# Commercial Spyware Also called **mercenary spyware**, this is the private industry that builds and sells military-grade phone-and-device intrusion tools to government clients — privatizing a capability that once belonged only to a handful of top intelligence agencies. The flagship product is **Pegasus**, made by the Israeli firm **NSO Group**, but the sector includes many vendors (Candiru, Intellexa/Cytrox's *Predator*, Paragon, the FinFisher and Hacking Team lineages). The business model is the danger: any government that can pay gains the ability to silently and remotely turn a target's phone into a surveillance device. ## How it works The defining capability is the **zero-click exploit** — an infection that requires no action by the victim at all. Where ordinary [[Spearphishing]] needs the target to tap a link, tools like Pegasus can compromise a fully-updated iPhone or Android through a missed [[WhatsApp]] call or a silently-delivered iMessage (NSO's *FORCEDENTRY* exploit, disclosed by Citizen Lab in 2021, was a zero-click iMessage attack). Once installed, the spyware grants total access: messages from encrypted apps (read *after* decryption, defeating end-to-end encryption), microphone and camera activation, location, photos, passwords, and contacts. Because the compromise is invisible and self-deleting, victims rarely know they were targeted without forensic analysis. ## The accountability record The sector is documented almost entirely by independent researchers — principally the University of Toronto's **Citizen Lab** and **Amnesty International's Security Lab** — rather than by governments or the vendors. The watershed was the **Pegasus Project** (July 2021), a journalism consortium investigation built around a leaked list of ~50,000 phone numbers of interest to NSO clients. Documented targets span exactly the categories that matter to this knowledge base: journalists, human-rights defenders, opposition politicians, lawyers, and dissidents. Reporting connected Pegasus to surveillance of associates of murdered Saudi journalist Jamal Khashoggi and of jailed Saudi activist Loujain al-Hathloul, among many others across Mexico, Hungary, India, the Gulf, and Europe. In **November 2021** the U.S. Commerce Department added NSO Group to its **Entity List** (trade blacklist) for acting "contrary to the national security or foreign policy interests" of the United States — a rare and significant sanction against a foreign software firm. A 2023 Biden executive order restricted U.S. government use of commercial spyware that poses counterintelligence or human-rights risks. Yet the industry has proven resilient, rebranding, relocating, and spinning up successors faster than enforcement can track. ## Right-wing-KB relevance Commercial spyware is where the [[Surveillance State]] goes mercenary and global. It hands authoritarian and democratic-backsliding governments alike a turnkey tool for monitoring journalists and crushing opposition — the operational core of *digital authoritarianism* — without needing to build the capability in-house. The cross-border targeting (governments spying on exiles and critics abroad, including on Western soil) makes it a transnational-repression instrument, and the involvement of U.S. investors and the persistent question of which American agencies have tested or bought such tools keeps it directly relevant to domestic accountability debates. It is the privatized, exportable complement to state systems like the [[Great Firewall]]. ## Distinct from neighbors - **[[Surveillance Capitalism]]** — corporate extraction of behavioral data for profit; commercial spyware is *targeted state intrusion* sold as a product, not mass commercial data-harvesting. - **[[Surveillance State]]** — the government apparatus; commercial spyware is the *private vendor* that equips it off-the-shelf. - **Lawful-intercept / wiretap** — court-bound telecom interception; mercenary spyware routinely operates outside any such oversight. - **Stalkerware** — consumer-grade apps for spying on partners; the same idea, vastly less capable, without the state clientele. ## See Also - [[Surveillance State]] - [[Surveillance Capitalism]] - [[Great Firewall]] - [[Spearphishing]] - [[Surveillance Lexicon]] - [[Cybersecurity Lexicon]]