Uncertainty about the nature of the list of 50K potential Pegasus targets created confusion and controversy, but doesn't negate the investigation's key findings
A series of blockbuster stories published this week around a leaked list of 50,000 phone numbers have created confusion …
Zero DayKim Zetter
Context & Ripple Effects
Earlier reporting connected the leak to potential targets in Mexico, while NSO's chief executive said the 50,000-plus-number list had no connection to the company. The present dispute is therefore about what the list can prove, not whether the investigation raised broader questions about Pegasus use.
Later forensic findings on French journalists' phones supplied a separate evidentiary track and prompted a referral to French prosecutors, reducing the investigation's dependence on how the leaked list is interpreted.
First-order effects
NSO gains a narrower public rebuttal focused on the list's provenance, while investigators must distinguish potential-target data from evidence of confirmed infection.
Second-order effects
French authorities can pursue the matter using device-level findings rather than the contested list, as shown by the malware evidence found on three journalists' phones and the subsequent prosecutorial referral.
Third-order effects
The pattern shifts scrutiny of commercial spyware away from any one leak and toward repeatable forensic investigations spanning vendors and jurisdictions, including the later Pegasus and Candiru targeting investigation.
The trend: Commercial-spyware accountability is increasingly being built on device forensics and cross-border investigations rather than leaked target lists alone.
Great analysis as always from @KimZetter. “[NSO's CEO] has said that NSO does not know who the targets of its customers are and does not have access to that information. He also asserts confidently that Khashoggi was never targeted with Pegasus.” https://zetter.substack.com/ ...
Clearest piece I've read yet on the recent NSO revelations & what the stories do & don't reveal, from the indefatigable @KimZetter https://zetter.substack.com/ ...
If you've found it hard to follow the details around the Pegasus Project, or don't have time to read the articles, I've compiled the salient points and what we know so far and don't - particularly about the list of 50,000 phone numbers. https://zetter.substack.com/ ...
@iblametom @KimZetter @lorenzofb The NSO “Surveillance List”: What It Is and Isn't. @KimZetter's unpacking on this topic is great. https://zetter.substack.com/ ...
I have a feeling we are starting to see a lot of misreporting on the Pegasus Project stories as they are getting aggregated and (poorly) re-reported by publications with no experience reporting and writing about government malware.
NEW - I spoke with Shalev Hulio, NSO's CEO. Some highlights: - If you're not a ‘bin Laden of the world,’ NSO tools won't hit you. - NSO won't know who customers target unless allegations of misuse are made and it investigates. Can then check targets. https://www.forbes.com/...
@lorenzofb They probably do, at least temporarily, but why would all the numbers from all the campaigns be in one place? Their billing doesn't work like that right? Their infra seems to be more distributed. Compartmentalization and low retention of sensitive campaign material see…
That being said, it is possible that the list is exactly what people are assuming it to be. I don't know what the list is, but if you read this old story from Joe and I you can imagine that, perhaps, NSO does log phone numbers somehow. https://www.vice.com/...
@nicoleperlroth The initial reporting on the targeting of, say, the Indians whose phones were not analysed by Amnesty was written in such a hedgy ‘potential’ fashion, it was as if the outlets' lawyers themselves deserved the byline.
This was not made clear by Amnesty or by any outlets who picked up the #PegasusProject The ambiguity and backtracking makes it so much harder for those of us who have spent years tracking NSO, its customers and their real victims. Speechless. https://twitter.com/...
In which @KimZetter details what we know and don't know about the #PegasusProject list with 50,000 phone numbers. Subscribe to her reporting while you're at it. https://zetter.substack.com/ ...
In this blog post — “The NSO “Surveillance List”: What It Is and Isn't” — @KimZetter has provided better context than most of the media organizations that have collaborated on this important story. https://zetter.substack.com/ ...
More than a decade later, the cybersecurity company that arose out of that fateful conversation is at the center of a global debate over the weaponization of powerful and largely unregulated surveillance technology. https://www.washingtonpost.com/ ...
Maybe they had done something wrong that they weren't aware of, Shalev Hulio and Omri Lavie recalled in interviews this week with The Washington Post. Instead, the officials made an unexpected request. https://www.washingtonpost.com/ ...
Two 20-something Israeli entrepreneurs who had been running a small customer service start-up for mobile phones were at a client meeting in Europe in 2009 when they received a visit from law enforcement officials. Their first instinct was fear. https://www.washingtonpost.com/ ...
Let me summarize: The CEO of NSO promises that a) You won't be targeted if you are not a terrorist and b) they don't actually know who is getting targeted. Not sure how both of those statements can be true. But maybe that's just me. https://twitter.com/...