human rights”.
“Given Israel’s record, it is extremely dangerous for the UK to be embracing its high-tech sector,” Doyle told Middle East Eye after the deal was announced.
“How can the Israeli authorities be trusted when it permitted one of its leading companies, NSO, to sell its Pegasus surveillance software to brutal regimes? That very software was used against British citizens as well as human rights defenders.”
MEE asked the Foreign, Commonwealth and Development Office whether the terms of the trade deal explicitly prohibit Israeli spyware from being used against targets in the UK, but did not receive an answer.
'The biggest secret sauce'
There were few details revealed on Monday about what the new agreement means tangibly for cyber security activities between Israel and the UK, which isn’t surprising given that what was signed was a framework for future cooperation.
Historically, Yossi Melman, an Israeli journalist, told MEE, the UK has been at the forefront of technological development for military and intelligence, and already has a well-developed cybersecurity programme.
But Israel, he said, would bring to the table more experience with offensive cyber attacks used, for example, in its cyberwar with Iran. “The UK would, as part of preparing itself for a future conflict, want to gather from the learning of the Israeli experience,” Melman said.
There are some clues about the direction of travel in a speech the UK’s top cyber security official Lindy Cameron told an audience this July at CyberWeek at Tel Aviv University.
“The UK-Israel cyber security relationship is built on the long-standing ties of an enduring national security alliance. Operational collaboration between our agencies - and many other agencies represented at this conference - is strong and well developed,” Cameron said.
“It focuses on exchanges of threat reporting and analysis of trends, something I am pleased to say continued successfully throughout the challenge of Covid.”
Specifically, Cameron highlighted several ways Israel had been able to cross-pollinate between its military, intelligence community and private sector to develop its cyber capabilities.
She said Israel’s Cyber Innovation Arena in Be’er Shiva - known as CyberSpark - has served as one of the inspirations for Cyber Central, a nearly square-mile-large business park housing cyber-related companies, now being built on the outskirts of Cheltenham, Gloucestershire, where GCHQ, the British intelligence and security centre is based.
Cyber Central, Cameron said, will be “a hive of industry collaboration, ranging from tech giants to start-ups as well as academia and government”. It is also the anchor of the broader Golden Valley Development that developers say will bring around 12,000 jobs to Gloucestershire.
She also said that the UK had drawn inspiration from Talpiot, an elite, nine-year-long Israeli military training programme in technology that has also produced many of the country’s tech entrepreneurs and their innovations.
Building synergies between intelligence and technology industry is clearly an area of interest to the UK with the MI6 chief Richard Moore saying in his first public speech on Tuesday that intelligence agencies can’t work alone, given the speed at which technology is developing.
“Unlike Q in the Bond movies, we cannot do it all in-house,” Moore said. “Our adversaries are pouring money and ambition into mastering artificial intelligence, quantum computing and synthetic biology, because they know that mastering these technologies will give them leverage. An intelligence service needs to be at the vanguard of what is technologically possible.”
Bennett, himself a former elite commando turned tech entrepreneur, has made similar comments, describing this coming together for which his country is well-known as “the biggest secret sauce of Israel”.
“The biggest thing we did is create an industry - or allow an industry to thrive. No country alone, no government or combination of governments can solve this problem,” he said at the same Tel Aviv University cyber gathering in July. “We need the prowess of the private industry.”
Checks and balances
Of course, it’s private Israeli spyware companies that have been making headlines for allegedly enabling repressive governments to target and surveil human rights defenders, dissidents, journalists and heads of state. So should the UK be worried about going down this road?
Emily Taylor, CEO of Oxford Information Labs and an associate fellow in Chatham House’s International Security programme, said activities in this field often come with inherent human rights risks and require checks and balances - and mechanisms which ensure they are being observed.
“The UK, I think, has a great respect for its intelligence agencies,” Taylor said. “But part and parcel of maintaining that trust is also in making sure that there isn’t too much of a deferential attitude from say the parliamentary committees or the oversight mechanisms that are meant to look into their work.”
Compared to the US government that blacklisted the NSO Group and Candiru, the British government has been muted in its response to the allegations about the 400 British citizens who may have been targeted by Pegasus spyware.
'We’ve got to try to challenge ourselves to get out of binary thinking like "One Nation, Bad. One Nation, Good"'
- Emily Taylor, Oxford Information Labs and Chatham House
After the Pegasus stories were published, a British minister told members of the House of Lords that the government had raised its concerns about the NSO Group's operations "several times" with Israel, but has not answered further questions about what sparked the complaints or when they were made.
A source close to NSO Group told the Guardian in October that Pegasus could no longer target UK numbers, a change reportedly implemented in 2020 after it realised the spyware had been used to hack the mobile phones of Princess Haya and her lawyer, Fiona Shackleton, who is also a member of the House of Lords.
But questions still remain. Amnesty, which was one of the partners in the Pegasus papers, urged the UK’s Foreign Affairs committee last month to conduct an immediate investigation into the allegations, saying not enough had been done.
Could it be, MEE asked Taylor, given the UK’s established ties to Israel on cyber security, that the British government had calculated that it was better to handle the Pegasus allegations privately?
Taylor said that was possible, but also said it was important that incidents like the alleged Pegasus targeting "are not just papered over".
“It’s about trying to develop the ability to have proper checks and balances, the ability to assess after the event, how certain tools were used by different partners," she said.
“We’ve got to try to challenge ourselves to get out of binary thinking like ‘One Nation, Bad. One Nation, Good’….Or ‘This is a good thing, so it can’t be bad in any way’. Everything is imperfect and everything in it has its failings that need to be honestly addressed."
Middle East Eye delivers independent and unrivalled coverage and analysis of the Middle East, North Africa and beyond. To learn more about republishing this content and the associated fees, please fill out this form. More about MEE can be found here.
