# Pegasus Spyware ## BLUF **Pegasus** is a commercial-grade mobile device surveillance tool developed by Israel's NSO Group and sold exclusively to sovereign state customers. It represents the most analytically significant case of **commercial surveillance capability proliferation**: for the first time in history, state-of-the-art signals intelligence capability — comparable in some respects to NSA TAO tools — is available to any government willing to pay. The documented deployment of Pegasus against journalists, human rights defenders, opposition politicians, and foreign heads of state (including Emmanuel Macron, Jamal Khashoggi's associates, and Felipe Calderón's cabinet) has made Pegasus the defining case study of the civil liberties, geopolitical, and accountability crises produced by the commercialization of offensive cyber capabilities. --- ## Technical Capabilities Pegasus is a **mobile device implant** — malware that, once installed on a target's iPhone or Android device, provides the operator with near-total access to the device's contents and functions. ### Capabilities once installed - **Full device content access:** Messages (including E2E-encrypted apps like WhatsApp, Signal, Telegram — captured at endpoint, before encryption), photos, videos, documents, contacts, browsing history - **Real-time surveillance:** Microphone activation, camera activation, location tracking - **Credentials capture:** Passwords, cryptographic keys, multi-factor authentication codes - **Persistent access:** Survives most reboots; updates remotely to defeat patches - **Covert operation:** Designed to avoid detection by users and most commercial security tools ### Delivery mechanisms Early Pegasus versions required one-click delivery — the target had to click a link. Subsequent versions evolved to **zero-click exploits**: - **ForcedEntry (CVE-2021-30860):** Exploit in Apple's CoreGraphics framework that could install Pegasus via a malicious iMessage the target did not need to open or even see - **Successive iMessage and WhatsApp exploits:** NSO Group has demonstrated persistent capability to develop new zero-click vectors as old ones are patched The zero-click capability is the strategic threshold: a target who takes no action — no clicking, no opening — can still be compromised through a message their device processes automatically. --- ## NSO Group: The Operating Model NSO Group is an Israeli company headquartered in Herzliya, founded in 2010. Its operating model defines the commercial offensive cyber industry: - **Government-only customer model:** Publicly, NSO sells only to sovereign state customers (law enforcement and intelligence agencies). No commercial customers. - **Export control dependency:** Pegasus sales are regulated as arms exports by the Israeli Ministry of Defense. Export authorization is a diplomatic instrument as much as a commercial one. - **Licensed deployment model:** Customers receive operator access but do not receive source code or underlying exploits. NSO controls the technical capability; customers control the targeting. - **Plausible deniability architecture:** NSO maintains that it cannot audit customer targeting; the customer agreement prohibits targeting journalists, civil society, and human rights defenders, but enforcement mechanisms are limited. **Financial position (2024):** Under significant financial pressure following US sanctions (2021 Entity List designation); repeated rounds of restructuring; ongoing litigation from Apple, WhatsApp/Meta, and multiple civil society organizations. --- ## Documented Deployments The **Pegasus Project** (2021) — an international journalistic consortium led by Forbidden Stories with forensic support from Amnesty International's Security Lab — published evidence of Pegasus targeting against: ### Heads of State and Senior Officials - **French President Emmanuel Macron** — phone number on the Pegasus target list - **Pakistani Prime Minister Imran Khan** — targeting attributed to Indian government - **Mexican President Felipe Calderón** — during his presidential term, attributed to Mexican security services - **King Mohammed VI of Morocco** — attributed to Moroccan government self-surveillance - **Multiple European and Latin American presidents, ministers, and ambassadors** ### Journalists - **Jamal Khashoggi's associates:** His fiancée Hatice Cengiz and Saudi dissident friends were targeted, suggesting Saudi intelligence built its operational intelligence on him via Pegasus before his October 2018 murder in the Saudi consulate in Istanbul - **Multiple Al Jazeera journalists** — extensive targeting attributed to Saudi Arabia and UAE - **Investigative journalists in Mexico, India, Hungary, Azerbaijan, Rwanda, Morocco** ### Civil