Five years after the Pegasus Project headlines shocked the world, the press is still chasing a comforting lie. They want you to believe that a French judicial investigation, a few blacklists, and some sternly worded human rights reports will somehow tame the wild west of mercenary spyware.
It is pure, unadulterated theater.
The mainstream narrative surrounding NSO Group and Pegasus is fundamentally broken. It treats offensive cyber-weapons as an anomaly—a rogue weed that can be pulled from the digital garden if we only pass the right laws or indict the right foreign executives. This perspective is not just naive; it is actively dangerous because it ignores how modern telecommunications and global intelligence markets actually function.
The hard truth is that Pegasus is not a temporary aberration. It is the natural, inevitable end state of a consumer technology ecosystem built on hyper-complexity, and a geopolitical arena driven by infinite state demand.
The Fallacy of the Unique Villain
The media loves a villain with a name. NSO Group, the Israeli creator of Pegasus, fits the script perfectly. But treating NSO as the root of the problem is like blaming a single arms manufacturer for the existence of global warfare.
If NSO Group collapsed tomorrow, the market for zero-click exploits would not shrink by a single millimeter.
The mercenary spyware industry is a hydra. When the United States blacklisted NSO Group, the demand did not vanish; it simply migrated. Agencies worldwide turned to competitors like Candiru, Intellexa, Variston, and Cybereason. When Greece erupted in its own wiretapping scandal involving Predator spyware, it proved that European soil is just as fertile for these operations as the Middle East.
This is a highly liquid, parallel defense market. For decades, private exploit brokers like Zerodium and Crowdfense have openly advertised multi-million-dollar bounties for zero-click iOS and Android vulnerabilities.
Let us look at the cold math of this industry:
- A zero-click iOS exploit chain (allowing complete takeover without user interaction) routinely commands $5,000,000 to $10,000,000 on the private gray market.
- The buyers are not just comic-book dictatorships; they are sovereign states, including Western democracies that publicly condemn the trade while privately funding it.
To believe that a slow-moving judicial inquiry in Paris can dismantle an industry fueled by these economics is sheer delusion. The lawyers are bringing paper shields to a railgun fight.
Why Courts and Blacklists Cannot Save You
The ongoing French judicial investigation is hailed as a crucial step toward accountability. In reality, it is a dead end.
The legal system is fundamentally unequipped to handle transnational, state-sponsored cyber operations. Cyber-surveillance tools are sold to sovereign governments. Under international law, the doctrine of state immunity shields foreign governments from domestic lawsuits. This means a French court cannot easily penalize a foreign intelligence agency for deploying Pegasus against its citizens.
Instead, the courts target the corporate entities. But NSO Group and its peers are masters of corporate shell games. They operate through a dizzying web of holding companies, local subsidiaries, and intellectual property transfers spanning Israel, Cyprus, Luxembourg, and Oregon. By the time a court finalizes a ruling against one corporate structure, the engineers, the source code, and the client contracts have already been transferred to a new, clean corporate shell.
Even the US Treasury’s entity list—which restricted NSO's access to American technology—failed to kill the company. It merely forced them to restructure their debt and look for buyers in countries that do not care about Washington's sanctions.
If you think a court ruling will secure your phone, you do not understand how sovereign states operate when they believe their national security is on the line. They do not care about a subpoena.
The Hypocrisy of Sovereign Demand
The loudest voices condemning Pegasus are often the ones driving the market for it.
Western intelligence agencies have spent the last two decades crying crocodile tears over "going dark"—their term for the rise of end-to-end encrypted messaging apps like Signal, WhatsApp, and iMessage. They spent years trying to force tech companies to build backdoors into these apps. They failed because tech companies knew backdoors would compromise security for everyone.
So, how did those intelligence agencies solve the "going dark" problem? They went to the private market.
If you cannot break the encryption in transit, you compromise the endpoint. You buy an exploit that infects the phone itself, allowing you to read the messages before they are encrypted and after they are decrypted.
