NEW YORK (AP) — Americans remembered 9/11 on Sunday with tear-choked tributes and pleas to “never forget,” 21 years after the deadliest terror attack on U.S. soil.

The loss still feels immediate to Bonita Mentis, who wore a necklace with a photo of her slain sister, Shevonne Mentis.

“It’s been 21 years, but it’s not 21 years for us. It seems like just yesterday,” she said before reading victims’ names at the World Trade Center to a crowd that included Vice President Kamala Harris and husband Doug Emhoff. Mentis’

At the Pentagon, which also was targeted on 9/11, President Joe Biden vowed that the U.S. would continue working to root out terrorist plots and called on Americans to stand up for “the very democracy that guarantees the right to freedom that those terrorists on 9/11 sought to bury in the burning fire, smoke and ash.” First lady Jill Biden spoke at the third attack site, a field near Shanksville, Pennsylvania.

On Sept. 11, 2001, conspirators from the al-Qaida Islamic terror group seized control of jets to use them as passenger-filled missiles, hitting the trade center’s twin towers and the Pentagon. The fourth plane was headed for Washington but crashed near Shanksville after crew members and passengers tried to storm the cockpit.

The attacks killed nearly 3,000 people, reconfigured national security policy and spurred a U.S. “war on terror” worldwide. Sunday’s observances came little more than a month after a U.S. drone strike killed a key al-Qaida figure who helped plot the 9/11 attacks, Ayman al-Zawahri.

Pierre Roldan, who lost his cousin Carlos Lillo, a paramedic, said “we had some form of justice” when a U.S. raid killed Osama bin Laden in 2011.

“Now that al-Zawahri is gone, at least we’re continuing to get that justice,” Roldan said.

The self-proclaimed mastermind of the attacks, Khalid Shaikh Mohammed, still awaits a long-postponed military tribunal. An attorney for one of Mohammed’s co-defendants this week confirmed ongoing negotiations toward a potential agreement to avoid a trial and impose lesser but still lengthy sentences.

The Sept. 11 attacks stirred — for a time — a sense of national pride and unity for many, while also subjecting Muslim Americans to years of suspicion and bigotry and engendering debate over the balance between safety and civil liberties. In ways both subtle and plain, the aftermath of 9/11 ripples through American politics and public life to this day.

But like some other victims’ relatives, Jay Saloman fears that Americans’ consciousness of 9/11 is receding.

“It was a terrorist attack against our country that day. And theoretically, everybody should remember it and, you know, take precautions and watch out,” said Saloman, who lost his brother, Wayne Saloman.

By tradition, no political figures speak at the ground zero ceremony. The observance centers, instead, on relatives reading aloud the names of the dead.

Like a growing number of readers, firefighter Jimmy Riches’ namesake nephew wasn’t born yet when his relative died. But the boy took the podium to honor him.

“You’re always in my heart. And I know you are watching over me,” he said.

Nikita Shah wore a T-shirt that bore the de facto epigraph of the annual commemoration — “never forget” — and the name of her father, Jayesh Shah. She was 10 when he was killed.

The family later moved to Houston but often returns to New York for the anniversary to be “around people who kind of experienced the same type of grief and the same feelings after 9/11,” said Shah.

Readers often add personal remarks that form an alloy of American sentiments about Sept. 11 — grief, anger, toughness, appreciation for first responders and the military, appeals to patriotism, hopes for peace, occasional political barbs, and a poignant accounting of the graduations, weddings, births and daily lives that victims have missed. A few readers note recent events, this year ranging from the still ongoing coronavirus pandemic to Russia’s war in Ukraine.

Some relatives also lament that a nation which came together — to some extent — after the attacks has since splintered apart. So much so that federal law enforcement and intelligence agencies, which were reshaped to focus on international terrorism after 9/11, now see the threat of domestic violent extremism as equally urgent.

