Former NSO Chief Shalev Hulio Calls on Governments to Develop Sovereign AI Systems

Speaking on the strategic trajectory of advanced computing, Hulio argued that national security, defense readiness, and administrative autonomy require domestic control over foundation models and computational capacity. His intervention brings one of the commercial surveillance industry's most recognizable and controversial figures into the rapidly expanding debate surrounding technological sovereignty, at a time when governments across Europe, Asia, and the Middle East are evaluating their exposure to American cloud computing monopolies.

What happened

In his public assessment reported by Jean Leon, Hulio framed artificial intelligence as an existential sovereign asset akin to national defense architecture, intelligence collection apparatuses, or national energy grids. He cautioned that sovereign states that outsource their primary machine learning architectures, training pipelines, and data storage to foreign private corporations risk surrendering long-term strategic self-determination.

According to the reporting, Hulio's central thesis centers on the vulnerability inherent in relying on major United States technology vendors. Leading hyperscale cloud operators and frontier model developers—primarily based in Silicon Valley and Seattle—currently control the vast majority of cutting-edge foundational models, enterprise infrastructure, and specialized computational clusters worldwide. Hulio argued that foreign governments should commission, fund, and maintain their own sovereign models capable of operating securely within domestic borders, insulated from extraterritorial regulatory interventions, export controls, or corporate policy shifts.

The position reflects a broader transition within the cyber-defense sphere, where advanced machine learning is increasingly integrated into both defensive network protection and offensive intelligence operations. Hulio contended that nations lacking dedicated sovereign models would find their critical services, law enforcement bodies, and defense systems vulnerable to outside interference or abrupt service denials during geopolitical crises.

The push for sovereign artificial intelligence carries profound geopolitical, economic, and technological implications. When a nation state relies on commercial cloud providers based in another jurisdiction, its most sensitive institutional operations—including classified intelligence analysis, healthcare records, tax administration, and defense planning—are subject to legal frameworks outside its direct authority. Under United States legal precedents such as the Clarifying Lawful Overseas Use of Data Act (CLOUD Act) of 2018, federal law enforcement agencies can compel American technology firms to provide data stored on their servers, regardless of whether that data resides inside or outside United States borders.

Furthermore, computational independence determines how a nation can withstand geopolitical realignment. As Washington tightens export restrictions on cutting-edge microchips—such as the advanced graphics processing units produced by Nvidia and AMD—foreign nations risk being caught on the receiving end of sudden supply constraints. If an administration lacks domestic computational infrastructure and indigenous foundation models, its ability to automate public infrastructure, operate cyber defenses, and drive research could be unilaterally curtailed.

For enterprise markets and citizens, sovereign AI initiatives also directly shape regulatory enforcement. The European Union's General Data Protection Regulation (GDPR) and the newly ratified EU Artificial Intelligence Act impose strict obligations regarding data governance, transparency, and cross-border data transfers. Relying on centralized, proprietary models whose training datasets and alignment mechanisms are treated as corporate trade secrets complicates compliance for public agencies. Developing domestic models offers governments a way to train systems on local languages, adhere strictly to domestic privacy statutes, and avoid cultural or operational biases embedded in models trained predominantly on American data.

The background

Hulio's prominence in international defense and technology policy stems from his tenure at NSO Group, which he established in Herzliya, Israel, alongside Omri Lavie in 2010. The company became globally renowned—and heavily criticized—for its flagship software, Pegasus. Pegasus is a zero-click exploit suite capable of secretly infiltrating modern smartphones across Apple iOS and Google Android platforms, extracting messages, recording phone calls, and turning on microphones and cameras without requiring user interaction.

While NSO Group consistently stated that it licensed Pegasus exclusively to vetted law enforcement and intelligence agencies to combat terrorism and organized crime, international investigations exposed systemic abuses. In July 2021, the Pegasus Project—a collaboration involving Amnesty International, Citizen Lab, and more than 80 journalists across 17 media organizations—revealed that authoritarian and democratic governments alike had deployed the software against journalists, political dissidents, human rights attorneys, and foreign diplomats. Subsequent disclosures revealed infections on phones belonging to senior European officials, including Spanish Prime Minister Pedro Sánchez and French President Emmanuel Macron.

