N is for NSO Group — The Archetype of the Mercenary, the Zero-Click, and the Deniable

The Alphabet of Actors — Letter N. A named-entity dossier: who they are in the record, what the LSN systems catch of their kind today, and a status verdict — ACTIVE, DEFUNCT, REBRANDED, PROSECUTED, ABSORBED, INDICTED, DISBANDED, EXPOSED, DISSOLVED, UNDETERRED, NORMALIZED, SANCTIONED, CAUGHT, EVOLVING, TAKEN DOWN, IMMORTAL, LIABLE.

The last letter, Mirai, was the loudest actor in this register — a botnet the honeypot watches recruit tens of thousands of times a day, the noisy floor of the internet's threat landscape. This letter is its exact opposite, and that opposition is the point. NSO Group's Pegasus is the quietest actor in the whole alphabet. The honeypot cannot see it. No sensor the LSN platform runs will ever record it. It arrives at a single chosen phone over the cellular network or a messaging app, compromises a fully-patched device with no action by its owner, exfiltrates that person's entire life, and, on some versions, deletes itself. Mirai is mass, indiscriminate, and trivially detectable. Pegasus is targeted, deliberate, and by design almost undetectable. Between them sits the entire span of what "attack" can mean.

NSO Group is an Israeli company, founded in 2010, that did something more consequential than write a piece of spyware. It industrialized a model. It took military-grade phone interception — the kind of capability that had belonged to a handful of state intelligence agencies — packaged it as a licensed commercial product called Pegasus, and sold it to governments around the world as a subscription. And it wrapped that product in an accountability structure so clean that, for a decade, the company could stand behind almost any abuse committed with its tool and say, truthfully in the narrow legal sense: we did not do that; our customer did; we only sold the software.

This is the capstone of the spyware arc this register has been building through the alphabet — Amesys and Nexa at the beginning, FinFisher, Intellexa — and NSO is the archetype all the others copied. It is also the one commercial-surveillance actor in this entire register to face real, adjudicated consequence: blacklisted by the United States government, and found liable by a United States federal court. This is the letter about what happens when the pioneer of an industry is actually punished, and the industry it created keeps growing anyway.

1. The Actor: interception as a product

To understand NSO you have to understand what it sold, because the product is the argument. Pegasus is a remote phone-compromise platform. Once it is on a target's iPhone or Android device, it does not merely read messages — it takes the whole device: the encrypted chats before they were encrypted and after they were decrypted, the call logs, the photos, the location history minute by minute, the contacts, the calendar. And more than the stored data, it takes the sensors: it can silently activate the microphone and the camera, turning the phone in a person's pocket into a live listening and watching device that follows them into every room they enter. There is no meaningful privacy left to a person whose phone carries Pegasus. The phone stops being theirs.

What made NSO the archetype was not that this was possible — intelligence agencies had pursued such capabilities for years — but that NSO turned it into a repeatable, sellable, supportable commercial product. A government did not need to build an interception program from scratch, recruit exploit developers, or run the infrastructure. It could buy Pegasus as a licensed system, with an interface, with support, with capacity for a number of concurrent targets, the way an enterprise buys any other software. NSO took the most sensitive capability a state can wield against an individual and made it procurable. That is the industrialization, and it is why every profile of the mercenary-spyware market, including Google's Threat Analysis Group survey Buying Spying, treats NSO not as one company among many but as the node that defined the category.

And around the product NSO built the defence that is the second half of its significance. In its own 2021 Transparency and Responsibility Report, the company states its position plainly: NSO licenses Pegasus to sovereign states and state agencies; NSO does not itself operate the system; NSO does not see the data collected against any target. The vendor sells the weapon; the government pulls the trigger; and therefore, the argument runs, the vendor is not responsible for who gets shot. Hold that structure in mind, because everything difficult about this letter — legally, morally, forensically — lives inside it.