“It took a tragedy to unite us. It should not take another tragedy to unite us again,” said Andrew Colabella, whose cousin, John DiGiovanni, died in the 1993 bombing World Trade Center bombing that presaged 9/11.

Beyond the attack sites, communities around the country marked the day with candlelight vigils, interfaith services and other commemorations. Some Americans joined in volunteer projects on a day that is federally recognized as both Patriot Day and a National Day of Service and Remembrance.

Others observed the anniversary with their own reflections.

More than 70 of Sekou Siby’s co-workers perished at Windows on the World, the restaurant atop the trade center’s north tower. He had the day off because another cook asked him to switch shifts.

The Ivorian immigrant wrestled with how to comprehend such horror in a country where he’d come looking for a better life. And Siby, now president of restaurant workers’ advocacy group ROC United, said ahead of the anniversary that the attacks made him wary of becoming attached to people when “you have no control over what’s going to happen to them next.”

“Every 9/11 is a reminder,” he said, “of what I lost that I can never recover.”

___

Associated Press journalists Colleen Long in Washington and Dave Collins in Hartford, Connecticut, contributed.

The FBI has confirmed that it obtained NSO Group’s powerful Pegasus spyware, suggesting that it bought access to the Israeli surveillance tool to “stay abreast of emerging technologies and tradecraft”.

In a statement released to the Guardian, the bureau said it had procured a “limited licence” to access Pegasus for “product testing and evaluation only”, and suggested that its evaluation of the tool partly related to security concerns if the spyware fell into the “wrong hands”.

The bureau also claimed it had never used Pegasus in support of any FBI investigation. “There was no operational use in support of any investigation, the FBI procured a limited licence for product testing and evaluation only,” it said.

The statement marks a direct acknowledgment by the FBI that it acquired Pegasus, one of the world’s most sophisticated hacking tools.

The FBI’s procurement of Pegasus, which occurred in 2019 under the Trump administration, was first reported by the New York Times.

It was a stunning revelation in part because the Biden administration has recently placed NSO on a commerce department blacklist, saying it had evidence that the company’s hacking tools had enabled governments around the world to conduct “transnational repression”, targeting dissidents and journalists.

The Guardian and other media organisations have reported multiple cases in which security researchers say governments have used NSO’s tools to target American citizens around the world, including Carine Kanimba, the daughter of the jailed Rwandan dissident Paul Rusesabagina, and Lama Fakih, a senior staff member of Human Rights Watch in Beirut.

Once deployed, the user of Pegasus spyware can take complete control of a person’s phone, accessing messages, intercepting phone calls and using the phone as a remote listening device.

A person with close knowledge of the FBI deal, who spoke to the Guardian on the condition of anonymity, claimed that it occurred after a “long process” of negotiations between US officials and NSO.

It is claimed one disagreement centred on how much control NSO would retain over its software. The source claimed that NSO usually kept sensors on its technology so that the company could be alerted in Israel if the technology was moved by a government client.

But the source claimed the FBI did not want the technology to be fitted with sensors that would have allowed NSO to track its physical location.

The source also claimed that the FBI did not want NSO’s own engineers to install the technology and did not want to integrate the spyware into its own systems. Ultimately, it is understood that NSO and the FBI agreed to keep the technology in a large container. NSO did not respond to a request for comment on these claims.

The FBI was also concerned about possible “leakage” of any data to another foreign intelligence service, the source said.

The source claimed the Pegasus licence was acquired by the FBI using a financial “vehicle” that was not easily identified as being linked to the bureau.

The FBI did not respond to specific questions about its alleged concerns, the financial vehicle it used to procure the Pegasus licence, or other details.

In the end, the source claimed, the FBI did not actually use Pegasus. “They weren’t using it at all. Like, not even switching it on. But they kept paying for it, and they wanted to renew. It was a one-year test project and it cost about $5m [£3.7m], and they renewed for another $4m,” the source claimed. “But they didn’t use it.”

