Presumably, the latter is less of a risk; they probably don't want NSO to know their business and there's going to be at least metadata leaking that points to what they're doing. Plus, presumably, there's always a chance NSO could play them off to a higher bidder?

I agree about UAE wanting to keep their cards close to the chest, but I think the choice between NSO/other third party hacking groups and developing in house is an AND statement, not OR. At the end of the day, developing adequate zero day chains that provide access akin to NSO's Pegasus is an extremely time and talent intensive endeavor, and having multiple options to procure those capabilities is the more likely solution.

the principal agent problem. whenever you hire an agent whose interests are not specifically aligned with yours, theres an existential problem ensuring your principal concerns are acted upon.

so yeah, you want your agents to have a principal stake so havi g a nsa agen direct your staff brings more surety than some random third party like nso doing your dirty work even if its just handing over software. we all know it matters the route your hardware and software comes from if you are involved in national security.

> we all know it matters the route your hardware and software comes from if you are involved in national security.

No security apparatus in the world has the capability to build and execute everything they want to on their own. Hardware and software is always procured from multiple sources.

The price of a software, or use of an exploit, for a nation state is nothing!

Money is probably not the only factor.

UAE is probably very suspicious of NSO software coming from Israel, and what other, hidden, capabilities it might have.

yeah, no matter how equally dirty your supplier is, they still have different motives than you, regardless of any human bias.

perfect principal-agent problem