2. The Instrument: the zero-click, and why the honeypot is blind to it

The technical apex of Pegasus, and the reason it belongs at the silent end of this alphabet, is the zero-click exploit. In 2021 the researchers at Citizen Lab captured and analysed one, which they named ForcedEntry. It worked through Apple's iMessage, and it required the victim to do nothing at all. No link to click. No attachment to open. No suspicious message even to notice. The exploit arrived, compromised a fully up-to-date iPhone through a flaw in the way the device processed an incoming message, and installed Pegasus — all before the target had any chance to see anything, because there was nothing to see. Google's own analysts, who later dissected the technique, described it as among the most sophisticated exploits they had ever encountered.

Sit with what zero-click means for defence, because it is the whole reason this letter's bridge is an inversion. Almost every piece of security advice ever given to an ordinary person is about the click: do not open unexpected attachments, do not follow suspicious links, do not enter your password on a strange site. Every one of those defences assumes the victim participates in their own compromise, and can therefore refuse. The zero-click exploit removes the victim from the equation entirely. There is no moment of choice to get right. A careful, informed, cautious person who does everything correctly is compromised exactly as thoroughly as a careless one, because their behaviour was never a variable. Against ForcedEntry, being careful is not protection. Only not being targeted is protection, and that is not a thing a target gets to decide.

Now the bridge, which is the honest one this letter has been pointing at. The LSN honeypot — the platform beneath these words — sees the internet's noise: the telnet brute-forcers, the SSH credential-stuffers, the scanners, the mass-exploitation waves. It is superb at the loud, indiscriminate floor, and the last letter showed it watching Mirai's genus recruit in real time. Pegasus is the ceiling, and the honeypot is structurally blind to it. Pegasus does not scan; it does not brute-force; it does not knock on a honeypot's open port, because it was never looking for open ports — it was aimed at one specific human being's phone number, and it travelled a path the honeypot does not sit on. This is the letter where the platform's relevant instrument is not its sensors at all. It is the archive — Citizen Lab's forensics, the EU Parliament's inquiry, the court complaints, Google TAG's mapping. Some actors you catch in telemetry. This one you catch only in the paper record, and that distinction is one of the truest things the whole Alphabet has to teach.

3. The Victims: who Pegasus was pointed at

An abstraction about capability becomes a dossier only when it names who was harmed, and here the record is specific, so this section centers the targets rather than the technology.

The founding case has a name: Ahmed Mansoor, a human-rights defender in the United Arab Emirates. In 2016 Citizen Lab documented that Mansoor had been targeted with an NSO Pegasus iPhone zero-day exploit chain — the operation they called the Million Dollar Dissident, for the going price of the exploit. What exposed it was Mansoor's own caution: he recognised the SMS lure as suspicious and, instead of clicking, forwarded it to researchers. That single decision turned a covert operation into the first forensically-grounded public capture of Pegasus in the wild. It is worth stating what happened to Mansoor afterward, because it is the ground truth of what this tool is for: he was later imprisoned in the UAE, where he has remained, in conditions rights groups have condemned. The Million Dollar Dissident is not a technical footnote. It is a man whose phone was targeted and who is now in a cell.

Beyond Mansoor, the pattern documented across the archive is consistent: the targets of Pegasus, as reported in the Apple and WhatsApp complaints and years of forensic reporting, are journalists, human-rights activists, lawyers, political opposition figures, academics, and dissidents. The Washington Post reporting cited in Apple's own complaint describes Pegasus deployed to attack and surveil scores of such individuals across many countries. These are not the counterterrorism targets NSO's marketing invokes; they are the people who hold power to account. That is the recurring shape of the harm, and it is the reason the bright line in the next sections matters — because within this pattern are both incidents established to a forensic standard and contested attributions the company disputes, and an honest register must keep them apart.

4. The Reach: the model came home to the democracies

There is a comfortable version of the Pegasus story in which the tool is sold by an Israeli firm to authoritarian governments who use it against their own dissidents — a story that keeps the harm safely abroad, in other people's countries, under other people's regimes. The European Parliament's own inquiry demolished that comfort, and this section reports what it found.

The Parliament established a dedicated committee of inquiry, PEGA, to investigate the use of Pegasus and equivalent spyware. Its finding was that the mercenary model had come home. There was strong evidence of Pegasus use inside the European Union: NSO had sold its products to at least 22 end-users in at least 14 Member States. It named names — Poland, Hungary, Spain, the Netherlands, Belgium among them — and it found that two Member States, Cyprus and Bulgaria, had served as export hubs for the spyware moving out of Europe. In several of those states the documented targeting was not of foreign terrorists but of domestic politics: opposition figures, journalists and lawyers surveilled by their own governments.