In an emailed statement in response to claims about the bureau’s acquisition of Pegasus, the FBI said: “The FBI works diligently to stay abreast of emerging technologies and tradecraft – not just to explore a potential legal use but also to combat crime and to protect both the American people and our civil liberties.

“That means we routinely identify, evaluate, and test technical solutions and problems for a variety of reasons, including possible operational and security concerns they might pose in the wrong hands. There was no operational use in support of any investigation, the FBI procured a limited licence for product testing and evaluation only.”

NSO has categorically denied that its Pegasus spyware can be used against US mobile phones.

Ron Wyden, a Democratic senator from Oregon, the chair of the finance committee and a staunch privacy advocate, said: “The public deserves far more transparency from the executive branch, including the FBI and justice department, about any US government relationships with NSO and other cyber-mercenaries. The public has a particular interest in whether the government believes the use of these tools against Americans is legal.”

The New York Times reported that NSO brought a version of Pegasus to New Jersey in June 2019, after the FBI had reportedly been offered a workaround by NSO that allowed a product called Phantom to “hack any number in the United States”. Without naming sources, the New York Times reported that NSO conducted demonstrations of Phantom to the FBI, which the newspaper said resulted in an alleged “attack” against a US phone number.

In a lawsuit it filed in 2019, WhatsApp accused NSO of sending malware to 1,400 of its users. The company has said about 100 of the individuals who were targeted were members of civil society, including journalists and activists. NSO has said in legal filings that even if WhatsApp’s allegations were true, it was acting as a “foreign agent” when its spyware was deployed against WhatsApp users, because its software is used by foreign governments who are meant to use its spyware to fight crime.

NSO has also said it does not have information about how its clients use its spyware or who its clients target.

WhatsApp has also alleged in court filings that a US phone number was targeted by Pegasus on 9 May 2019. Without providing evidence or sourcing, the New York Times reported that the alleged intrusion on a US number, as described in WhatsApp’s legal case, was in fact a demonstration of NSO’s technology to the FBI.

The FBI declined to comment on the allegation. NSO did not respond to a request for comment.

WhatsApp said: “In all circumstances our priority is to defend our services from threats that would harm people’s ability to safely communicate with one another. We will continue our efforts to hold NSO accountable for their attacks against journalists, human rights activists and government officials in violation of US law. The spyware industry must be prevented from undermining the privacy and security of people in the US and across the world.”

The gag order was issued by Raul Arias Marxuach, the federal judge presiding over the case. The order prohibits parties from expressing themselves outside the judicial process on matters that have not been publicly expressed before the court.

They can only talk about the content of motions and court orders that have been filed publicly.

The judge pointed out that while it was intended to guarantee the accused’s rights to a fair trial, public attention has received the case, which is the second time that someone ruling Puerto Rico has been charged on the island.

“The Protective Order does not protect Vazquez Garcád’s Sixth Amendment rights, as the Court intended. Unsurprisingly, it serves as a sword and shield for the public ministry,” the defense motion said.

“The implicit bias in media coverage in favor of the public ministry, together with a general gag order that barred Vazquez Garcád from responding, constitutes a prior restriction of his First Amendment rights (of the United States Constitution to free expression) and Endangers your Sixth Amendment right to an impartial jury,” he said.

Meanwhile, in a motion filed yesterday, lawyers for Vázquez Garsad defended themselves against Judge Arias Marxuach’s allegations that publicity of the case included his appearance before the media before the federal grand jury charges.

He stressed that “the presence of defense lawyers was the result of widespread leaks and media coverage of an investigation against the governor and reports that the FBI has confiscated his cell phone.”

“Governor Vazquez Garcid has requested the court’s authority to supplement this explanation with a more detailed description of the events that led to the appearance of defense lawyers in the media prior to the charge,” he said.

Vázquez Garçond’s defense arguments against the gag order were first presented by co-defendant Marc Rossini, who raised on August 30 that he was excluded from the disposition of the judge.

