Report details the use of telecom snooping tools provided by Circles, an NSO Group affiliate, by 25 nations, some of which have a history of human rights abuses
Did These 25 Countries Buy It? Tweets: Stphane Duguin / @duguinstephane : Reports after reports, the work of @citizenlab is not only revealing the reality of state sponsored intrusions at scale. It builds a legacy for all of us to rethink accountability. https://citizenlab.ca/... cc @RonDeibert @CyberpeaceInst @saharawivoice : NEW: Morocco is among the clients of the cyberespionage firm Circles, which reportedly exploits weaknesses in the global mobile phone system to snoop on calls, texts, and the location of phones around the globe. Circles is affiliated with NSO Group, which develops Pegasus spyware https://twitter.com/... Lorenzo / @lorenzofb : NEW: Researchers say they found evidence that 25 countries (Denmark, Belgium, Australia, Mexico, Thailand...) have deployed cellphone tracking technology made by Circles. Circles has merged with spyware vendor NSO and provides SS7 tracking technology. https://www.vice.com/... @vice : “You can track any phone number from any country and anywhere in the world.” https://www.vice.com/... Asaf Lubin / @asaflubin : The tireless work that @citizenlab does in uncovering corporate and government surveillance is simply astonishing. Yet another amazing report from an organization that deserves a lot more global acclaim (if not a Nobel Peace Prize). https://twitter.com/... Raphael Satter / @razhael : Another one of Citizen Lab's clever web scans has uncovered suspected installations of Israeli surveillance firm Circles' phone snopping tools around the world, including several European countries - Belgium, Denmark, and Estonia - as well as Australia. https://citizenlab.ca/... Catalin Cimpanu / @campuscodi : New Citizen Lab report on Circles, a company that provides SS7 hacking capabilities https://citizenlab.ca/... https://twitter.com/...
Context & Ripple Effects
The Citizen Lab's Circles report extends a paper trail it has been building around Israel's mercenary spyware sector. Earlier reporting detailed NSO Group's sales in Gulf states worth hundreds of millions of dollars for Pegasus; this report shows the same vendor ecosystem also sells network-level interception, with Circles exploiting weaknesses in the global SS7 signaling system rather than implanting malware on devices.
The significance is scope and deniability: 25 suspected client states, Morocco named among them, some with documented human rights abuse records. Because Circles rides telecom infrastructure itself, the targeting surface is every phone on a network — a different threat model from the device hacks later documented by Citizen Lab and Microsoft in their exposé of rival QuaDream's iOS spyware.
First-order effects
- Governments identified as Circles clients, including Morocco, now face public attribution for intercepting calls, texts, and locations at network level — evidence that can feed prosecutions like the French referral after Pegasus was confirmed on three French journalists' phones.
- Telecom operators worldwide are directly affected: their SS7 signaling infrastructure, designed for inter-carrier routing, is being repurposed as a surveillance channel they did not consent to.
Second-order effects
- The affiliation with NSO Group means reputational and legal exposure compounds across both brands, pressuring Israeli export regulators while rivals like QuaDream compete for the same government clients in an increasingly scrutinized market.
- Mobile carriers and standards bodies face forced investment in SS7 hardening and filtering, since the exploit targets a protocol weakness no single subscriber can patch.
Third-order effects
- If the pattern holds, interception becomes a procurement category: states buy surveillance capability off the shelf from a small Tel Aviv-centered vendor cluster, shifting the bottleneck from technical skill to export licenses and diplomatic cover.
- Sustained Citizen Lab-style attribution builds the evidentiary base for structural responses — export controls, litigation, and carrier-side protocol reform — aimed at an industry that currently operates between national regulatory regimes.
The trend: Commercial spyware is expanding from device-level implants like Pegasus into network-level interception sold as a service, with independent research labs serving as the de facto accountability mechanism.