NSO GROUP▊
The company that sells the bite that leaves no mark — zero-click phone exploitation, by government subscription — blacklisted by Washington, tracked by Citizen Lab, and found liable in the one case that reached a jury.
- ENTITY
- NSO Group Technologies Ltd., Herzliya, Israel — maker of the Pegasus spyware platform, sold to government clients FACT
- OPERATION
- Zero-click phone exploitation — "we only sell to vetted governments, for terrorists and criminals" (the company's standing position)
- HABITAT
- Per Citizen Lab's 2018 scanning: suspected Pegasus operations in 45 countries, run by 36 distinct operators ATTRIBUTED
- EVENT
- FOUND LIABLE — for hacking 1,400 WhatsApp users; jury awards $167.3M punitive, May 2025 ADJUDICATED
- PATTERN
- The research keeps finding the "terrorists and criminals" tool on the phones of journalists and activists ATTRIBUTED
- DISPOSITION
- US Commerce Entity List, Nov 2021 FACT · permanent injunction; punitives cut to ~$4M on review, Oct 2025 ADJUDICATED
NSO Group, official statement, July 21, 2021 — from "Enough is enough!", on the company's own site, in response to the Pegasus Project:
"The list is not a list of targets or potential targets of Pegasus. The numbers in the list are not related to NSO group. Any claim that a name in the list is necessarily related to a Pegasus target or Pegasus potential target is erroneous and false."
The same statement describes the coverage as a "planned and well-orchestrated media campaign lead by Forbidden Stories" and announces the company "will no longer be responding to media inquiries on this matter."
Every entry in this drawer wears one of three tags, and on this specimen the tags matter more than usual. ADJUDICATED is the WhatsApp case — a judge, a jury, an injunction. FACT is the paper trail: the Entity List notice, the dockets, the company's own statements. Everything else — the 50,000 numbers, the 45 countries, the forensics — is ATTRIBUTED: the work of Citizen Lab, Amnesty's Security Lab, and a reporting consortium, stated as theirs, disputed by the subject, and never upgraded by this archive.
Keep one more distinction in hand as you read. NSO's entire defense lives in the gap between making the gun and pulling the trigger: it says it sells only to vetted governments, and that what a government does with the tool is the government's act. The research community's entire case lives in how often, and on whose phones, the trigger keeps getting pulled. Both positions are below, at full strength.
▸ The mechanism — how NSO Group's tooling fits the surveillance-and-capture apparatus — is analyzed and scored on evilrobots.lol: the operator profile. troll.fan keeps the drama; the apparatus lives there.
the drama timeline
ACT I — THE TRACKERS FIND THE SPOOR (2016–2018)
A spyware platform is designed to be unobservable. A university lab in Toronto spends years building the instruments to observe it anyway. This act is about what the instruments showed — and what nearly walked out the door of the den itself.
-
SEP 18 2018
Citizen Lab maps Pegasus to 45 countries
Citizen Lab publishes Hide and Seek: two years of internet scanning identifying 1,091 IP addresses and 1,014 domains matching its Pegasus fingerprint, clustered into 36 distinct operators, with suspected operations in 45 countries — the lab's own careful phrasing is that operators "may be conducting operations" there.
The animal's camouflage is its product. The trackers cannot photograph it directly, so they photograph the bent grass — a thousand servers' worth of bent grass, on five continents.
-
JUL 2018
The $50M inside job that wasn't
Per an Israeli indictment as reported by AppleInsider, a disgruntled NSO senior programmer, facing termination, allegedly downloaded a copy of Pegasus source code — described as worth "hundreds of millions of dollars" — circumvented the company's controls on external storage devices after Googling how, and offered the cache on the dark net for around $50 million in cryptocurrency. The would-be buyer instead alerted NSO, which worked with law enforcement to catch the alleged thief. A cyberweapon nearly went to the open market; the company's response, on this record, was to catch it.
