EY valued NSO Group at $2.3bn months before emergency bailout

EY, the Big Four accounting firm, valued the secretive Israeli spyware company NSO Group at $2.3bn just months before it needed emergency funding in a cash crunch and its equity was deemed worthless.

The EY valuation, more than twice what NSO had been valued at two years earlier, was made by analysts in the firm’s Luxembourg office in July last year, according to documents seen by the Financial Times. The estimate of NSO’s enterprise value was made without visiting the company or verifying the information its analysts had been provided.

By contrast Berkeley Research Group, a consultancy that represents NSO’s private equity owners, said earlier this year that the company’s equity was “valueless”.

The EY valuation was also far higher than what an unnamed potential buyer had offered just weeks earlier, when it proposed to take a minority stake in a deal valuing NSO at $1.6bn, including $500mn in debt. That figure was presented to NSO’s investors at a July 2021 meeting, according to a separate document seen by the FT, though the deal did not go through.

EY’s valuation was made as reports of the abuse of NSO’s Pegasus cyberweapon against activists and journalists ricocheted around the world. Around the same time, NSO’s private equity owner was riven by infighting, while the spyware maker was being sued by Meta, parent group of Facebook, for hacking its secure messaging platform WhatsApp.

Investment bankers and defence officials are now trying to assess the firm’s worth once more, in a potential deal to spin off NSO’s core assets to L3Harris, a US defence contractor. That sale is designed to sidestep a US Commerce Department blacklisting in November 2021 that has further damaged the company’s reputation and operations.

In a 132-page report that valued NSO and the other companies owned by the private equity group Novalpina Capital, EY described NSO as a “market leader” even though its revenues had fallen 17 per cent in 2020 while its competitors had grown healthily.

Months later Berkeley Research Group, which was brought in to wind up the private equity fund, reached its conclusion that the equity in NSO — once the jewel of Israel’s surveillance export industry — was worth zero.

In October 2021, BRG would provide a $10mn emergency loan to a sister company to NSO to help it meet payroll.

EY and NSO declined to comment for this article.

While it is not uncommon for the private valuations of tech firms to gyrate between valuation rounds and in between acquisitions, the process by which such numbers are assigned — in behind-closed-doors agreements often signed off by large professional services firms but not made public — is under growing scrutiny as listed companies’ valuations tumble.

EY’s report came at a pivotal moment. It was formally commissioned just two days before an international consortium of newspapers brought renewed attention to how NSO clients, which have included Saudi Arabia, the UAE and other authoritarian countries, used Pegasus to surreptitiously pierce the encryption on phones and turn them into surveillance devices.

By August 6, when EY signed off on the valuation, the company had been on front pages for weeks, and new sales had started to shrivel.

Still, EY said it was only valuing the company as of June 30, without assessing the impact of “increased adverse media attention” after that date. Even as that attention forced the company’s chief executive to publicly pledge reforms, EY decided that measuring its impact was outside its remit, choosing to ignore any “social or governance” issues.

By November, NSO had been added to a US trade blacklist, a further blow to its operations. In December a group of NSO creditors said in a letter to its majority shareholders that the company was insolvent.

The swings in estimates of what NSO is worth are also particular to the company, which has operated in the shadows of Israel’s military and diplomatic outreach to Arab and Gulf neighbours, while trying to attract the premiums that investors were willing, until recently, to pay for Israel-based tech firms.

Because it straddled the classified world of spycraft and the limited disclosures of a private equity-backed cyberweapons manufacturer, NSO managers have participated in debt roadshows. Chief executive Shalev Hulio has told friends that the company’s peers include publicly traded surveillance giants such as Palantir and Verint, while also shielding crucial operational and financial information behind non-disclosure agreements.

Moody’s has tracked NSO’s $500mn in junk-rated debt since its issuance in 2019, but said this month that it was withdrawing its rating because of “inadequate” information.

At EY, the valuation came with a disclaimer — their complicated financial modelling was just a “desktop valuation”, which meant it had not visited the company. EY said it was “reliant on the accuracy and completeness of the underlying information supplied to us” and did not verify it or check its accuracy.

Even desktop valuations can have important implications, especially since they signal how much NSO officials might hope to receive in incentive payouts — worth a total of $54.3mn if targets were hit, the EY report shows.

EY’s assessment cast NSO as a thriving tech company, with revenues expected to leap some 60 per cent by 2023 to $400mn with sustained media focus on the abuse of its signature Pegasus spyware having little to no impact on future sales. A counter-drone business and data analytics business would supplement the sales of Pegasus.

That differs sharply from the view held by the officers at Berkeley Research Group, which was brought in by the original investors in Novalpina — including Yorkshire and Oregon pension funds — and now oversees the fund.

BRG argued, according to correspondence seen by the FT, that NSO’s business could only continue by selling to “elevated risk customers” — deals that BRG has declined to approve.