NSO CEO claims leaked list of 50K+ phone numbers potentially targeted with NSO spyware has “nothing to do with us” and had first heard about the list last month
CTech
Context & Ripple Effects
The denial lands mid-firestorm. Days after the leaked list surfaced, Zero Day's reporting stressed that uncertainty about what the 50K-number list actually represents doesn't undo the investigation's core findings — and the CEO's 'nothing to do with us' framing leans heavily on that ambiguity. The company has been here before: Blackstone walked away from a stake in NSO back in 2017, and researchers later documented how [[a:961578|Pegasus-derived tooling swept up thousands of bystanders' location data during the COVID tracing pitch]], so the denial arrives against an established pattern of contested accountability rather than a clean record.
NSO is now defending against two fronts at once: the leaked-list narrative it disavows, and the confirmed Israeli government probe into Pegasus abuse allegations that followed within days.
The denial shifts the evidentiary burden onto journalists and investigators, but Zero Day's position that the list's ambiguity doesn't negate key findings means the rebuttal doesn't close the story.
Second-order effects
Institutional investors have already priced in this risk profile — Blackstone's abandoned stake talks in 2017 set the template for capital retreating when reputational exposure surfaces.
Government customers face their own exposure: with officials now investigating inside Israel, client states using Pegasus must weigh whether continued purchases carry diplomatic and legal blowback.
Third-order effects
If the pattern holds — leak, denial, then a home-government investigation — commercial spyware firms drift toward a structure where export approval and domestic oversight by the selling state become the real control points, not vendor self-policing or press disclosure.
The trend: Commercial spyware is being forced from private-sector deniability toward state-supervised accountability, with the seller's home government becoming the decisive gatekeeper.
NSO issued a statement today, saying two things: 1) Pegasus wasn't involved in Jamal Khashoggi's murder, and 2) it doesn't have visibility into what customers do or who they target with Pegasus. These two statement seem to be in conflict. Statement here: https://www.nsogroup.com/…
„Hulio claimed that over the past 11 years, the company sold its services to 45 countries, and rejected some 90 countries that offered to pay for the software it sells" - If this is true, then at least 135 countries wanted to buy #Pegasus 👁 | #NSO https://www.timesofisrael.com/ .…
NSO CEO exclusively responds to allegations: “The list of 50,000 phone numbers has nothing to do with us.” “I'll give you a simple statement: Journalists, human rights activists, and civil organizations are all off-limits.” - Shalev Hulio. #PegasusProject https://www.calcalistech…
@Techmeme 3/bonus) Regarding the “list”: Amnesty said 34 iPhones were forensically checked. 23 successfully had malware (specifically Pegasus) installed on them. the other 11 saw attempts at malware infection. That's a 100% hit rate on their sampling of the “list”. https://www.wa…
Hmm. NSO CEO says he heard about list of phone #s last month. “an information broker...said that there is a list circulating in the market and that whoever holds it is saying that the NSO servers in Cyprus were hacked... We don't have servers in Cyprus” https://www.calcalistech.c…
@Techmeme 1/2) his claim that the list has “nothing” to do with us is almost certainly false. There is near certainty that there is overlap with people on that list and people that got Pegasus spyware. What does seem probable is that the list is not completely overlapping with NS…
Fully agree with @Snowden on this one. No “better vetting” or “deeper investigation”, just a total ban on all kinds of spyware and companies making it. And put all those people working at NSO on trial for the crimes committed with their tools. https://www.theguardian.com/ ...
NSO's claim that it is “technologically impossible” to spy on American phone numbers is a bald-faced lie: a exploit that works against Macron's iPhone will work the same on Biden's iPhone. Any code written to prohibit targeting a country can also be unwritten. It's a fig leaf. ht…