ACT II — THE LIST (JUL–NOV 2021)
Eighty journalists, seventeen newsrooms, one leaked dataset, and the sharpest caveat in modern reporting — a list of numbers that proves selection, not infection. Then the blacklist, which required no caveat at all.
-
JUL 18 2021
The Pegasus Project publishes
The Guardian, the Washington Post, and 15 other outlets, coordinated by Forbidden Stories with Amnesty's Security Lab as technical partner, publish the leaked list of 50,000+ phone numbers they believe NSO clients selected as targets of interest since 2016. The consortium's own caveat, kept intact here: a number's presence does not reveal whether the device was infected or even attacked. On the phones it could physically examine, Amnesty's lab reported Pegasus traces on 37 of 67.
-
JUL 21 2021
"Enough is enough" — NSO stops answering
NSO publishes the statement quoted in full in the "in their own words" block above: the list "is not a list of targets or potential targets of Pegasus," the coverage is a "planned and well-orchestrated media campaign," and the company will stop responding to media inquiries on the matter.
Note the posture: not a rebuttal of each number, but a rejection of the list's species entirely — followed by silence, announced in advance.
-
SEP 13 2021
FORCEDENTRY — the zero-click, captured live
Citizen Lab, examining a Saudi activist's phone, captures a working zero-click iMessage exploit — no tap, no link, no sign — and attributes it to NSO with high confidence. Apple patches CVE-2021-30860 the day of disclosure, updating every iPhone, Mac, and Watch on Earth because of what was on one activist's handset.
-
NOV 2021
The Entity List — and then Apple sues
The US Commerce Department adds NSO to the Entity List, restricting American exports to the company, on the recorded basis that its spyware was supplied to foreign governments that "used this tool to maliciously target government officials, journalists, businesspeople, activists, academics, and embassy workers." Three weeks later Apple files its own federal suit — which Apple itself would voluntarily drop in September 2024, citing (per reporting on the case) the risk of exposing its threat intelligence.
The listing is the strangest wound on the specimen: inflicted not by activists or courts, but by the export-control machinery of its most important ally's government.
ACT III — THE WATERING HOLE SUES BACK (2019–2025)
In 2019 the animal drank from the one watering hole with lawyers: it delivered Pegasus through WhatsApp's own infrastructure. Six years of discovery later, this is the only act with a gavel in it.
-
MAY–OCT 2019
1,400 phones via missed call; WhatsApp files suit
A zero-click exploit in WhatsApp's calling function — answer not required — is used to place Pegasus on the phones of 1,400 users over roughly two weeks in May 2019, per the allegations WhatsApp filed that October in the Northern District of California (case 4:19-cv-07123). NSO fights the suit for years, including on the argument that it deserves immunity for the sovereign acts of its government customers.
-
DEC 20 2024
Liable — on summary judgment
Judge Phyllis Hamilton finds NSO liable without need of a trial on the merits: violations of the federal Computer Fraud and Abuse Act, state hacking law, and WhatsApp's terms of service. The ruling also records that NSO "dragged its feet" in discovery, including defying an order to produce Pegasus source code usably. Only damages remain for a jury.
-
MAY 6 2025
The jury: $444,719 + $167.3 million
A California jury awards WhatsApp $444,719 in compensatory damages and $167.3M in punitive damages. NSO's statement: it will "carefully examine the verdict's details and pursue appropriate legal remedies, including further proceedings and an appeal."
Observe the ratio. The compensable harm to WhatsApp was priced under half a million. The number the jury attached to the conduct itself was three hundred and seventy-six times larger.
-
OCT 17 2025
Punitives cut to ~$4M — but the injunction is permanent
Judge Hamilton rules the jury's punitive award constitutionally excessive and cuts it to roughly $4 million — a 97% reduction, and a genuine win for NSO. The same order grants what NSO argued would "force it out of business": a permanent injunction barring NSO from targeting WhatsApp. "Part of what companies such as WhatsApp are 'selling' is informational privacy," the judge writes, "and any unauthorized access is an interference with that sale." Appeals continue.
both sides, on the record
Adjudicated hacking. A federal court found NSO violated US hacking law by delivering Pegasus to 1,400 WhatsApp users; a jury priced the conduct at $167.3M punitive; the injunction against targeting WhatsApp is permanent [1] [2] [3] [4].
