TI-2026-061N — The Phone That Was Yours

Classification: HIGH · Mercenary Spyware · NSO/Pegasus · Paragon · Intellexa Confidence: HIGH on the NSO/Pegasus record (court filings, EU inquiry, US sanctions, in-corpus); MEDIUM on the Paragon-rebrand specifics, from 2025 reporting. TLP:WHITE — public complaints, public inquiries, public sanctions, published forensics. Series: The Fake Umbrella — Part N. N is for "NSO." This is the apex of the whole umbrella: the product that does not watch your phone from the outside but becomes it from the inside — sold, like all the rest, under a word that means "for your safety." Facts are facts. They are good for some and bad for others. You decide.

The seed: the one thing that is entirely you

Cellebrite (Part C) needed the phone in its hand. Lawful interception (Part I) needed the wire. The data brokers (Part D) bought your movements from around the edges. This letter is about the thing that skips all of it and takes the whole device from the inside, while it sits in your pocket, doing nothing you can see.

Pegasus, made by Israel's NSO Group, is zero-click spyware: it can be delivered to a modern phone with no tap, no link, no mistake by the victim — the iOS "BLASTPASS" chain of Part B is one such delivery — and once inside, it is the phone. Every message before it was encrypted and after it is read. The microphone, on demand. The camera. The location, continuously. The photos, the contacts, the wallet, the notes you wrote to yourself. There is no icon, no notification, no trace the owner can find. The single object that holds more of a person than any other — the one that is, functionally, you — quietly changes owners, and you are the last to know, if you ever know at all.

And it is sold, exactly like every other letter in this series, under a reassuring sentence: "We license only to governments, to fight terrorism and serious crime."

What the record says the tool is actually for

Set the sales sentence against the documented facts, which are not activist claims but court filings, parliamentary inquiries, and government findings.

• The US government's own words. In Apple's 2021 lawsuit against NSO, quoted in our corpus, the complaint cites the US Government confirming that NSO's products "have… enabled foreign governments to conduct transnational repression, which is the practice of authoritarian governments targeting dissidents, journalists and activists outside of their sovereign borders to silence dissent." The named function, per the United States, is silencing dissent.
• The Pegasus Project. Citizen Lab found Pegasus in 45 countries by 2018; the 2021 Forbidden Stories/Amnesty investigation surfaced ~50,000 numbers of interest — journalists, activists, lawyers, opposition figures — and people in the circle of Jamal Khashoggi, the journalist murdered and dismembered in a consulate. The EU Parliament's PEGA inquiry then documented abuse inside the EU — Poland, Hungary, Greece, Spain.
• The sanction. In November 2021 the US Commerce Department placed NSO on the Entity List for acting contrary to US national-security and foreign-policy interests. A government blacklisted it.
• The supply. Google TAG attributes 50% of known zero-day exploits against Google products to commercial surveillance vendors — this industry is the apex buyer of the market in Part B.

The "terrorists and pedophiles" of the brochure may be in the target list too. But the names that keep surfacing, in forensic report after forensic report, are reporters, lawyers, and the friends of a murdered journalist. The tool sold to fight the worst people keeps being found on the people who expose them.

The deniability is the product

NSO's defence is a small masterpiece of engineering — not of the malware, of the liability. Its own transparency report (in our corpus) says Pegasus is used "by states… to collect data from the mobile devices of specific suspected major criminals," licensed "only to the law enforcement and intelligence agencies of sovereign states," and then adds the crucial line: "we do not operate this technology" and have no knowledge of who the targets are.

Read what that structure does. The vendor builds and sells the capability and takes the money, while disclaiming all knowledge of its use. The client state operates it and points it, while hiding behind "national security." So when Pegasus turns up on a journalist's phone, there is a perfectly engineered gap where accountability should be: NSO says we don't operate it, ask the government; the government says national security, we don't comment; and the journalist is left holding a compromised phone and no one to sue. The "we don't operate it" is not a disclaimer bolted on afterward. It is the business model — a machine designed so that the harm has an author no one can name.

The "democracy-friendly" rebrand — and why it fails

After NSO got sanctioned and litigated, the market did what markets do: it produced a cleaner-looking version of the same thing. Paragon Solutions — Israeli, and per our corpus dossier 034D acquired in 2024 by the US private-equity firm AE Industrial Partners — marketed itself explicitly to "ethical," Western-democracy clients: the very governments that had sanctioned NSO. The pitch was, in effect, we are the spyware you can buy with a clear conscience. Same capability; better manners.