Society - Human rights defenders, opposition politicians, lawyers, and activists across dozens of countries - Apple sent notifications to "state-sponsored attack" targets in 150+ countries starting 2021 --- ## Strategic Significance ### The Proliferation Crisis Pegasus represents the most extreme case of **commercial offensive cyber capability proliferation**: capabilities that were previously monopoly assets of a handful of advanced state intelligence services (NSA, GCHQ, Mossad, MSS, FSB) are now available for purchase by any government with the budget. **Strategic implications:** - Small and mid-size states can acquire top-tier SIGINT capability without building domestic capacity - The capability gap between major powers and emerging authoritarian states has closed dramatically in this specific domain - Traditional arms-control frameworks do not yet address commercial offensive cyber as a category ### The Accountability Problem Commercial offensive cyber creates novel accountability gaps: - The technical capability is produced by a commercial company, not a state intelligence service, evading intelligence-community oversight frameworks - The targeting is done by the customer state, not the company, diffusing responsibility across jurisdictions - Victims are frequently citizens of different countries than the attacking state, complicating legal recourse - The exploits themselves are often zero-days that affect billions of users globally — the commercial capability creates externalities that harm everyone whose devices share the vulnerabilities ### The Israeli Foreign Policy Instrument Israel's export control over NSO transforms Pegasus into a diplomatic instrument: - Saudi Arabia, UAE, Bahrain gained or expanded Pegasus access during the Abraham Accords period (2020–) — suggesting quid pro quo elements in normalization - Hungary, Poland reported to have gained Pegasus access during periods of diplomatic alignment with Israel - India-Israel relationship deepened alongside Pegasus availability to Indian services Pegasus is not just a commercial product; it is a component of Israeli soft/hard power projection. --- ## Regulatory and Legal Response **US (Biden administration, 2021):** NSO Group placed on Commerce Department Entity List, restricting NSO's access to US technology. This significantly damaged NSO's commercial position. **Apple (2021–present):** Filed lawsuit against NSO Group; developed Lockdown Mode as an iOS hardening option specifically designed to reduce Pegasus attack surface; maintains ongoing forensic investigation. **WhatsApp / Meta (2019–present):** Filed lawsuit against NSO Group for exploits targeting WhatsApp users; achieved partial legal victories. **Civil society:** Access Now, Citizen Lab, Amnesty Security Lab maintain ongoing forensic monitoring. **EU:** European Parliament PEGA committee investigation (2022–2023) documented Pegasus use against EU citizens, including by EU member state governments (notably Hungary and Poland). --- ## Defensive Measures For journalists, civil society, and at-risk targets: - **iOS Lockdown Mode:** Apple's hardening mode that disables specific attack surfaces (attachment processing, complex web content) - **Operational security discipline:** Compartmentalize devices; separate sensitive and routine communications; use hardened devices for high-sensitivity contact; assume mobile devices are compromised in high-threat contexts - **Forensic monitoring:** Regular MVT (Mobile Verification Toolkit) scans; Citizen Lab and Amnesty Security Lab offer forensic assessment - **Platform choice:** Different endpoints offer different attack surface profiles; iOS devices may offer better defensive posture than older Android devices due to Apple's update cadence None of these measures provide absolute protection against zero-day capability. The operational reality is that high-value targets should assume their mobile communications can be compromised by state adversaries. --- ## Key Connections - [[01 Actors & Entities/11_State_Actors/Israel]] — state producer and exporter - [[01 Actors & Entities/11_State_Actors/Saudi Arabia]] — documented operator; Khashoggi context - [[02 Concepts & Tactics/Signals Intelligence]] — the doctrinal category Pegasus extends commercially - [[02 Concepts & Tactics/Cyber Warfare]] — the broader domain - [[02 Concepts & Tactics/Mass Surveillance]] — the surveillance framework Pegasus enables - [[02 Concepts & Tactics/Cognitive Warfare and Algorithmic Disinformation]] — post-collection use case for information advantage - [[07 Current Investigations/Open Leads/Google, Microsoft_ Gaza Abuse Report_]] — parallel case of commercial infrastructure enabling state surveillance