In that motion, the defense requested that he be put out of order because “it is detrimental to Mr. Rossini.”

Like Vázquez Garsed, Rossini was concerned that reviews prevailed over motions issued by the federal prosecutor’s office, which in the early stages of the judicial process usually informed the distribution of the discovery of evidence.

“The overwhelming and persistent narrative about Mr. Rossini that has been presented to the jury by the media pertains to the government’s allegations of criminal conduct of Mr. Rossini. The protection order is unconstitutional to the extent necessary to allow Mr. Rossini to obtain a fair trial.” Prevents you from making your defense clear.

In support of his argument, he cited jurisprudence from the Sixth Circuit of Appeals to indicate that “‘a defendant’s interest in fighting the charges and engaging in public adversity is … at its peak’ when ‘the defendant’ Criminally awaiting trial in a controversial case.”

It also said that a false order “which effectively silences a defendant, defeats the purpose of the Sixth Amendment and should not remain in effect.”

Rossini’s defense insisted that his client did not request the order, although media reports “have focused on the allegations against him and are not favorable to him.”

While acknowledging that the gag order was meant to “rescue damage already done,” Rossini’s lawyers say it actually “does more harm than good.”

It added that “the order of protection, by potentially prohibiting Mr Rossini from describing the nature of his defense and claiming his innocence to the press and public without restraint in response to the avalanche of negative media attention, An unfair and potentially unconstitutional restriction on their freedom of expression and should be repealed.”

for its part, The federal prosecutor’s office indicated it “has no objection to suspending the (gag) order for the time being”.,

This was indicated by prosecutor Ryan Crosswell of the United States Department of Justice’s Public Integrity Division in a motion he filed in court yesterday in response to Rossini’s statements.

They acknowledged that before the charges were brought against Vazquez Garsed, Rossini and banker Julio Herrera Velutini, “the defendants had public profiles” and shared concerns about the attention received by the case at “local, national and international” levels. .

However, Crosswell said there are “less restrictive means of addressing the inappropriate public commentary on the matter.” As an example, he highlighted that the Federal District Court for Puerto Rico has “punishments for attorneys who participate in extraordinary statements that violate local regulations”.

He also recalled that there could be a penalty for “any lawyer or defendant disclosing information presented in pursuit of evidence”, as there is a separate court order that governs disclosure of information about evidence provided by the Ministry of Public Affairs. prohibits. Defense.

In addition, he explained that “additional questions may be added to any party negatively affected by another party’s public comment in the jury selection process”, while if “inappropriate additional commentary” arises, the gag order may be suspended. can be restored.

A federal grand jury released on 3 August seven-count indictment Against Vazquez Garced, Herrera Velutini and Rossini. All three face 20 years in prison on charges of conspiracy, bribery and fraud.

In addition to working in the past as an FBI agent, Herrera Velutino is the owner of Bancocredito and Rossini was his advisor.

According to a federal grand jury indictment, the three conspired with Rossini, with the help of Rossini, to obtain contributions from the banker to his gubernatorial campaign in exchange for the then official who removed George Joyner from the office of financial commissioner. Institutions (OCIF) to conclude the audit had detected suspicious transactions in Herrera Velutini’s bank accounts.

There is no doubt that the CIA has been one of the most efficient intelligence agencies in the world. The organization claims to have been working to collect and analyze intelligence to further national security and preempt threats.

However, the agency seems to be focusing more on the domestic affairs of other nations and making efforts to influence their local politics.

Well, Ukrainian President Zelensky has taken a fancy to the CIA’s tactics and its ability to gather information. He has reportedly commissioned the Virginia-based organization to gather information on the voices being raised against him and has asked the American organization to compile a list.

Zelensky reportedly runs an organization known as Mirotvorets, which is a state-run unit under Ukraine’s Security Service that produces a list of people and organizations deemed to be “Enemies Of Ukraine.”

