Pegasus NSO Spyware

Introduction

Pegasus is a mobile phone surveillance software package developed by the Israeli private-intelligence firm NSO Group Technologies. Marketed exclusively to government clients as a tool for fighting terrorism and serious crime, Pegasus is capable of silently infecting both iOS and Android devices, extracting call records, messages, emails, photos, and GPS data, and — in its most advanced versions — activating the microphone and camera without the target's knowledge. Its infection mechanism has evolved from targeted link-click attacks to "zero-click" exploits that require no action by the target.

The framing of Pegasus as a "conspiracy theory" is somewhat misleading: the core claims — that Pegasus exists, that it can do what it is alleged to do, and that it has been used against journalists, activists, and politicians — are not conspiracy speculation but documented forensic findings. The conspiracy dimensions concern scale, authorisation, and the degree to which NSO Group or its clients acted unlawfully or unethically.

Citizen Lab and the Forensic Record

The first forensic documentation of Pegasus came from Bill Marczak and John Scott-Railton of the Citizen Lab at the University of Toronto's Munk School of Global Affairs. In 2016, their analysis of an attack on UAE human rights activist Ahmed Mansoor provided the first technical reconstruction of how Pegasus infected a device via a targeted link. Apple issued an emergency patch (iOS 9.3.5) within ten days of Citizen Lab's disclosure. This episode established the forensic methodology that subsequent Pegasus investigations have used.

Between 2016 and 2021, Citizen Lab published multiple reports documenting Pegasus infections on devices belonging to journalists, dissidents, and lawyers across Mexico, Saudi Arabia, India, Azerbaijan, Kazakhstan, Rwanda, and at least a dozen other countries. NSO Group consistently denied misuse, arguing that Pegasus was sold only to vetted government clients for lawful interception of terrorism and serious crime suspects.

The 2021 Pegasus Project

In July 2021, Forbidden Stories (a Paris-based nonprofit journalism organisation) and Amnesty International published the results of a coordinated investigation involving 80 journalists across 17 media organisations — including The Guardian, Le Monde, Süddeutsche Zeitung, the Washington Post, and others. The investigation was based on a leaked list of over 50,000 phone numbers that appeared to have been selected as surveillance targets by NSO Group clients.

Key findings of the Pegasus Project:

• Journalists and media figures: Over 180 journalists from 20 countries appeared on the list, including reporters from Reuters, the Associated Press, the Financial Times, CNN, Le Monde, Al Jazeera, and others.
• Khashoggi associates: Numbers associated with family members and close associates of Washington Post columnist Jamal Khashoggi — murdered in the Saudi consulate in Istanbul in October 2018 — appeared on the list. Forensic analysis of the phone of Khashoggi's fiancée, Hatice Cengiz, confirmed Pegasus infections.
• Heads of state: The French government subsequently confirmed that President Emmanuel Macron's phone number appeared on the list. Moroccan intelligence was identified as the likely client responsible; Morocco denied this. Numbers associated with at least fourteen other heads of state and senior government officials appeared on the list.
• Catalan independence figures: At least 65 individuals connected to the Catalan independence movement — including Catalan President Carles Puigdemont and other politicians and lawyers — were identified as targets, with the Spanish government implicated as the client.

Amnesty International's Security Lab performed forensic analysis on a sample of devices and confirmed Pegasus infections on 37. NSO Group disputed the methodology and the interpretation of the leaked list, arguing that the list was not an NSO product and that the forensic analyses contained errors.

Apple and Meta Lawsuits

In November 2021, Apple filed suit against NSO Group in federal court in California, seeking to permanently bar NSO from using Apple products and services, and seeking damages. Apple simultaneously disclosed an iOS vulnerability (CVE-2021-30860) that NSO had exploited via iMessage in a zero-click attack dubbed "FORCEDENTRY." The complaint cited Citizen Lab's forensic work extensively.

Meta (then Facebook) had filed an earlier lawsuit in October 2019, alleging that NSO had used WhatsApp infrastructure to deliver Pegasus to approximately 1,400 devices in a two-week window in May 2019, targeting journalists, human rights activists, and government officials. That lawsuit is ongoing.

US Commerce Department Entity List

In November 2021, the US Department of Commerce added NSO Group (and Candiru, another Israeli surveillance firm) to its Entity List, restricting US companies from exporting technology to NSO without a licence. The Commerce Department cited credible evidence that NSO had supplied spyware to foreign governments that used it to maliciously target government officials, journalists, businesspeople, activists, academics, and embassy workers. This is a formal US government determination, not a speculative claim.

NSO Group's Defences

NSO Group has consistently argued:

1. Pegasus is sold only to vetted government clients for lawful interception of terrorism and serious crime suspects.
2. NSO has no visibility into which specific targets its clients select; it provides the tool, not the targeting.
3. Amnesty International's forensic methodology contains errors; the 50,000-number list is not an NSO product.
4. NSO terminated contracts with clients found to have misused the product, and has a human rights policy.