A formal US finding of supply-to-abusers. The Entity List basis, in the Federal Register: spyware supplied to foreign governments that used it "to maliciously target government officials, journalists, businesspeople, activists, academics, and embassy workers" [5].
A decade of consistent research findings. Citizen Lab's 45-country map, the FORCEDENTRY zero-click captured on an activist's phone, Amnesty's forensics on the Pegasus Project phones — the counterterror tool keeps turning up, per the researchers, on civil-society handsets [6] [7] [8].
The company's standing position: it sells Pegasus only to vetted sovereign government customers, under Israeli export licensing, for counterterrorism and law enforcement; it does not operate the system for its clients; and governments' misuse of a lawfully sold tool is the governments' act. Its stated record includes investigating misuse and terminating client access [14].
Its denial of the list is total and on the record: "The list is not a list of targets or potential targets of Pegasus. The numbers in the list are not related to NSO group" [13]. The consortium itself concedes a number's presence proves neither infection nor attempted attack — the 50,000 figure is a claim about client interest, not about hacks [10].
The adjudicated record is narrower than the headlines. One case, one platform, one two-week campaign. On review, the court itself found the jury's punitive number excessive and cut it ~97%, to ~$4M [4]; Apple dropped its own suit voluntarily in 2024 [2] [12]; the Entity List is an export-control determination, not a judgment. And when an insider allegedly tried to sell Pegasus itself for $50M, the company's controls caught it and prosecutors acted [11]. NSO is appealing the WhatsApp result [3].
YOU DECIDE
Scoped to the claims. That NSO hacked WhatsApp's users is adjudicated — liability, jury, injunction; the punitive figure alone was reduced. That its spyware was supplied to governments that abused it is a formal US export-control finding, in the Federal Register's own words. That 50,000 numbers were targets is the consortium's characterization of a leaked list — attributed here, denied by the company, and never upgraded by this archive to more than what it is.
Weigh the costly signals on both sides: the US government restricted trade with it, a jury priced its conduct at nine figures, and its answer to the biggest investigation into its business was to announce it would stop answering. Against that: it fought the WhatsApp case for six years rather than settle, won a 97% cut on post-trial review, and the strongest claims against it remain, by the researchers' own careful hedges, research and not rulings.
The archive does not judge. It keeps the dockets, the denials, and the caveats — all three, at full strength.
evidence locker
COURT RECORD & GOVERNMENT
RESEARCH — CITIZEN LAB & AMNESTY
PRESS & CONSORTIUM
SUBJECT'S OWN CHANNELS — THE DEFENSE, UNEDITED
NSO Group — "Enough is enough!" (Jul 2021) SELF-PUBLISHED — the denial of the list's meaning and the end of media replies, in the company's own words.
nsogroup.com/Newses/enough-is-enough/ nsogroup.com SELF-PUBLISHED — the operation, still open for business; governance and human-rights policy pages as the company presents them. No official social account is linked on the company's site; none is asserted here.
nsogroup.com
The standard. The only adjudicated facts on this page are the WhatsApp case's outcomes — liability, the jury award, the reduction, the injunction — and they are labeled as such. The Entity List is quoted verbatim from the Federal Register and identified as an export-control determination, not a judgment. Citizen Lab's and Amnesty's findings are stated as their research, with their own hedges preserved; the Pegasus Project list is stated as an attributed target-selection list, never as confirmed infections. The company's denial, its lawful-sale defense, its appeal, and the court's own 97% punitive reduction are presented at full strength. No individual is accused of anything. If it couldn't survive a defamation challenge, it wouldn't be on this page.