Uncertainty about the nature of the list of 50K potential Pegasus targets created confusion and controversy, but doesn't negate the investigation's key findings
which used NSO tech to spy on dissidents— to expand surveillance into the UK.https://www.theguardian.com/ ... Lorenzo Franceschi-Bicchierai / @lorenzofb : NSO Group is now blaming Palestinian activists—and Qatar—for the series of stories published this week detailing alleged abuses of its technology all over the world. https://www.vice.com/... Kenneth Roth / @kenroth : The United Arab Emirates had already used Israeli NSO Group's spyware to target respected Emirati human rights activist Ahmed Mansoor (imprisoned a year later). NSO then allowed Dubai to use it, which it did to hack activists & dissidents living in exile. https://www.theguardian.com/ ... https://twitter.com/... @hahellyer : “I don't want to sound cynical now, but there are those who don't want [Israel] to import ice cream or export technologies.” — well, that's a truly impressive argument to deploy. How can no one be unconvinced? https://www.vice.com/... Hakan / @hatr : NSO is easily one of the most hated companies with information security folks I know for how its tech ended up targeting civil society. Not sure that trying to shift blame without a shred of evidence is going to do the trick. https://www.vice.com/... https://twitter.com/... @mairavz : NSO Group CEO holds either BDS or Qatar or both responsible for the “attack” in Israeli cyber security companies https://www.vice.com/... Lorenzo Franceschi-Bicchierai / @lorenzofb : NSO CEO also said said that “everyone just focuses on Israelis.” But researchers from Amnesty, Citizen Lab, as well as countless media outlets have covered competitors Hacking Team (🇮🇹), FinFisher (🇩🇪), Wolf Intelligence (🇮🇳) etc, for literally a decade. https://www.vice.com/... Eva / @evacide : NSO Group tries to pin the blame on investigations uncovering their complicity in human rights abuses on BDS. Recall that this was the gist of what they paid Black Cube to trick Citizen Lab's @jsrailton into saying. https://www.vice.com/... Catalin Cimpanu / @campuscodi : NSO coating itself in nationalistic b***s**t. This is not about them providing spyware to abhorrent regimes which have used it to kill innocent people. It's a Palestinian (or Qatar) conspiracy to ruin one of Israel's most successful businesses. [eyeroll] https://twitter.com/... @camillefrancois : As I'm working my way through the coverage, I found this @KimZetter explainer on what we know and don't know on the infamous list of 50 000 number really helpful: https://zetter.substack.com/ ... Michael Safi / @safimichael : NSO told human rights groups in 2019 it would do “whatever is necessary” to prevent abuse of its tools. Soon after, it hatched a deal to allow Dubai to use Pegasus to spy on UK citizens https://www.theguardian.com/ ... the story of NSO by the reporter who knows it best @skirchy Nadim Kobeissi / @kaepora : Journalists are still falsely reporting that there is proof that malware activity found on journalist phones can be attributed to Pegasus/NSO. While there is good evidence for *some* malware, there is no strong evidence to allow attribution to a *particular* actor or malware. https://twitter.com/... Tejas Harad / @h_tejas : “There are three jurisdictions you don't fuck with: the US, Israel and the Russians.” https://www.theguardian.com/ ... Poppy McPherson / @poppymcp : ‘Being a client of NSO, said one person who previously served as a broker in the industry, was a bit like gun ownership in the US. “You are supposed to use a gun to protect yourself, but who is to stop you from robbing a bank?” they said.’ https://www.theguardian.com/ ... David Carroll / @profcarroll : Something that probably shouldn't be a business model: competing with NSA and GHCQ as a wholesaler service retailed by re-sellers, all floated by private equity #PegasusProject https://www.theguardian.com/ ... by @skirchy Aakar Patel / @aakar__patel : “In an exchange of public letters in 2019, they told Amnesty International and others they would do “whatever is necessary” to ensure NSO's weapons-grade software would only be used to fight crime and terrorism. But the claim, it now appears, was hollow.” https://www.theguardian.com/ ... Kenn White / @kennwhite : Great analysis as always from @KimZetter. “[NSO's CEO] has said that NSO does not know who the targets of its customers are and does not have access to that information. He also asserts confidently that Khashoggi was never targeted with Pegasus.” https://zetter.substack.com/ ... Kate O'Flaherty / @kateoflaherty : Great article by @KimZetter breaking down the facts and detailing how Pegasus could have been used https://zetter.substack.com/ ... Ryan Gallagher / @rj_gallagher : Clearest piece I've read yet on the recent NSO revelations & what the stories do & don't reveal, from the indefatigable @KimZetter https://zetter.substack.com/ ... Dr. Siva Vaidhyanathan / @sivavaid : This whole thing is totally messing with my “Privacy and Surveillance” syllabus. https://twitter.com/... Matthew Green / @matthew_d_green : I love that *this* is where NSO draws the line. https://www.nsogroup.com/... Zach Dorfman / @zachsdorfman : Great analysis from @KimZetter on what we know, and don't, about the NSO surveillance list. https://zetter.substack.com/ ... Dan Goodin / @dangoodin001 : @iblametom @KimZetter @lorenzofb The NSO “Surveillance List”: What It Is and Isn't. @KimZetter's unpacking on this topic is great. https://zetter.substack.com/ ... Kim Zetter / @kimzetter : If you've found it hard to follow the details around the Pegasus Project, or don't have time to read the articles, I've compiled the salient points and what we know so far and don't - particularly about the list of 50,000 phone numbers. https://zetter.substack.com/ ... Runa Sandvik / @runasand : In which @KimZetter details what we know and don't know about the #PegasusProject list with 50,000 phone numbers. Subscribe to her reporting while you're at it. https://zetter.substack.com/ ... Dan Gillmor / @dangillmor : In this blog post — “The NSO “Surveillance List”: What It Is and Isn't” — @KimZetter has provided better context than most of the media organizations that have collaborated on this important story. https://zetter.substack.com/ ... @washingtonpost : More than a decade later, the cybersecurity company that arose out of that fateful conversation is at the center of a global debate over the weaponization of powerful and largely unregulated surveillance technology. https://www.washingtonpost.com/ ... @washingtonpost : Maybe they had done something wrong that they weren't aware of, Shalev Hulio and Omri Lavie recalled in interviews this week with The Washington Post. Instead, the officials made an unexpected request. https://www.washingtonpost.com/ ... @washingtonpost : Two 20-something Israeli entrepreneurs who had been running a small customer service start-up for mobile phones were at a client meeting in Europe in 2009 when they received a visit from law enforcement officials. Their first instinct was fear. https://www.washingtonpost.com/ ... Andreas Proschofsky / @suka_hiroaki : Let me summarize: The CEO of NSO promises that a) You won't be targeted if you are not a terrorist and b) they don't actually know who is getting targeted. Not sure how both of those statements can be true. But maybe that's just me. https://twitter.com/...
Context & Ripple Effects
Early Pegasus coverage combined a broad leak that included Mexican politicians, reporters, activists, and people close to the president with NSO's insistence that the 50,000-number list was unrelated to it. The dispute matters because a potential-target list and evidence of an actual device compromise answer different questions about surveillance abuse.
Subsequent reporting supplied the more concrete evidentiary layer: French authorities found Pegasus on three journalists' phones and referred the matter to prosecutors, while later research documented targeting in Spain. That progression makes the list debate consequential without making it the investigation's sole basis.
First-order effects
- NSO Group can point to uncertainty around the list to contest how individual numbers are characterized, while the investigation's documented allegations of spying on dissidents remain separate from that dispute.
- Journalists, researchers, and alleged targets must distinguish potential selection for surveillance from forensic confirmation that spyware reached a phone.
Second-order effects
- Independent device forensics gain importance as the evidence that can corroborate or narrow claims drawn from leaked target data, as illustrated by the French examination of journalists' phones.
- Government inquiries and public scrutiny of NSO's customers are likely to focus more tightly on verified compromises and attribution than on the leaked list alone.
Third-order effects
- If this evidence pattern persists, commercial-spyware accountability will increasingly rest on a chain of forensic findings, independent research, and official investigations rather than vendors' statements about customer targeting.
- The later Catalan targeting investigation involving Pegasus and Candiru points to scrutiny broadening from one vendor or leak into a recurring governance problem for intrusive surveillance tools.
The trend: Commercial-spyware scrutiny is shifting from contested leaked datasets toward independently verified device compromises and the investigations they trigger.