Pegasus Spyware

//The Mainstream Narrative

Pegasus spyware, developed by Israeli cyber-intelligence company NSO Group, represents one of the world's most sophisticated commercial surveillance tools. First documented in 2016 by researchers at Citizen Lab and Lookout, Pegasus can remotely exploit vulnerabilities in iOS and Android devices to extract messages, emails, photos, location data, and activate cameras and microphones without any user interaction—so-called "zero-click" attacks. NSO Group maintains that Pegasus is sold exclusively to vetted government intelligence and law enforcement agencies for legitimate purposes such as counterterrorism and combating serious crime, subject to Israeli export licensing. The company insists it has no access to the data collected by its clients and operates within a legal framework. Major exposés, particularly the 2021 Pegasus Project—a collaborative investigation by seventeen media organizations coordinated by Forbidden Stories and Amnesty International—revealed that a leaked list of over 50,000 phone numbers included journalists, human rights activists, business executives, and political figures. Confirmed infections were found on the devices of journalists from The Washington Post, Financial Times, CNN, and The New York Times, among others, as well as associates of murdered Saudi journalist Jamal Khashoggi. Governments in Saudi Arabia, the UAE, Morocco, Hungary, India, Mexico, and Rwanda have been implicated as Pegasus clients.

//Under-Reported Dimensions

While the surveillance of high-profile journalists received substantial coverage, the systematic targeting of civil society in specific countries has been less examined. In Mexico, at least fifteen journalists and activists were confirmed infected between 2015 and 2017, according to Citizen Lab research, during a period when the Mexican government publicly denied purchasing spyware. The spyware was deployed against scientists and health advocates opposing a soda tax, revealing surveillance beyond traditional security justifications. In India, forensic analysis by Amnesty International's Security Lab confirmed infections on phones belonging to prominent opposition figures, constitutional lawyers, and Supreme Court staff during politically sensitive periods. The Israeli government's role as export licensor creates a strategic dimension: NSO Group cannot sell Pegasus without Ministry of Defense approval, making surveillance sales instruments of Israeli foreign policy. Documents obtained by The New York Times in 2022 revealed that NSO offered the Pegasus system to the FBI in 2019 and that U.S. agents tested it, though the agency ultimately declined deployment. The European Parliament established a Committee of Inquiry (PEGA) in 2022 after revelations that Pegasus had been used within EU member states to target politicians, journalists, and lawyers, raising questions about rule-of-law adherence in democratic contexts.

//Credible Dissenting Voices

Ron Deibert, director of the Citizen Lab at the University of Toronto's Munk School, has consistently argued that NSO's claimed safeguards are ineffective and that the company enables human rights abuses by design. In testimony before the European Parliament, Deibert stated, "There is no evidence that NSO Group's governance mechanisms prevent abuse; in fact, the evidence shows systematic misuse across multiple jurisdictions." Agnes Callamard, former UN Special Rapporteur on extrajudicial executions (now Secretary General of Amnesty International), documented that Pegasus was used to target close associates of Jamal Khashoggi both before and after his murder, calling for a moratorium on surveillance technology sales until human rights safeguards are established. Natalie Bannerman, a former NSO Group employee who worked in governance and compliance, became a whistleblower in 2021, revealing to The Guardian that internal concerns about client misuse were routinely dismissed and that the company prioritized revenue over human rights due diligence. John Scott-Railton, senior researcher at Citizen Lab, has identified "mercenary spyware" as a distinct threat category requiring international regulatory frameworks, arguing that commercial spyware has fundamentally altered the power dynamics between states and civil society.

//Follow the Money

NSO Group was acquired by U.S. private equity firm Francisco Partners in 2014 for approximately $120 million and again in 2019 by Francisco Partners alongside Novalpina Capital in a leveraged buyout valuing the company at $1 billion. The business model depends on lucrative government contracts: licenses reportedly cost between $8-10 million for basic capabilities and up to $50 million for comprehensive systems. Each phone target adds approximately $650,000-800,000 to the contract. NSO's reported annual revenue peaked near $250 million. Following the 2021 Pegasus Project revelations, the U.S. Commerce Department placed NSO Group on the Entity List in November 2021, restricting access to American technology. Apple filed a lawsuit against NSO in November 2021 seeking a permanent injunction and damages. By 2022, NSO faced financial distress, laying off employees and struggling with debt obligations. The Israeli government reportedly explored taking greater control of the technology to preserve strategic capabilities while containing reputational damage. Meta (Facebook/WhatsApp) had already sued NSO in 2019 for exploiting a WhatsApp vulnerability to infect 1,400 devices. Intelligence agencies worldwide benefited from capabilities previously requiring significant internal development resources, effectively outsourcing sophisticated surveillance infrastructure. Client governments gained technological leverage over opposition movements, independent media, and civil society organizations, with political benefits including early warning of dissent and intimidation effects.

//Open Questions

How many total individuals have been surveilled using Pegasus, and what is the complete list of government clients across NSO Group's operational history? What specific oversight mechanisms did the Israeli Ministry of Defense employ when approving export licenses, and were human rights assessments genuinely conducted or pro forma? To what extent did intelligence-sharing partnerships (Five Eyes, other frameworks) facilitate indirect access to Pegasus-derived intelligence by governments that did not directly purchase the system? What technical assistance, if any, did NSO Group provide to clients in targeting specific individuals, and does this constitute active participation in surveillance operations? Have any NSO Group employees or executives faced criminal investigation or prosecution in Israel or other jurisdictions for facilitating human rights abuses? What became of the Pegasus source code and technical capabilities following NSO's financial difficulties—has the technology proliferated to additional state or non-state actors? How many vulnerabilities (zero-days) did NSO Group discover, purchase, or exploit, and were any reported to device manufacturers under responsible disclosure frameworks? What international legal framework, if any, can effectively regulate the mercenary spyware industry while balancing legitimate law enforcement needs?