The fallout was severe. In November 2021, the United States Department of Commerce added NSO Group to its Entity List, restricting American businesses from selling hardware, software, or technical components to the company. Tech giants also retaliated in federal court: Meta subsidiary WhatsApp filed a landmark federal lawsuit in California in October 2019 alleging unauthorized access to its servers, followed by a similar federal suit filed by Apple in November 2021.

Hulio stepped down as chief executive of NSO Group in August 2022 during a major internal restructuring that resulted in the departure of roughly 100 employees. Shortly thereafter, Hulio turned his focus toward defensive technology, partnering with former Austrian Chancellor Sebastian Kurz to launch Dream Security. That Tel Aviv-based company was founded with a stated mandate to utilize artificial intelligence to protect critical infrastructure, municipalities, and enterprise systems from cyberattacks, illustrating Hulio's ongoing pivot toward the intersection of machine learning and state security.

Concurrently, the concept of "sovereign AI" has gained traction across world capitals. French President Emmanuel Macron has repeatedly advocated for European digital autonomy, pouring state resources into French artificial intelligence champions like Mistral AI. In the Middle East, the United Arab Emirates launched its open-source Falcon model through the Technology Innovation Institute in Abu Dhabi, while Saudi Arabia has directed sovereign wealth allocations into state-backed computing hubs. Hulio's comments align with this emerging consensus among middle-power states.

Reaction

Hulio's interventions inevitably attract scrutiny given his background in commercial surveillance. Civil society organizations, digital rights advocates, and cybersecurity researchers historically critical of NSO Group often view advice from its former leadership with deep skepticism. Critics frequently argue that figures with backgrounds in offensive cyber surveillance could use sovereign security arguments to justify state-funded contracts for opaque, proprietary intelligence technologies with minimal public oversight.

Within the defense and intelligence sectors, however, Hulio's diagnosis resonates with strategic planners who have warned for years about operational dependencies on foreign commercial software. Defense ministries in Europe and Asia have expressed growing unease about hosting operational mission data on foreign-owned hyperscale cloud platforms, even when those platforms offer localized "sovereign cloud" partitions.

American technology corporations have responded to the sovereign AI movement by attempting to localize their operations. Companies like Microsoft, Amazon Web Services, and Alphabet have launched dedicated regional cloud boundaries in Europe and partnered with local telecommunications operators to offer localized hosting. However, these arrangements have not fully resolved political concerns regarding the ultimate legal reach of the United States government over the parent corporations.

What we don't know yet

Significant operational and technical questions remain unanswered regarding Hulio's prescription. The reporting by Jean Leon did not specify the precise technical frameworks, licensing structures, or hardware sourcing strategies Hulio recommends for states pursuing sovereign artificial intelligence. Because the fabrication of cutting-edge hardware—specifically advanced semiconductors manufactured by Taiwan Semiconductor Manufacturing Company (TSMC)—remains concentrated in a handful of facilities globally, genuine infrastructure independence remains extraordinarily difficult for any single nation to achieve in isolation.

Additionally, it remains unclear whether Hulio's advocacy is purely analytical or intended to lay commercial groundwork for his current venture, Dream Security, or potential future advisory enterprises. The extent to which specific foreign governments are actively consulting former surveillance executives on sovereign artificial intelligence strategies has not been publicly documented, leaving a gap between theoretical policy recommendations and actual state procurement contracts.

What to watch

The progression of sovereign AI strategies will be shaped by upcoming regulatory, commercial, and diplomatic decisions over the coming years. Observers should track state procurement tenders issued by mid-sized powers and European Union member states for sovereign high-performance computing centers and domestic foundation models.

Key indicators of the sovereign AI trajectory include:

This report is based on reporting by Jean Leon.