This is the finding that promotes Pegasus from a human-rights problem in distant autocracies to a structural threat to democracy itself. A capability that removes the possibility of private communication, placed in the hands of a governing party, is a capability to surveil the opposition, the press and the courts that are supposed to constrain that party. The PEGA inquiry established that this did not remain hypothetical inside the EU. The tool that industrialized interception did not stay at the borders of the regimes it was first sold to. It flowed into democracies and was turned inward, and that is why the accountability question this letter turns on is not a niche concern of the surveilled few. It is a question about whether the machinery of accountable government can survive a product designed to see through it.

5. The Accountability: the one vendor the record actually caught

Across this entire register the recurring finding has been impunity — actors sheltered by borders, indicted but never tried, sanctioned but undeterred. NSO is the exception, and the exception is instructive precisely because it is so rare, so this section states carefully what was adjudicated and what was not.

Two hard outcomes of record distinguish NSO from every other vendor in the spyware arc. First, in November 2021 the United States Department of Commerce added NSO Group to the Entity List, finding that the company had acted contrary to the national-security and foreign-policy interests of the United States by supplying spyware used by foreign governments to maliciously target journalists, activists, dissidents, academics and embassy workers. That is a state-level sanction against a private surveillance vendor, and it cut NSO off from the American technology supply chain that the whole industry depends on. Second, and more remarkable, NSO was sued in United States federal court by WhatsApp, over the delivery of Pegasus to roughly 1,400 devices through a WhatsApp vulnerability — and it lost. A US federal court found NSO liable for the intrusion, and a jury returned a substantial damages award. This is not an allegation; it is a civil judgment. Of every actor named in this alphabet, NSO is among the very few to have a court actually find against it.

Now the bright line, held firm. What is adjudicated is the WhatsApp intrusion liability and the Entity List designation — those are facts of record. What is not adjudicated, and must not be reported as if it were, is the full catalogue of individual-victim attributions. NSO has consistently denied that its technology was used in some of the most notorious cases associated with its name, including targeting connected to the murder of the journalist Jamal Khashoggi; the company maintains it investigates credible allegations of misuse and terminates customers who abuse the system. Some victim attributions rest on strong independent forensics from Citizen Lab and others; some rest on reporting whose methodology has been contested; and the presumption of innocence attaches to every claim not tested in a court. This letter reports the judgment that exists and the sanction that exists, names the denials as denials, and does not launder the strength of the forensic cases into the certainty of the ones still contested. The gravest documented harm — the targeting of people like Mansoor, who is in prison — needs no exaggeration to weigh what it weighs.

6. The counter-narrative, steelmanned

NSO's own defence is coherent, it is stated in the archive in the company's own words, and it deserves to be put at its strongest before it is answered.

The argument runs like this. Pegasus is a lawful-intercept tool, sold only to vetted sovereign governments and their agencies, for the legitimate and serious purposes of counterterrorism and criminal investigation. Encryption has gone dark on the authorities; end-to-end messaging means that even with a lawful warrant, a state can no longer read the communications of a terror cell or a trafficking network the way it once could tap a phone line. Pegasus restores that lawful capability. NSO does not operate the system, does not choose the targets, and does not see the collected data — the government customer does all of that, under its own laws and its own oversight. When abuses occur, they are abuses by the customer, not by the vendor, exactly as a car manufacturer is not the drunk driver and a locksmith is not the burglar. And NSO says it does more than disclaim: it vets customers, it contractually forbids certain targeting, it investigates credible misuse reports, and it has cut off government clients found to have abused the tool. On this account NSO is a legitimate defence contractor serving democracies' security needs, unfairly made the villain for the sins of its sovereign customers.

