Commercial spyware: documented cases worldwide

Surveillance with commercial software leaves, unlike almost any other abuse of power, a technical trace. An infected phone retains marks that labs like the University of Toronto's Citizen Lab, or Amnesty International's Security Lab, can analyse and peer-review. This tracker gathers only cases with that kind of verification —forensic or judicial—, not mere suspicions: twenty-two documented cases in twelve countries on four continents, from Mexico to Thailand, from Poland to the United Arab Emirates.

The pattern that emerges is of an almost monotonous uniformity. The software is, overwhelmingly, Israeli: NSO Group's Pegasus appears in the vast majority of cases, occasionally complemented by Candiru, the Intellexa consortium's Predator and Paragon's Graphite. And the victims are almost always the same categories: journalists, activists, lawyers, political opponents and human rights defenders. The tool is sold to pursue 'terrorism and serious crime'; the infected phones belong, again and again, to those who inconvenience power.

Panama: the purchase the courts documented

The Panamanian case is singular because it does not rest on a forensic analysis of a phone, but on something even more solid: a court file. Ricardo Martinelli's government acquired Pegasus in 2012, for around eight million dollars, and operated it from the Oceanía building through the National Security Council to surveil at least 150 people between 2012 and 2014. All of it was documented in the 'wiretapping' trial, where prosecutors detailed the negotiation with NSO —installation and training included. It makes Panama one of the world's first states to use Pegasus, years before the global scandal erupted in 2021.

That precedent matters because it illuminates the rest of the tracker. Most cases are known from the victim's side —a phone a lab analyses after an Apple alert—, but it is rarely proven who bought and operated the software. Panama is the exception that shows the full chain: a state, a contract, a building, a target list. And yet the former president was acquitted in 2019 in one of the proceedings, a reminder of how hard it is to translate technical evidence into judicial consequence.

Who pulls the trigger

Attribution is the weak point of almost the entire tracker, which is why one of the charts measures precisely the level of confidence with which each case is linked to an operator. The technical trace proves a phone was infected; it rarely proves, on its own, who ordered the infection. NSO insists it only sells to states, which narrows the circle of suspects, but governments tend to deny being clients —as El Salvador did despite the surveillance of 22 El Faro staff, or as happens with the current control of the Pegasus bought in Colombia, whose whereabouts remain unclear.

Spain illustrates the other side: there, the spying cut in two directions. On one hand, the so-called 'CatalanGate' documented by Citizen Lab, with dozens of Catalan pro-independence figures surveilled; on the other, the phones of the prime minister and several ministers themselves, infected in what the government called an 'external and illicit' attack. That both the watched and the watchers end up on the same victim list says a great deal about how unchecked this market is.

A trace that respects no borders

If the first version of this tracker focused on Ibero-America, its expansion to the rest of the world confirms the phenomenon knows no geography. In Poland, opposition senator Krzysztof Brejza was infected 33 times during the 2019 campaign, and a Senate commission later concluded those elections were unfair: spyware used not in an autocracy, but inside the European Union. In Thailand, the GeckoSpy operation infected at least 30 pro-democracy activists. In the United Arab Emirates, activist Ahmed Mansoor was one of the world's first documented targets, in 2016.

The darkest case is Saudi Arabia's: Citizen Lab found Pegasus in journalist Jamal Khashoggi's circle —on the phone of his confidant Omar Abdulaziz and, later, on his wife's— in the months before his murder in the Saudi consulate in Istanbul. It is the starkest proof that mercenary surveillance is not an abstract privacy matter: it can be the prelude to violence. And the confirmation of infections of exiled Russians and Belarusians inside the EU shows that not even refuge in a democracy protects from these tools' reach.