The Pegasus Project
The Pegasus Project was a landmark collaborative investigation published in July 2021 by a consortium of 80+ journalists from 17 media organizations, coordinated by Forbidden Stories and Amnesty International. It revealed a leaked list of 50,000+ phone numbers selected as potential Pegasus targets and confirmed infections of journalists, activists, and politicians worldwide.
- 01Published July 2021 by Forbidden Stories + Amnesty International with 80+ journalists across 17 outlets
- 02Revealed a leaked list of 50,000+ phone numbers selected as potential Pegasus targets
- 03Confirmed forensic infections of journalists, activists, and politicians in 45+ countries
- 04Triggered lawsuits, government inquiries, and the US Entity List designation of NSO Group
- 05Led to the EU PEGA Committee and increased global scrutiny of the commercial spyware industry
What Was the Pegasus Project?
The Pegasus Project was a collaborative investigative journalism project published on July 18, 2021. It was coordinated by the Paris-based nonprofit Forbidden Stories and the technical security team at Amnesty International, with participation from 80+ journalists from 17 media organizations worldwide, including The Washington Post, The Guardian, Le Monde, Die Zeit, and others.
The investigation was based on a leaked database of more than 50,000 phone numbers that had been selected as potential targets for Pegasus surveillance by NSO Group's clients. The list was provided to Forbidden Stories by a source who has remained anonymous.
The Leaked Target List
The leaked database contained phone numbers that had been selected by NSO Group clients as potential surveillance targets. It is critical to understand:
- Being on the list means the number was selected for potential targeting — not that it was successfully infected
- Forensic confirmation of infection requires laboratory analysis of the device itself
- The list represents a subset of all Pegasus targets — it is not a complete record
- The list does not identify which NSO client selected each number
Key Findings
- 50,000+ phone numbers on the leaked target selection list
- 1,000+ individuals identified from the numbers, including journalists, activists, politicians, lawyers, and business leaders
- 180+ journalists from prominent media organizations worldwide
- 600+ politicians and government officials from 34 countries, including 10 heads of state
- 85+ human rights activists
- 189 journalists from Mexico alone — the most heavily represented country
- Forensic confirmation of Pegasus infections on devices belonging to multiple journalists and activists
Media Partners
The Pegasus Project involved 17 media organizations:
- The Washington Post (US)
- The Guardian (UK)
- Le Monde (France)
- Die Zeit and Süddeutsche Zeitung (Germany)
- Proyecto Armando (Mexico)
- Knack (Belgium)
- Der Spiegel (Germany)
- OCCRP (Organized Crime and Corruption Reporting Project)
- FrontPage Africa (Liberia)
- The Wire (India)
- Radio France
- Mediapart (France)
- Kobini (Japan)
- Repubblica (Italy)
- El País (Spain)
- Daraj (Arab world)
- Forbidden Stories (coordinator)
Impact
The Pegasus Project had massive global impact:
- US Entity List: In November 2021, the US Commerce Department added NSO Group to the Entity List, restricting the company's access to US technology
- EU PEGA Committee: The European Parliament established a committee of inquiry to investigate the use of Pegasus in EU member states
- Lawsuits: Apple sued NSO Group in November 2021; the WhatsApp v. NSO case gained renewed attention
- Government inquiries: Multiple countries launched investigations into domestic use of Pegasus, including India, Poland, Hungary, Spain, and France
- Israel export controls: Israel's Defense Ministry tightened export oversight of NSO Group
- NSO financial impact: Novalpina Capital lost control of NSO Group; the company underwent restructuring
- Public awareness: The investigation brought unprecedented public attention to the commercial spyware industry
“The Pegasus Project revealed systematic targeting of civil society by NSO Group's clients.”
The Pegasus Project combined the leaked target selection list with forensic analysis by Amnesty International's Security Lab, confirming Pegasus infections on devices belonging to journalists, activists, and politicians across multiple countries.
Methodology
The Pegasus Project used a rigorous methodology:
- Source verification: Forbidden Stories verified the authenticity of the leaked database through multiple independent checks
- Number identification: Journalists identified the owners of phone numbers on the list through public records, social media, and direct contact
- Forensic analysis: Amnesty International's Security Lab performed forensic analysis on devices of consenting individuals using MVT (Mobile Verification Toolkit)
- IOC matching: Device artifacts were compared against known Pegasus indicators of compromise
- Peer review: Citizen Lab independently verified some forensic findings
- Publication: Findings were published simultaneously by all 17 media partners on July 18, 2021
Criticism and Limitations
- The leaked list represents a subset of all Pegasus targets — it is not comprehensive
- Being on the list does not confirm infection — only forensic analysis can confirm infection
- The list does not identify which NSO client selected each number
- NSO Group disputed some findings and stated the list was not a list of Pegasus targets
- Some governments named in the investigation denied using Pegasus
- Not all numbers on the list could be identified or contacted for forensic analysis