This is why the market for zero-click spyware is indestructible. Governments need this capability to function in the modern surveillance era. The Wassenaar Arrangement, which attempts to regulate the export of dual-use technologies like intrusion software, has proven to be a toothless tiger. Governments routinely grant export licenses to their domestic spyware firms under the guise of "lawful interception" or "anti-terrorism."
The outrage is reserved for when these tools are used against journalists and politicians in the West. But when the exact same technology is used by Western allies to track geopolitical targets, it is called statecraft. The double standard is baked into the system.
Your Smartphone Is Born Broken
We must stop treating spyware infections as "hacks" in the traditional sense. They are not the result of users clicking suspicious links or downloading malicious apps.
The modern zero-click exploit is an engineering masterpiece that exploits the unavoidable laws of software complexity.
Consider the infamous "ForcedEntry" exploit chain discovered by Citizen Lab in 2021. NSO Group bypassed Apple’s BlastDoor sandbox by sending a malicious PDF disguised as a .gif file over iMessage.
When the target’s phone received the message, the system automatically processed the image to show a preview. To do this, the operating system used an old, obscure PDF parsing library designed to decode files from xerox scanners in the 1990s. The exploit triggered an integer overflow in that library, allowing NSO to set up a virtual computer inside the phone's memory and execute code without the user ever knowing a message had arrived.
Imagine a scenario where a device contains millions of lines of code, parsing thousands of obscure file formats, operating on baseband processors, Wi-Fi chips, graphics cards, and neural engines. Each of these components is a potential entry point.
[Incoming iMessage]
│
▼
[Automatic Preview Rendering] (No user action required)
│
▼
[Obscure 1990s PDF Parser Library]
│
▼
[Memory Overflow / Privilege Escalation]
│
▼
[Full Kernel Takeover & Spyware Installation]
No software engineering team on earth, not even Apple’s highly funded security team, can write millions of lines of C and C++ code without memory safety vulnerabilities.
Your smartphone is a general-purpose computer crammed into a pocket, constantly connected to a global network, running an incredibly complex stack of legacy software. It is structurally impossible to make it fully secure against a well-funded offensive research team. The attack surface is simply too vast.
The Illusion of Lockdown Mode
In response to Pegasus, Apple introduced "Lockdown Mode." It is a commendable effort, and it does make exploitation more expensive by stripping away features like message previews, complex web technologies, and shared libraries.
But do not mistake a higher price tag for absolute security.
Lockdown Mode is a speed bump, not a brick wall. It forces exploit developers to find more creative, more expensive vulnerabilities. It shifts the price of a working exploit chain from $3,000,000 to perhaps $8,000,000.
For a wealthy nation-state targeting a high-value dissident, a prime minister, or a defense contractor, an extra $5,000,000 is rounding error. The intelligence budget of even a mid-tier nation-state can easily absorb these costs.
If you are a target of a state-sponsored intelligence agency, relying on Lockdown Mode to save you is a dangerous gamble. It assumes your adversary has a fixed budget and zero patience. In reality, they have infinite patience and a budget funded by taxpayers.
Stop Pretending We Can Fix This
The entire debate around Pegasus is built on a flawed premise: that we can regulate our way back to privacy. We cannot.
The technology to compromise any connected consumer device exists, it is highly profitable, and it is actively coveted by every government on earth. The legal, corporate, and technological systems we rely on to protect us are fundamentally broken at the architectural level.
If you are a high-value target—a journalist exposing state corruption, a human rights attorney, or a political opposition leader—you must accept a brutal reality: If they want into your phone, they are getting in.
The only real defense is to change how you operate.
- Ditch the omni-device mindset. Stop using a single device for your sensitive communications, your personal banking, your social media, and your family photos.
- Treat every smartphone as compromised by design. Assume that everything said, typed, or displayed near your phone is being recorded by a third party.
- Go analog for critical operations. The most secure encryption is physical isolation. If a conversation is truly sensitive, leave the devices in another room, walk into a park, and speak face-to-face.
The judicial investigations will drag on for years, generating endless headlines and zero meaningful change. NSO Group might eventually rebrand or dissolve, but its engineers will simply sign new contracts under a different flag.
The digital panopticon is not coming; it is already here. Stop waiting for the courts to save you, and start acting like you are already being watched.