Then, in 2025, Paragon's "Graphite" spyware was found on the phones of journalists and activists (surfaced through WhatsApp/Meta notifications, notably in Italy). The rebrand did exactly what this whole series predicts a rebrand does: it changed the marketing, not the outcome. Because the capability is the capability — a zero-click implant cannot tell a terrorist's phone from a reporter's; it can only go where the client points it — and the client, "ethical" or not, keeps pointing it at reporters. "Democracy-friendly spyware" is not a safer product. It is the same product with a better sales channel, and the same journalists at the other end.

The seven questions

Who is this? Mercenary-spyware vendors — NSO (Pegasus), Paragon (Graphite), Intellexa/Cytrox (Predator) — and the client states that deploy them.

Why did it attack? To capture a specific person's entire phone for the client — messages, mic, camera, location — invisibly and completely.

Who does it claim to be? A counter-terror / serious-crime tool, licensed only to vetted sovereign governments, operated by them and not by the vendor.

Whom is it related to? The zero-day market (061B, its supply), the Unit 8200 pipeline (034D/061K, its people), Cellebrite (061C, the sibling cover), and lawful interception (061I, the state-vendor economy).

Where is the money? Multi-million-dollar per-target and per-country licences to governments, plus the private-equity capital now consolidating the industry (AE Industrial/Paragon). The target is not the customer; the target is the merchandise.

What is the official anchor? Defence-export licensing (the Israeli MoD for NSO) — which is real, and did not stop Pegasus reaching the states that murder journalists. The anchor exists and failed.

What if it is not who it claims? It is who it claims — a lawful-government spyware vendor. The finding is that a lawful-government spyware vendor, on the documented record, is an instrument of transnational repression with an engineered gap where its accountability should be.

What if…

• What if it really catches terrorists? Sometimes, surely — and that is the fig leaf, not the refutation. A zero-click total-capture implant cannot distinguish the terrorist from the journalist; it captures whoever the client selects, and the forensic record shows who the clients keep selecting. "It also catches criminals" does not answer for Khashoggi's circle.
• What if only bad governments abuse it? The EU PEGA inquiry found abuse inside EU democracies (Poland, Hungary, Greece, Spain), and Paragon's "democracy-only" spyware landed on Italian journalists. "Only bad governments" is not where the evidence sits; the capability corrupts the buyer's restraint by making the abuse frictionless and deniable.
• What if the vendor genuinely doesn't operate it? That is precisely the problem, not the defence. Selling an untraceable weapon and disclaiming its use is how you build a harm with no author. "We don't operate it" is the alibi, engineered in.

Steelman: the strongest defence — and why it fails

Built at full strength:

"Lawful-intercept spyware is a legitimate, regulated tool. Encryption has gone dark; police and intelligence services genuinely cannot investigate terrorism, child exploitation and cartels without a way onto the device. NSO sells only to vetted governments under Israeli defence-export licence, investigates credible abuse allegations, and has cut off customers. Paragon vets for democracies. Blaming the toolmaker for a client's misuse is like blaming a gun-maker for a murder."

Where it breaks:

• "Only vetted governments" is the trapdoor of Parts C and I. The vetting is opaque, the customers are secret, and the vetted list demonstrably included states that surveilled and, in Khashoggi's orbit, are tied to the killing of a journalist. "Lawful for the buyer" is not a safeguard when the buyer writes the law.
• "Investigates abuse and cuts off customers" is the Cellebrite reflex. As in Part C, the terminations trail exposure, never internal conscience, and the implant already on the phone keeps working. Reactive divorce from an abuser you kept selling to is not a control.
• "Vetted for democracies" was tested and failed. Paragon was the democracy-vetted version, and its spyware still landed on journalists in 2025. The strongest form of the defence has a 2025 counterexample.
• "Blame the client, not the toolmaker" ignores the engineered deniability. A gun-maker does not architect a business model whose entire point is that no one can ever prove who fired. NSO's "we don't operate it" is a designed accountability gap; the gun analogy fails precisely there.
• The one true thing: the going-dark problem is real, and lawful, warranted, overseen, adversarially-tested access to a specific device in a rule-of-law democracy can be legitimate — this dossier does not pretend otherwise. But that is a narrow, accountable act. The mercenary-spyware industry — untraceable zero-click total capture, sold to secret clients, disclaimed by the vendor, sanctioned by the US, and repeatedly found on the world's reporters — is not that act. It is the going-dark argument weaponised into an unaccountable global market.

