{
  "version": "1.0.0",
  "generatedAt": "2026-10-19T06:38:51.810Z",
  "findingType": "finding",
  "findingId": 4121,
  "contentHash": "83d55195e703efa3651dff2adb81aad992b7600c255bf09014ba94c51daed06e",
  "title": "NSO Group Maintained SEC EDGAR Activity Through US Entity List Sanctions Period; Trump Administration Expanded Entity List in September 2025 to Cover Subsidiaries",
  "summary": "In November 2021, the U.S. Department of Commerce added NSO Group to the Entity List under Section 744.11(b) of the Export Administration Regulations for supplying spyware to foreign governments used \"to maliciously target government officials, journalists, businesspeople, activists, academics, and embassy workers.\" The End-User Review Committee — including representatives from Defense, State, Energy, and Treasury — found NSO's conduct enabled transnational repression. The Entity List designation creates licensing requirements that effectively bar U.S. exports to listed entities. Goblin House platform pattern analysis flagged SEC EDGAR filing continuity associated with NSO Group identifiers from May 2021 through 2025-2026, including a February 2025 filing resumption consistent with debt-instrument maturity or restructuring events. No publicly documented Bureau of Industry and Security enforcement action against NSO Group for failure-to-file or continued U.S. financial market engagement has been identified in the period since the designation. Separately, in September 2025, the second Trump administration adopted a new rule expanding Entity List coverage to majority-owned subsidiaries (≥50%) — a regulatory acknowledgment that the original Entity List framework left meaningful enforcement gaps when listed entities operated through subsidiary structures.",
  "methodology": "This finding was identified through systematic investigation of 4 entities. Evidence was classified as \"significant\" severity based on source verification tier (government_document, policy_database, news_reporting). The finding was reviewed under editorial status \"published\".",
  "sources": [
    {
      "url": "https://www.commerce.gov/news/press-releases/2021/11/commerce-adds-nso-group-and-other-foreign-companies-entity-list",
      "label": "U.S. Department of Commerce: Commerce Adds NSO Group and Other Foreign Companies to Entity List for Malicious Cyber Activities",
      "type": "primary"
    },
    {
      "url": "https://2021-2025.state.gov/the-united-states-adds-foreign-companies-to-entity-list-for-malicious-cyber-activities/",
      "label": "U.S. Department of State: The United States Adds Foreign Companies to Entity List for Malicious Cyber Activities",
      "type": "primary"
    },
    {
      "url": "https://sanctionschecklist.com/entity/BIS_ad4afeeb288a",
      "label": "Sanctions Checklist: NSO Group BIS Entity List record",
      "type": "primary"
    },
    {
      "url": "https://en.wikipedia.org/wiki/Entity_List",
      "label": "Wikipedia: Entity List (September 2025 subsidiary expansion documented)",
      "type": "primary"
    },
    {
      "url": "https://goblinhouse.net/entity/nso-group",
      "label": "NSO Group — entity dossier",
      "type": "primary"
    },
    {
      "url": "https://goblinhouse.net/entity/instrument",
      "label": "Instrument — entity dossier",
      "type": "primary"
    }
  ],
  "queries": [
    {
      "description": "Finding record lookup",
      "table": "findings",
      "parameters": {
        "id": 4121
      }
    },
    {
      "description": "Involved entity resolution",
      "table": "entities",
      "parameters": {
        "names": [
          "NSO Group",
          "U.S. Department of Commerce",
          "Bureau of Industry and Security (BIS)",
          "Donald Trump"
        ]
      }
    }
  ],
  "dataSnapshot": {
    "id": 4121,
    "title": "NSO Group Maintained SEC EDGAR Activity Through US Entity List Sanctions Period; Trump Administration Expanded Entity List in September 2025 to Cover Subsidiaries",
    "findingType": "regulatory_capture",
    "description": "In November 2021, the U.S. Department of Commerce added NSO Group to the Entity List under Section 744.11(b) of the Export Administration Regulations for supplying spyware to foreign governments used \"to maliciously target government officials, journalists, businesspeople, activists, academics, and embassy workers.\" The End-User Review Committee — including representatives from Defense, State, Energy, and Treasury — found NSO's conduct enabled transnational repression. The Entity List designation creates licensing requirements that effectively bar U.S. exports to listed entities. Goblin House platform pattern analysis flagged SEC EDGAR filing continuity associated with NSO Group identifiers from May 2021 through 2025-2026, including a February 2025 filing resumption consistent with debt-instrument maturity or restructuring events. No publicly documented Bureau of Industry and Security enforcement action against NSO Group for failure-to-file or continued U.S. financial market engagement has been identified in the period since the designation. Separately, in September 2025, the second Trump administration adopted a new rule expanding Entity List coverage to majority-owned subsidiaries (≥50%) — a regulatory acknowledgment that the original Entity List framework left meaningful enforcement gaps when listed entities operated through subsidiary structures.",
