"NSO" is referred to in the article, but it's never expanded or explained.
Apparently this is the "NSO Group" [1], a private company in Israel that sells "Pegasus" [2] (also referred to in the article).
Apparently this is the "NSO Group" [1], a private company in Israel that sells "Pegasus" [2] (also referred to in the article).
NSO is extraordinarily well known in the security field; they're one of the best known (but almost certainly not the largest or most effective) purveyors of mobile exploits and malware (to governments). For P0 (and Apple), NSO is "the adversary".
Edit: Oh, they ran up against this just a few weeks ago according to their Wikipedia article. How about that.
Google could potentially sue them under civil CFAA if there was some unauthorized access to Google infrastructure needed to develop the exploits, but that's unlikely to be the case.
Using NSO tools against unwilling targets would violate US law, but that's not what NSO does.
Standby while I look for a source.