The dossier grants the real premise and rejects the exculpation. The going-dark problem is genuine; encrypted messaging does impede lawful investigation, and states have a legitimate interest in targeted, warranted interception of real threats. But the defence collapses at the point where it meets its own product and its own record. First, the "we only sell to governments, they operate it" structure is not a mitigation of the abuse — it is the mechanism of the abuse. A capability this total, sold to governments including ones with documented records of persecuting their critics, with the vendor deliberately positioned to neither see nor be responsible for its use, is a system engineered to make abuse deniable, not preventable. The deniability is the product feature. Second, the vetting-and-investigation defence is measured against the EU's own findings and years of forensics: if the safeguards worked, Pegasus would not have been found on the phones of opposition politicians and journalists inside the European Union, and NSO would not have needed to keep announcing customer terminations after the exposure rather than before the harm. Third, the zero-click nature refutes the car-and-locksmith analogy: a lock protects until someone chooses to break it, but ForcedEntry removes the victim's every defence with no choice on their part — this is not a neutral tool misused, it is a weapon whose only function is to defeat the defences of a specific human being. And fourth, the outcomes answer the "unfairly villainized" claim on their own: the United States government did not blacklist a defence contractor doing legitimate work, and a federal jury did not award damages against an innocent vendor. The counter-narrative describes a company NSO wishes it were. The record describes the one it is.

7. Verdict — LIABLE, and PROLIFERATING

NSO Group took the most invasive capability a state can turn against an individual, made it a product, sold it to governments, and built an accountability structure designed so that when the tool was used to hollow out a journalist's phone or follow a dissident into prison, the vendor could say it was not responsible. It industrialized the mercenary-spyware model, it achieved the zero-click apex that makes even a careful victim defenceless, and its tool was found not only in the hands of autocrats abroad but turned inward against opposition and press inside the democracies of the European Union. It is the archetype the whole spyware arc of this alphabet was building toward.

The verdict's first word is the one this register almost never gets to write about an actor in this class: LIABLE. NSO is not merely accused. The United States blacklisted it on the Entity List, and a United States federal court found it liable for the WhatsApp intrusion, with a jury attaching a real damages figure to the finding. Set against a register full of the untouchable — the sheltered state operators, the indicted-but-never-tried, the sanctioned-but-undeterred — NSO is a rare case of adjudicated consequence actually landing on the vendor. The archetype was caught, in the one way that leaves a judgment on the record.

The second word is why the judgment, though real, did not end the thing NSO started: PROLIFERATING. The market NSO defined is larger and more diffuse now than when it was blacklisted. The model — zero-click capability, government-only sales, vendor deniability — is a template, and templates outlive the companies that write them. Intellexa and its Predator (letter I), Paragon, Candiru, QuaDream: the successors sell equivalent capabilities, and every time one is exposed and pressured, another is standing up. Punishing the pioneer did not close the industry, because the industry was never one company; it was an idea about how to sell the unsellable, and NSO proved the idea works commercially even when its author is sanctioned. You can find a vendor liable. You cannot find a business model liable.

Fourteen letters deep, NSO is the register's clearest lesson in the limit of consequence against a class rather than an actor. Mirai showed a conviction that could not un-publish the code. NSO shows a judgment that cannot un-teach the model. The honeypot beneath these words will never record a single Pegasus infection, and that blindness is not a gap in the platform — it is the accurate measure of the threat: the loud floor is caught in telemetry, the silent ceiling is caught only in the paper record, and both are real. The vectors do not lie, and here the vectors are court filings, a parliamentary inquiry, and the forensic examination of victims' phones. Judge the company that made interception a product and deniability a feature. Then judge the market that outlived its punishment — and remember Ahmed Mansoor, who was careful, who forwarded the message instead of clicking, who exposed the whole thing, and who is in a prison cell anyway.

The Alphabet of Actors continues. Verdict: LIABLE, and PROLIFERATING. Confidence: HIGH on the adjudicated record — the Entity List designation, the WhatsApp liability finding and jury award, the PEGA inquiry findings, and the Citizen Lab forensic captures are all matters of public record; individual-victim attributions that NSO disputes are reported as contested, with presumption of innocence for untested claims and NSO's denials named as denials. Classification: TLP:WHITE. Include everything — the vectors do not lie, and they do not judge. The reader judges the vendor, the deniability structure, and the market that keeps building the same weapon under new names.