Israel restricts cyberweapons export list by two-thirds, from 102 to 37 countries

The Israeli government has restricted the list of countries to which local security firms are allowed to sell surveillance and offensive hacking tools by almost two-thirds, cutting the official cyber export list from 102 to 37 entries.

The new list, obtained by Israeli business newspaper Calcalist earlier today, only includes countries with proven democracies, such as those from Europe and the Five Eyes coalition:

Australia, Austria, Belgium, Bulgaria, Canada, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Iceland, India, Ireland, Italy, Japan, Latvia, Liechtenstein, Lithuania, Luxembourg, Malta, New Zealand, Norway, Portugal, Romania, Slovakia, Slovenia, South Korea, Spain, Sweden, Switzerland, the Netherlands, the UK, and the US.

Security firms can freely sell exploits and hacking tools to entities in any of the countries above. For sales to entities in countries not on this list, vendors must apply for a special license with the Israeli government.

The list noticeably removes autocratic regimes, to which Israeli companies have often supplied surveillance tools.

Spyware developed by Israeli companies like Candiru and the NSO Group has been linked in recent years to human rights abuses in tens of countries, with the tools being used by the local governments to spy on reporters, activists, dissidents, and political rivals.

Cyber export list update to impact Israeli cyberweapons market

Calcalist reporters said the government did not issue any statement on the list's update, and it is not yet clear why it was narrowed down earlier this month.

However, the timing suggests the Israeli government might have been forced into this decision by its allies.

The list's update comes a week after Israeli and French officials held a secret meeting to discuss allegations that spyware made by the NSO Group might have been used against French president Emmanuel Macron.

The update also came around the same time that the US sanctioned four surveillance vendors, including Israel's Candiru and NSO Group.

The sanctions are said to have put NSO into a death spiral, with the company going from a possible sale to French investors to losing its newly-appointed CEO and possible bankruptcy, as it has become a company-non-grata in the cyberweapons field.

In an episode of the Risky Business podcast last month, Azimuth Security co-founder Mark Dowd touched on the topic of Israeli-based surveillance vendors and their penchant for selling to offensive regimes, putting it on the fact that these companies don't usually have contacts in western governments to contend with western rivals.

With the Israeli Defense Ministry putting the reigns on exports to autocratic regimes, the restricted cyber export list is expected to put a giant dent in Israel's estimated $10 billion surveillance market.

A report by the Atlantic Council published earlier this month put the number of companies selling surveillance and hacking tools at around 224, with 27 based in Israel.

Article updated to reflect that the sale to countries outside this smaller list is possible, but with a special permit from the Israeli government.