Verdict: narrow, warranted, accountable device access in a democracy is a legitimate debate. The mercenary-spyware industry as it exists — NSO/Pegasus, Paragon/Graphite, Intellexa/Predator — is HIGH: total, invisible capture of the most personal object a human owns, sold with engineered deniability, officially named by the US and EU as a vehicle of repression, and landing, again and again, on journalists and the murdered. "Lawful" is not a mitigation. It is the last and heaviest costume in the umbrella. Confidence: HIGH on NSO/Pegasus; MEDIUM on the Paragon specifics.

Read between the lines

Every earlier letter borrowed a word to soften an act. This one borrows the whole grammar of the state — "sovereign," "lawful," "national security," "law enforcement and intelligence agencies" — to make the total capture of a private human being sound like governance. The genius, and the horror, is the outsourcing of the dirty verb. A government that hacked a journalist itself would own the act; NSO invented a structure where the government gets the take and the vendor gets the money and the act itself has no owner — it happened "lawfully," to a "target," via a tool "we do not operate," selected by a client "we cannot name." Read the whole umbrella backward from here and you see what it was building toward: not a single lie, but a supply chain of deniability long enough that, at the end of it, a reporter's phone opens and no human being is responsible. NSO did not just sell spyware. It sold the absence of an author, and priced it per target.

The human layer

A journalist keeps a phone the way the rest of us keep a diary and a life and a set of promises to the people who trusted them — the source who called at midnight, the address of the safe house, the photo not yet published, the message that says don't worry, no one can read this. And then, with nothing done wrong and nothing clicked, the phone is not theirs anymore. Everything on it — the source, the safe house, the photo, the promise — belongs to a government they are investigating, delivered by a company that will say it does not operate the tool and cannot name the client. Somewhere in the Pegasus numbers is a person who was close to Jamal Khashoggi, whose phone was of interest around the time he walked into a consulate and did not walk out. That is the far end of the whole fake umbrella: not a coupon, not an ad, not a false friend, but a human being whose most intimate possession was turned against them and everyone who trusted them, silently, lawfully, deniably — and a reporter, of all people, made unable to protect the very sources whose protection is the only thing the free press has to offer. The phone that was yours is where the series stops being about words. Here the word "lawful" is standing in front of a grave.

Defense — assume the device, protect the network of trust

(1) Assume total compromise is possible and design around it. Against a funded zero-click adversary, no consumer phone is guaranteed safe; high-risk users (journalists, activists, lawyers) should compartmentalise — separate devices, minimal data on any one phone, Lockdown Mode / hardened configurations, and the assumption that a seized or targeted device is fully owned. (2) Protect sources out-of-band. If your phone may be a target, the safety of your sources cannot live on it; the promise "no one can read this" must be backed by architecture, not faith. (3) Treat "lawful spyware" language as 061C/061I marketing. "Vetted governments," "only for serious crime," "we don't operate it" are the exact phrases the record has already defeated; weight them accordingly. (4) For policymakers: the leverage points are the export licence that let Pegasus reach abusers, the deniability structure that erases accountability, and the private-equity consolidation now scaling the industry — regulate the market, the licensing and the liability gap, because "should this capability exist for sale at all" is the only question proportionate to a phone that becomes its owner's jailer.

Investigation metadata

Next — TI-2026-061O: O is for "Open data" — Clearview AI and the face-recognition firms that scraped billions of public photos into a searchable face-print of humanity, and called it "just public information."

This is where the umbrella was always heading. Not a word that hides a sale, but a supply chain of deniability long enough that a journalist's phone opens and no one is responsible — the government took the take, the vendor took the money, and the act "we do not operate" has no author. They sold states the power to become a person's phone from the inside, and the freedom to never be named for it, and they kept calling it lawful because "lawful" was the last costume left. The phone that was yours was the diary, the source, the promise. Now it belongs to whoever paid. Facts are facts. They are good for some and bad for others. You decide.