The reports from the Guardian, the Washington Post, and 15 other media organizations, are based on a leak of tens of thousands of phone numbers that appear to have been targeted by Pegasus. While the numbers on the list don’t necessarily mean that devices associated with that number were infected with the spyware, the outlets were able to use the data to establish that journalists and activists in many countries were targeted —– and in some cases, successfully hacked — by the spyware.
The leaks, indicate the scope of what cybersecurity reporters and experts have said for years: that while the NSO Group claims its spyware is designed to target criminals and terrorists, its actual applications are much more broad. (The company released a statement in response to the investigation, denying that its data was leaked, and that any of resulting reporting was true).
My colleague Patrick Howell O’Neill has been reporting for some time on claims against the NSO Group, which “has been linked to cases including the murder of Saudi journalist Jamal Khashoggi, the targeting of scientists and campaigners pushing for political reform in Mexico, and Spanish government surveillance of Catalan separatist politicians,” he wrote in August 2020. In the past, NSO has denied these accusations, but also more broadly argued that it can’t be held responsible if governments misuse the technology it sells to them.
The company’s central argument, we wrote at the time, is one “that is common among weapons manufacturers: the company is the creator of a technology that governments use, but it doesn’t attack anyone itself, so it can’t be held responsible.”