Research Methodology
This page documents the methodology used by the Pegasus Research Archive for collecting, verifying, classifying, and presenting information about Pegasus spyware and related topics. Our goal is maximum transparency, reproducibility, and adherence to Google E-E-A-T (Experience, Expertise, Authoritativeness, Trustworthiness) principles.
- 01We prioritize primary sources (court filings, forensic reports, peer-reviewed research) over secondary reporting
- 02Every claim is labeled with its evidentiary status: Confirmed, Reported, Alleged, or Denied
- 03We use a 6-level source reliability rating system
- 04All sources are archived with citation IDs and direct links to originals
- 05We distinguish clearly between target selection, attempted infection, and confirmed infection
- 06We do not fabricate citations, invent developments, or present allegations as confirmed facts
Source Hierarchy
We classify sources into a hierarchy and prioritize them accordingly:
- Primary sources (Level 1): Court filings, forensic laboratory reports, peer-reviewed academic papers, official government documents, direct technical analysis
- Official sources (Level 2): Government statements, regulatory filings, parliamentary reports, official corporate statements
- Expert secondary sources (Level 3): Reports from established research organizations (Citizen Lab, Amnesty Tech, Google TAG), investigative journalism from major outlets
- Reputable secondary sources (Level 4): Mainstream media reporting from established outlets with editorial standards
- Other secondary sources (Level 5): Industry reports, think tank publications, specialist publications
- Tertiary sources (Level 6): Aggregators, encyclopedias, general reference works — used only for background, never for claims
Evidence Classification System
Every claim on this site is labeled with one of the following evidence classifications:
- FORENSICALLY CONFIRMED: The claim has been confirmed through forensic analysis by an independent, reputable research organization (e.g., Citizen Lab, Amnesty Tech). This is the highest level of confirmation.
- REPORTED: The claim has been reported by multiple credible sources but has not been independently forensically confirmed. This includes claims from the Pegasus Project's leaked target list.
- ALLEGED: The claim has been made by a source but has not been independently verified or confirmed. We present allegations as allegations, not as established facts.
- DISPUTED: The claim is contested — one party asserts it, another denies it, and the evidence does not clearly resolve the dispute.
- DENIED: The claim has been explicitly denied by the relevant party (e.g., NSO Group denies a specific allegation). We present denials as denials, not as confirmation that the claim is false.
- NOT INDEPENDENTLY VERIFIED: We have not been able to independently verify the claim and present it with appropriate caveats.
The Target Selection vs. Infection Distinction
We maintain a strict distinction between three different concepts that are often conflated:
- Target selection: A phone number appears on a list of potential targets selected by a spyware operator. This indicates interest in surveilling the person, not that the device was attacked.
- Attempted infection: A spyware operator attempted to infect the device. The attempt may or may not have succeeded.
- Confirmed infection: Forensic analysis has confirmed that the device was successfully infected with spyware. This is the strongest form of evidence.
We never present target selection as confirmed infection. We never present an attempted infection as a confirmed infection. We always specify which level of evidence supports each claim.
Source Reliability Rating
Each source in our Source Library is rated on a 6-level reliability scale:
- R1 (Highest): Peer-reviewed forensic report from a recognized research organization
- R2: Court filing or official government document
- R3: Report from a recognized research organization (not peer-reviewed)
- R4: Investigative journalism from a major outlet with editorial standards
- R5: Mainstream media reporting
- R6 (Lowest): General reference, aggregator, or unverified source
Verification Process
- Source identification: We identify the most authoritative source for each claim
- Source evaluation: We evaluate the source's reliability, expertise, and potential biases
- Cross-referencing: We cross-reference claims against multiple independent sources where possible
- Evidence classification: We classify each claim according to our evidence classification system
- Source citation: We cite the source with a citation ID and direct link to the original
- Archiving: We archive sources with their publication date, organization, author, and key findings
- Regular review: We periodically review and update our content as new information becomes available
Last Verified Dates
Every article on this site carries a "Last Verified" date indicating when the content was last reviewed and verified against current sources. We update content as new information becomes available and review all content at least quarterly.
What We Do NOT Do
- We do not fabricate citations or invent sources
- We do not present allegations as confirmed facts
- We do not sensationalize or use conspiracy language
- We do not assume guilt by association (being on a list is not proof of infection)
- We do not publish unverified technical claims without clear caveats
- We do not present NSO Group's statements as facts without noting they are the company's claims
- We do not present government denials as proof that something did not happen
- We do not use anonymous sources without noting their anonymity and the reasons for it
Google E-E-A-T Compliance
This archive is designed to comply with Google's E-E-A-T (Experience, Expertise, Authoritativeness, Trustworthiness) guidelines:
- Experience: We cite primary research from organizations with direct experience in spyware forensics (Citizen Lab, Amnesty Tech)
- Expertise: We rely on expert sources — forensic researchers, cybersecurity professionals, legal experts
- Authoritativeness: We cite authoritative sources — court filings, government documents, peer-reviewed research
- Trustworthiness: We are transparent about our methodology, evidence classification, and source reliability; we correct errors promptly; we distinguish between confirmed and unconfirmed claims
Independence
This archive is an independent, non-commercial research and educational resource. It is not affiliated with, endorsed by, or connected to NSO Group, any government, or any political organization. We do not accept funding from any party involved in the Pegasus story.
