Pegasus Spyware Found on Khashoggi Fiancée's Phone: A FRONTLINE Investigation

Many technologies used in cyber espionage are 'dual-use' products that can be used for both legitimate and malicious purposes, creating significant challenges for export control. Unlike physical goods, software can be distributed instantly across borders, making traditional customs controls ineffective. France and Britain have initiated new processes to address this, working both with governments and industry to establish new rules for technology control, including codes of conduct for businesses to know their end users and continuously monitor technology usage. The video explains that effective cyber defense requires international cooperation because cyberspace has no borders. NATO's cyber defense is only possible when the alliance can adequately assess cyber attacks and act collectively. The US has declared it can respond to cyber attacks not only in cyberspace but also conventionally (with missiles), which helps build a more systematic cyber defense.

Digital surveillance technologies, originally developed for military purposes, have become powerful tools that can be used to suppress human rights and silence journalists, necessitating international export controls similar to those applied to conventional weapons through frameworks like the Wassenaar Arrangement, as demonstrated by the case of Yemeni activists who discovered they had been spied on despite believing their work was government-approved.

Dual-use technology refers to products that can be used for both civilian and military purposes, including surveillance. The organization argues that such technology should be subject to export controls because it can be used for human rights violations. The European Union has implemented export controls for dual-use goods, but the organization argues these controls are too weak and allow technology to reach authoritarian regimes. The organization advocates for stronger export controls that would prevent the export of surveillance technology to countries where it would be used for human rights violations. The organization has advocated for reforms to European export control regulations to include human rights due diligence requirements. The current system relies on a list-based approach where companies must check if their products appear on controlled lists. The organization argues this is insufficient because many surveillance technologies, such as facial recognition software, are not on controlled lists. The organization advocates for requiring companies to conduct human rights due diligence on their products and customers, and to refuse exports to countries where their products would be used for human rights violations.

Dual use technologies are goods usable for both civilian and military purposes, including hypersonic missiles and microelectronics. International frameworks include the Wassenaar Arrangement (1996), Australia Group (chemical/biological weapons), and MTCR (missile technology control). India joined MTCR in 2017 but is not an NSG member. India's Strategic Trade Control System (SCTC) with SCOMET list regulates exports. Key national security laws include WMD Act 2005, Arms Act, Atomic Energy Act 1962, and Explosives Act 1884.

Dual-use technology refers to items that can be used for both civilian and military purposes, including GPS systems, internet infrastructure, smartphones, computers, and artificial intelligence. These technologies are subject to export controls because they can be used for military applications. Japan faces particular scrutiny regarding exports of dual-use technology to China, given concerns about China's military expansion and nuclear program. The strategic importance of these technologies has led to significant international trade tensions.

The Mobile Verification Toolkit (MVT) is a Python-based forensic tool that scans mobile devices (Android and iOS) for indicators of compromise (IOCs) such as spyware and malware, using STIX format databases maintained by the MVT community; the tool requires enabling developer mode and USB debugging on the device, connecting via ADB, and can extract complete backups of applications, SMS, and system data for security analysis.

The Mobile Verification Toolkit (MVT) is a security tool that scans Android devices for indicators of compromise (IOCs) by comparing installed applications and services against STIX format databases maintained by security communities, helping users detect potential spyware or malicious software; the tool requires developer mode to be enabled on the device and can extract complete application backups regardless of whether the device is rooted.

The Mobile Verification Toolkit (MVT) is a forensic tool that scans Android devices for indicators of compromise (IoC) by comparing device data against known malware signatures, helping identify potential spyware or unauthorized applications installed without user knowledge.

The Mobile Verification Toolkit (MVT) is an open-source forensic analysis tool developed by Amnesty International Security Lab that enables consensual forensic examination of Android devices to detect potential spyware infections by scanning SMS messages and embedded links against publicly available indicators of compromise (IOCs), allowing users to identify traces of compromise such as malicious spyware campaigns including Pegasus, Predator Spyware, and other surveillance software without requiring device rooting.

The Mobile Verification Toolkit (MVT) is a security tool that detects malware and spyware on Android devices by analyzing installed applications through automated scanning services like VirusTotal and Kaspersky, as well as by extracting and examining application data backups to identify malicious links or data exfiltration attempts.

