Israel has updated the list of countries local companies are permitted to sell cybersecurity tools to, reducing the overall number to 37 countries, down from 102. The new list mainly includes western European countries, the U.S., and Canada (see full list below).
The updated list released at the beginning of November doesn't include countries such as Morocco, Mexico, Saudi Arabia, or the UAE, which according to reports are among the countries to have acquired offensive cyber tools from Israeli company NSO. The embroiled company hasn't confirmed which countries it has done business with but did state that it only sold to countries approved by the Ministry of Defense. Assuming this claim is correct, it seems that Israel was very lenient in providing approvals for the sale of cyber tools and was aware of all the sales being made by NSO.
The new list will significantly complicate matters for Israeli cybersecurity companies, especially those selling offensive cyber tools, to operate in countries with totalitarian regimes or with a record of violating human rights.
The Israeli cybersecurity sector currently generates $10 billion in annual revenue, with offensive cyber believed to be responsible for 10% of those sales. Some 13% of all cybersecurity companies operate from Israel, with 29% of all investments in the sector being directed to Israeli companies.
It is unclear whether one of the reasons the list was curtailed was due to the Ministry of Defense knowing that the U.S. Commerce Department was planning to add NSO and Israel's Candiru to its trade blacklist. The Commerce Department said earlier this month that NSO and Candiru sold spyware to foreign governments that used the equipment to target government officials, journalists, and others.
The Ministry of Defense told Calcalist: "The State of Israel is constantly reassessing its policy on supervising its defense export in general, including its policy on supervising the export of cyber products. The State of Israel only approves the export of cyber products for governmental organizations, to be used in a legal manner and for the purpose of preventing and investigating crime and fighting terror. All of this, in accordance with a commitment made by the acquiring country. As to when it becomes clear that an acquiring country is using the product not according to the terms of the license or not according to the commitment made by the acquiring country, the proper proceedings are initiated. The State of Israel doesn't specify its policy for supervising defense exports."
The updated list includes Austria, Italy, Iceland, Ireland, Estonia, Bulgaria, Belgium, the UK, Germany, Denmark, The Netherlands, Greece, Luxembourg, Latvia, Lithuania, Liechtenstein, Malta, Norway, Slovenia, Slovakia, Spain, Portugal, Finland, Czech Republic, France, Croatia, Cyprus, Romania, Sweden, Switzerland, Australia, India, Japan, New Zealand, South Korea, United States, and Canada.