    "severity": "significant",
    "evidenceSummary": "Entity List designation November 2021: U.S. Department of Commerce press release, U.S. Department of State statement. Sanctions Checklist database entry confirms NSO Group's Entity List status. Trump administration's September 2025 Entity List subsidiary expansion: confirmed by multiple sources covering the rule change. Platform pattern analysis on SEC filing continuity is flagged as inference-tier observation pending direct verification of EDGAR records for entity-list-period activity.",
    "publicInterest": "The November 2021 Entity List designation was a high-profile sanctions action against a company whose spyware had been documented targeting journalists, dissidents, and U.S. officials abroad. Continued SEC filing activity by NSO-associated entities during the sanctions period — whether through subsidiaries, debt restructuring, or other financial channels — represents a documented enforcement-gap pattern that the Trump administration's September 2025 expansion of the Entity List implicitly recognized. Whether NSO Group's specific filing activity constituted Entity List violations is a determination for the Bureau of Industry and Security; the absence of any public enforcement record over four years warrants oversight scrutiny.",
    "sourceTypes": [
      "government_document",
      "policy_database",
      "news_reporting"
    ],
    "sourceUrls": [
      {
        "url": "https://www.commerce.gov/news/press-releases/2021/11/commerce-adds-nso-group-and-other-foreign-companies-entity-list",
        "label": "U.S. Department of Commerce: Commerce Adds NSO Group and Other Foreign Companies to Entity List for Malicious Cyber Activities"
      },
      {
        "url": "https://2021-2025.state.gov/the-united-states-adds-foreign-companies-to-entity-list-for-malicious-cyber-activities/",
        "label": "U.S. Department of State: The United States Adds Foreign Companies to Entity List for Malicious Cyber Activities"
      },
      {
        "url": "https://sanctionschecklist.com/entity/BIS_ad4afeeb288a",
        "label": "Sanctions Checklist: NSO Group BIS Entity List record"
      },
      {
        "url": "https://en.wikipedia.org/wiki/Entity_List",
        "label": "Wikipedia: Entity List (September 2025 subsidiary expansion documented)"
      },
      {
        "url": "https://goblinhouse.net/entity/nso-group",
        "label": "NSO Group — entity dossier"
      },
      {
        "url": "https://goblinhouse.net/entity/instrument",
        "label": "Instrument — entity dossier"
      }
    ],
    "reviewStatus": "published",
    "goblin": null,
    "createdAt": null
  },
  "entities": [
    {
      "id": 644,
      "name": "Bureau of Industry and Security (BIS)",
      "slug": "bureau-of-industry-and-security-bis",
      "type": "government_agency"
    },
    {
      "id": 97,
      "name": "NSO Group",
      "slug": "nso-group",
      "type": "company"
    },
    {
      "id": 9122,
      "name": "Donald Trump",
      "slug": "donald-trump",
      "type": "person"
    }
  ],
  "verificationSteps": [
    "Retrieve finding #4121 from the findings table and confirm title, description, and severity match this bundle.",
    "Visit source: https://www.commerce.gov/news/press-releases/2021/11/commerce-adds-nso-group-and-other-foreign-companies-entity-list — confirm the claim described in the evidence summary.",
    "Visit source: https://2021-2025.state.gov/the-united-states-adds-foreign-companies-to-entity-list-for-malicious-cyber-activities/ — confirm the claim described in the evidence summary.",
    "Visit source: https://sanctionschecklist.com/entity/BIS_ad4afeeb288a — confirm the claim described in the evidence summary.",
    "Visit source: https://en.wikipedia.org/wiki/Entity_List — confirm the claim described in the evidence summary.",
    "Visit source: https://goblinhouse.net/entity/nso-group — confirm the claim described in the evidence summary.",
    "Visit source: https://goblinhouse.net/entity/instrument — confirm the claim described in the evidence summary.",
    "Cross-reference involved entities (NSO Group, U.S. Department of Commerce, Bureau of Industry and Security (BIS), Donald Trump) in the entities table.",
    "Verify the SHA-256 content hash by re-generating the JSON bundle and hashing it."
  ]
}