These defences are partially credited in the record: NSO has terminated some client contracts. But the forensic evidence of infections — confirmed by Apple, Citizen Lab, and Amnesty International's Security Lab independently — establishes that the product has been used against civilians, journalists, and activists, not only terrorism suspects.

Why the Verdict Is "Confirmed"

The core claims are forensically confirmed by multiple independent technical teams including Citizen Lab (University of Toronto), Amnesty International Security Lab, and Apple's own vulnerability disclosure process. The US government's formal Entity List designation constitutes an official determination of misuse. The victims are identified by name. The scale (50,000+ numbers) and breadth of targets (journalists, activists, heads of state, Khashoggi associates) are documented, not speculated. The outstanding contested questions — precise authorisation chains for each targeting decision, the complete universe of clients and operations — do not undermine the core confirmed claims.

What Would Change Our Verdict

• Comprehensive client and targeting disclosure by NSO Group (would clarify scale)
• Judicial findings in the Apple and Meta lawsuits (would clarify specific legal violations)
• Successor technology assessments as Pegasus evolves

Verdict

Confirmed. Pegasus's existence and capabilities are forensically documented by multiple independent technical teams. Its use against journalists, activists, Khashoggi associates, and heads of state is confirmed by Citizen Lab, Amnesty International, and Apple's own vulnerability disclosure. The US Commerce Department has formally determined misuse. NSO Group's contested defences do not overturn the forensic record; they contest scope and authorisation at the margins.

The Forensic Record Continues: 2022-2025

Citizen Lab's monitoring of Pegasus deployments did not stop with the 2021 Pegasus Project. Working with Mexico's R3D digital-rights group, Citizen Lab documented new infections occurring between 2019 and 2021 — years after the Mexican government had publicly claimed to have discontinued its Pegasus contracts. Confirmed targets included human rights defender Raymundo Ramos, infected after documenting alleged military abuses; journalist Ricardo Raphael, hacked repeatedly while reporting on corruption and cartel ties; an anonymous reporter at the outlet Animal Político; and opposition politician Agustín Basave Alanís. Unlike the link-based attacks documented in earlier Mexican cases, these were zero-click infections requiring no action by the victim. Citizen Lab and Amnesty International's Security Lab have since documented further Pegasus infections of civil society figures in Jordan, El Salvador, Serbia, Poland, and among Russian- and Belarusian-speaking journalists and opposition figures living in European exile — evidence that the pattern of civilian targeting identified in 2021 continued rather than stopped.

The European Parliament's PEGA Inquiry

The 2021 revelations prompted the European Parliament to convene a dedicated Committee of Inquiry, known as PEGA, which ran fact-finding missions to Israel, Poland, Hungary, Greece, Cyprus, and Spain and heard from more than 200 witnesses. Its report, adopted by Parliament in June 2023, found that Hungary and Poland had used spyware in ways that violated EU law and dismantled independent oversight mechanisms — describing Hungary's use as part of "a calculated and strategic campaign to destroy media freedom" — while Greece and Cyprus served as hubs for spyware sales and use against journalists, politicians, and businesspeople. The committee recommended EU-wide standards restricting spyware to judicially authorised, exceptional use, and the creation of an independent EU forensic capability to investigate future abuses. The report passed by a vote of 30 to 3.

WhatsApp v. NSO Group: From Injunction to Jury Verdict

Meta's 2019 lawsuit reached trial in 2025. In December 2024, Judge Phyllis Hamilton of the US District Court for the Northern District of California ruled that NSO Group had violated the US Computer Fraud and Abuse Act and California's anti-hacking statute by using WhatsApp's servers to deliver Pegasus. In May 2025, a federal jury awarded WhatsApp $444,719 in compensatory damages and $167.3 million in punitive damages, and Hamilton issued a permanent injunction barring NSO from ever targeting WhatsApp again and ordering it to destroy any WhatsApp-related code in its possession. In October 2025, Hamilton reduced the punitive award to just over $4 million, applying the standard rule capping punitive damages at roughly nine times the compensatory award and concluding NSO's conduct did not rise to the most egregious tier that would justify a larger multiple — while leaving the underlying liability finding and the injunction untouched. NSO has appealed the rulings on liability, the injunction, and damages.

Apple's 2024 Withdrawal

Apple's own November 2021 suit did not reach trial. In September 2024, Apple voluntarily withdrew it, citing the risk that continued discovery could force disclosure of Apple's own threat-intelligence and anti-exploitation methods, and noting that the broader spyware market had fragmented since 2021 such that even a win over NSO specifically would leave rival vendors' comparable capabilities untouched. NSO Group did not oppose the dismissal.