Technology companies can take legal action against spyware developers who enable their products to be used for illegal surveillance. Apple sued NSO Group for enabling customers to abuse their products to target individuals including government officials, journalists, businesspeople, activists, academics, and U.S. citizens. The lawsuit was filed in the Northern District of California against NSO Group Technologies Limited and its parent company Q Cyber Technologies Limited, seeking a jury trial and permanent injunction to ban NSO Group from using any Apple software, services, or devices.

Major technology companies including Facebook and Apple have taken legal action against NSO Group, the developer of Pegasus. Facebook sued NSO in 2019 after discovering that the company had attacked 1,400 user accounts. Apple has also filed lawsuits against NSO, demonstrating that even major corporations recognize the dangers of such surveillance technology.

Journalists filed lawsuits against NSO Group, with Román Gracie becoming the first American citizen to sue in November 2020. The cases allege violations of federal computer fraud laws and California state laws. NSO Group claims its software is sold only to legitimate governments and has saved thousands of lives. Beyond El Salvador, lawsuits have been filed in the UK against NSO and governments of Saudi Arabia and UAE, with cases in Hungary, Thailand, and France. Major companies like WhatsApp and Apple have also sued NSO Group, creating a global legal challenge to the spyware industry.

This video explains Meta's successful lawsuit against NSO Group, a cybersecurity company that developed Pegasus, a zero-click spyware tool used to infect approximately 1,400 WhatsApp users including journalists, activists, and civilians. Despite NSO's defense that they only sold tools to licensed government agencies for fighting terrorism, the court ruled in Meta's favor, ordering NSO to pay $167 million in punitive damages and $445,000 in compensatory damages. This case represents a significant legal precedent in holding cybersecurity companies accountable for the misuse of their surveillance tools.

A US federal jury ordered Israeli spyware company NSO Group to pay Meta $170 million (including $130 million in punitive damages) for hacking 1,400 WhatsApp accounts, establishing a historic legal precedent that spyware companies can be held financially accountable for illegal surveillance operations. This landmark ruling, decided by 12 ordinary citizens, challenges the industry's culture of impunity and exposes the contradiction between governments claiming to prioritize cybersecurity while purchasing spyware technologies from companies like NSO Group. The judgment has significant implications for digital rights, international law, and the future of the spyware industry, with Mexico identified as the largest client of NSO Group, having the highest number of Pegasus victims.

State surveillance creates widespread self-censorship among citizens who fear their communications may be intercepted. Citizens avoid international communications and limit political expression, creating a climate of fear that suppresses democratic participation. The transformation from pre-2019, when citizens freely communicated, to 2025, when citizens fear electronic communication, demonstrates the chilling effect of state surveillance. Political reforms consolidate police state characteristics, where the state maintains extensive control through continuous monitoring. The normalization of intimidation tactics, including undated warning documents surrounded by multiple police officers, creates psychological pressure that paralyzes press freedom and civic engagement.

Metadata collection programs fundamentally violate associational privacy by tracking everyone's communications, contacts, locations, and movements. This creates a chilling effect on free association and speech, representing unconstitutional expansion of surveillance authority. International human rights bodies have condemned such practices as violating obligations under the ICCPR and Universal Declaration of Human Rights. The core issue is that mass surveillance enables pre-criminal investigation without judicial oversight, fundamentally transforming the relationship between citizens and the state.

Mass surveillance by definition cannot be proportionate and therefore violates international human rights law. The effect of surveillance is a strong deterrent effect that can lead people to modify their behavior before expressing public opinions or attending demonstrations, even when they have nothing to hide. This creates a chilling effect on the exercise of fundamental rights. No technical or legal guarantee can completely eliminate these risks to human rights, which is why total prohibition is advocated.

State intelligence agencies may conduct surveillance on human rights defenders and journalists investigating government misconduct. This surveillance can involve sophisticated malware such as Pegasus, which can take complete control of a victim's mobile device. The surveillance is often conducted to discredit investigations, link defenders to criminal organizations, and prevent them from exposing government abuses.

Understanding pervasive surveillance creates subconscious psychological effects that lead to self-censorship. People begin to tread on eggshells, avoiding certain topics or behaviors because they fear being tracked. This affects authenticity and honesty in opinions. The speaker describes how even simple things like wearing a smartwatch make them hesitant to share information. This creates isolation and loneliness, as people feel they cannot express themselves freely. The speaker notes that people are not connecting the way they used to, becoming very selective about which platforms they use, creating separate closed-off communities based on privacy consciousness.