Pegasus spyware, created by the Israeli cyber-intelligence firm NSO Group, has become one of the most infamous surveillance technologies in the world. Marketed as a weapon against terrorism and organised crime, Pegasus has instead become a symbol of the dangers posed by unchecked digital surveillance. Its ability to silently and comprehensively infiltrate smartphones has sparked global debates about privacy, human rights, and the future of democracy.
Origins and Development
NSO Group was founded in 2010, and by 2011, it had developed Pegasus. The company claimed the spyware was designed exclusively for government agencies, with sales requiring approval from Israel’s Ministry of Defence. NSO argued that Pegasus was a legitimate tool for law enforcement to track criminals and terrorists.
However, investigations have shown that Pegasus has been deployed far beyond its intended scope. Instead of focusing solely on criminal networks, it has been used against journalists, activists, lawyers, and political opponents, raising serious ethical and legal concerns.
How Pegasus Works
Pegasus is notorious for its “zero-click” exploits. Unlike traditional malware, which requires a victim to click a malicious link, Pegasus can infiltrate a device via vulnerabilities in apps such as iMessage or WhatsApp without any user interaction.
Once inside, Pegasus provides near-total access to the device:
- Messages and emails: It can read private communications.
- Calls: It can monitor and record conversations.
- Passwords: It can harvest login credentials.
- Location data: It tracks movements in real time.
- Microphone and camera: It can turn the phone into a surveillance device.
- Encrypted apps: Pegasus doesn’t break encryption itself but captures data before it is encrypted or after it is decrypted, effectively bypassing secure messaging platforms like Signal and WhatsApp.
This ability to compromise even “secure” apps makes Pegasus one of the most advanced spyware systems ever discovered.
Discovery and Early Investigations
Pegasus first came to public attention in 2016 when Emirati activist Ahmed Mansoor received a suspicious text message offering “secrets” about torture in UAE prisons. Instead of clicking the link, Mansoor forwarded it to Citizen Lab, a Canadian research group. Their investigation revealed Pegasus was exploiting three previously unknown iOS vulnerabilities—later dubbed “Trident”—that would have allowed remote jailbreaking of iPhones.
This discovery marked the beginning of a series of investigations by Citizen Lab, Amnesty International, and other watchdogs, which exposed Pegasus’s widespread misuse.
The Pegasus Project
In July 2021, a global consortium of journalists launched the Pegasus Project, based on a leaked list of 50,000 phone numbers allegedly selected for targeting by Pegasus customers.
The investigation revealed that Pegasus had been used against:
- Heads of state, including presidents and prime ministers.
- Journalists from outlets such as The Guardian, Le Monde, and The Washington Post.
- Human rights defenders working in repressive regimes.
- Lawyers and opposition figures in democratic countries.
While not all numbers represented confirmed infections, the scale of potential targeting highlighted the global reach of Pegasus.
High-Profile Cases
Pegasus has been linked to several major incidents:
- Jamal Khashoggi: Reports suggest Pegasus was used to monitor associates of the Saudi journalist before his murder in 2018. While direct causation remains debated, the allegations underscore the spyware’s role in silencing dissent.
- Catalan independence leaders: Investigations in Spain revealed Pegasus was deployed against politicians advocating for Catalan independence, a scandal dubbed “CatalanGate.”
- WhatsApp hack (2019): NSO’s spyware exploited a vulnerability in WhatsApp’s call feature, targeting about 1,400 devices worldwide.
These cases illustrate how Pegasus has been weaponized against political dissent and free expression.
Legal and Ethical Battles
The misuse of Pegasus has triggered lawsuits and sanctions:
- Apple filed a lawsuit against NSO Group in 2021, accusing it of violating U.S. law by targeting iPhone users.
- Meta (WhatsApp) also sued NSO over the 2019 hack.
- The U.S. government blacklisted NSO Group in 2021, adding it to the Commerce Department’s Entity List, restricting its access to American technology.
NSO continues to insist that it sells Pegasus only to governments for legitimate security purposes, but watchdogs argue the company has failed to prevent abuse.
Why Pegasus Matters
Pegasus represents a turning point in the debate over surveillance technology. On one hand, it offers governments a powerful tool to combat terrorism and organized crime. On the other, its misuse demonstrates the fragility of privacy in the digital age.
The spyware raises urgent questions:
- Should private companies be allowed to sell such powerful surveillance tools?
- How can governments ensure accountability when these tools are misused?
- What protections exist for journalists, activists, and ordinary citizens against state surveillance?
Pegasus spyware is more than just a piece of technology—it is a symbol of the struggle between security and freedom. While NSO Group claims Pegasus is a weapon against criminals, its deployment against civil society has exposed the dangers of unchecked surveillance.
As investigations continue and lawsuits unfold, Pegasus has become a cautionary tale: in the wrong hands, even the most advanced technology can undermine democracy and human rights.
