NSO Group, an Israeli cybersecurity firm, develops and sells Pegasus, sophisticated mobile spyware marketed as a “lawful intercept” tool for governments to combat terrorism, organized crime, and other serious threats. In practice, forensic investigations by groups such as Citizen Lab, Amnesty International’s Security Lab, and the 2021 Pegasus Project (a collaboration led by Forbidden Stories) have repeatedly linked Pegasus deployments to the surveillance of journalists, human rights defenders, lawyers, opposition politicians, and even foreign officials.
Recent developments in Poland illustrate the risks. Prime Minister Donald Tusk has described the previous government’s purchase and use of Pegasus as a “crime against the state.” Investigations by Polish authorities found that NSO Group retained technical access to parts of the system, that harvested data traveled outside Poland via manufacturer-managed infrastructure, and that the Central Anti-Corruption Bureau did not fully control administrator credentials. Targets included opposition figures during election campaigns.
How Pegasus Works
Pegasus can be delivered via one-click phishing links or, in more advanced versions, zero-click exploits (no user interaction required). Once installed, it can access messages, calls, contacts, photos, location data, microphones, and cameras, and it can extract data even from encrypted apps. NSO sells it only to government customers, with Israeli export controls, and claims licensing restrictions on targets and countries. The company states it does not operate the systems itself or access customer data, though the Polish findings and court cases have challenged aspects of that claim.
Documented Deployments and Abuses by Country
Citizen Lab’s 2018 “Hide and Seek” report identified suspected Pegasus operations associated with operators in roughly 45 countries, including Algeria, Bahrain, Bangladesh, Brazil, Egypt, France, India, Iraq, Israel, Jordan, Kazakhstan, Kenya, Kuwait, Lebanon, Libya, Mexico, Morocco, Oman, Pakistan, Palestine, Poland, Qatar, Rwanda, Saudi Arabia, Thailand, Togo, Tunisia, Turkey, the UAE, Uganda, Uzbekistan, Yemen, and Zambia (among others). At least some operators conducted cross-border surveillance. Not every country on the list was necessarily a direct customer; some infections could stem from third-party operators.
The 2021 Pegasus Project analyzed a leak of more than 50,000 phone numbers selected for potential targeting. While NSO has disputed that the list represented actual Pegasus targets, forensic work confirmed infections in many cases. Potential clients identified through clustering included Azerbaijan, Bahrain, Hungary, India, Kazakhstan, Mexico, Morocco, Rwanda, Saudi Arabia, Togo, and the UAE. Hundreds of journalists, activists, lawyers, and politicians appeared. At least 188 journalists across roughly two dozen countries were selected.
Key documented cases include:
Mexico**: One of the earliest and largest scandals. Citizen Lab and partners documented targeting of dozens of journalists, lawyers, human rights defenders, opposition politicians, and anti-corruption advocates around 2016. Multiple operators were linked to the country. Mexican journalists and others continued to appear in later investigations. Mexico accounted for the highest number of victims in one WhatsApp-related dataset (hundreds of targets).
Saudi Arabia*: Linked to targeting of associates of murdered *Washington Post columnist Jamal Khashoggi, including his fiancée Hatice Cengiz shortly after the 2018 killing. The system was used against dissidents and critics. NSO has stated its technology was not associated with the murder itself.
United Arab Emirates**: Used against human rights activists, local figures, and members of the ruling family or related individuals. One of the most extensive deployments by volume in some analyses.
Morocco**: Amnesty International and others have attributed sustained campaigns against civil society, journalists, lawyers, Western Sahara activists, and people abroad to Morocco’s DGST intelligence service. A recent Amnesty report links the same infrastructure to infections of Spanish officials, including Defence Minister Margarita Robles and Interior Minister Fernando Grande-Marlaska, as well as French-based activists and journalists. Targeting of civil society was evident from early in Morocco’s reported use of the system (around 2017).
India*: Opposition politicians (including figures linked to Rahul Gandhi’s circle), journalists (including from *The Wire), and activists were selected or infected. India ranked high in WhatsApp victim counts in related court documents. The government has denied misuse.
Poland**: Under the prior Law and Justice (PiS) government, Pegasus was purchased and used against opposition politicians, prosecutors, and others, including during election periods. Amnesty confirmed infections of figures such as senator Krzysztof Brejza. The current government has highlighted retained manufacturer access and data leaving the country.
Spain**: Catalan politicians and civil society figures were targeted (2019 reports). Spanish cabinet ministers’ phones were later compromised, with Amnesty attributing the attacks on Robles and Grande-Marlaska to Moroccan operators. President Pedro Sánchez’s phone was also reported infected around the time of a migration crisis involving Morocco.
Hungary**: Used against opposition journalists, critics, and political figures. Investigative journalists had phones confirmed infected.
Other countries*: Bahrain, Kazakhstan, Rwanda, Azerbaijan, El Salvador (journalists at *El Faro), Thailand (pro-democracy activists and academics), and Israel itself (reports of police use against citizens). Cross-border cases involved targeting of people in France, the UK, the US, and elsewhere. WhatsApp court documents listed high victim numbers in Mexico, India, Bahrain, Morocco, Pakistan, Indonesia, and others.
Legal and Regulatory Consequences
In 2019, WhatsApp (Meta) sued NSO over the exploitation of a vulnerability to deliver Pegasus to roughly 1,400 users, many of them civil society members. A U.S. court found NSO liable for violations of the Computer Fraud and Abuse Act and other claims; damages proceedings followed, with an injunction barring certain targeting of WhatsApp. Apple also sued. NSO has been sued by journalists and others in various jurisdictions (with mixed procedural outcomes).
In November 2021, the U.S. Commerce Department added NSO Group (and Candiru) to its Entity List, restricting access to U.S. technology. The determination cited evidence that the companies supplied spyware used by foreign governments to maliciously target government officials, journalists, activists, academics, and embassy workers.
NSO’s Position
NSO maintains that Pegasus is sold only to vetted government agencies for legitimate law enforcement and national security purposes, that it has compliance and human rights programs, and that it investigates misuse and has terminated customers when warranted. It has denied operating systems or accessing target data, disputed the interpretation of leaked numbers in the Pegasus Project, and argued that many allegations lack corroboration or are technically impossible under its controls. The company has published transparency reports and noted that some governments use the tool successfully against serious crime. It has also stated that certain high-profile claims (e.g., involving specific world leaders) were false.
Critics, including researchers and human rights groups, argue that the scale of documented abuse against non-criminal targets, the difficulty of independent verification, and cases of retained manufacturer access demonstrate inadequate safeguards. The proliferation of such tools raises questions about sovereignty (data and system control leaving a purchasing country), privacy, and the risks of selling powerful zero-click capabilities to governments with poor human rights records.
The Poland revelations add a concrete example of the practical risks when a purchasing government does not fully control the infrastructure. Multiple independent forensic investigations across years and countries have established a pattern of Pegasus being deployed far beyond its stated anti-terror and anti-crime purposes.