Source: Wikipedia

Mirotvorets is essentially a list that is made public and targets anti-Zelensky voices. The names of those on the list are declared to be those of the regime’s enemies, and an unofficial death warrant is issued for them.

A government-backed organization like Mirotvorets that produces a list of people whom they proclaim “Anti-Ukrainians” should not be a part of a healthy democracy, as it motivates illegal groups to promote violence without the need for legal action, something we are sure that Mr Zelensky would like.

And well, news of the organization’s having ties with the CIA has now come to light. The Ukrainian Myrotvorets website lists “Langley, VA, USA” as a partner in the effort to track down dissidents and murder them, and guess what? – Langley is home to the CIA headquarters.

The biggest intelligence agency in the world is assisting a petty regime to track down innocents. That is exactly what the organization has been limited to under Biden’s rule.

Also, it would not be the first time that the CIA has involved itself in list-making ventures.  In 1990, The Washington Post reported the agency “supplied the names of thousands of members of the Indonesian Communist Party to the army in Jakarta, which at the time was hunting down the leftists and killing them in a crackdown branded as one of the century’s worst massacres” in 1965.

The late investigative journalist, William Blum, wrote in his book “Killing Hope” that the CIA has assassinated or attempted to assassinate leaders in China, India, Panama, Zaire (then the Congo), Haiti, Cuba, and numerous other countries.

Therefore, it makes perfect sense that the incompetent intelligence services of Ukraine would need a far more experienced agency like the CIA to do its dirty work, and what is shocking is that Biden in actuality approved it.

Zelensky is essentially going after anyone who criticizes his regime. He previously targeted Ukrainian journalist Sonya Lukashova, who later ended up on the notorious Mirotvorets website in the aftermath of her authoring an article that claimed the data on Russian military rape allegations produced by the country’s former human rights chief, Lyudmila Denisova, were false.

The regime is accusing the Russians of war crimes, while on the contrary, reports from reputed international agencies portray a different opinion.

“A report from human rights watchdog Amnesty International claims the Ukrainian military is guilty of the widespread use of tactics that constitute war crimes, including using populated residential areas, schools, and hospitals as de facto military bases,” the Washington Examiner reported on August 4.

So, to sum up, the whole scenario, Zelensky is using a foreign agency to compile lists for him so it becomes easier for him to kill individuals from his own country. Well, isn’t that convenient? Or maybe it’s the norm in the Zelensky era.

Donald Trump’s non-stop drive to paint the FBI raid on Mar-a-Lago to recover classified documents as a political witch hunt is drawing rebukes from ex-justice department and FBI officials who warn such attacks can spur violence and pose a real threat to the physical safety of law enforcement.

But the concerns have not deterred Republican House minority leader Kevin McCarthy and other Trump allies from making inflammatory remarks echoing the former US president.

Related: Mar-a-Lago a magnet for spies, officials warn after nuclear file reportedly found

The unrelenting attacks by Trump and loyalists such as McCarthy, senator Lindsey Graham, Steve Bannon and false conspiracy theorist Alex Jones against law enforcement have continued despite strong evidence that Trump kept hundreds of classified documents illegally.

Before the 8 August raid, Trump and his attorneys stonewalled FBI and US National Archives requests for the return of all classified documents and did not fully comply with a grand jury subpoena in a criminal probe of Trump’s hoarding of government documents.

The FBI search of Trump’s Mar-a-Lago home and club recovered 33 boxes with over 100 classified documents, adding to the 200 classified records Trump had earlier returned in response to multiple federal requests.

Trump’s high decibel attacks on law enforcement officials for trying to recover large quantities of classified documents including some that reportedly had foreign nuclear secrets was palpable in Pennsylvania recently when Trump at a political rally branded the FBI and justice department “political monsters” and labelled president Joe Biden “an enemy of the state”.

The day before in Pennsylvania, to coincide with a major Biden speech about threats to democracy posed by Trump and some of his allies, McCarthy mimicked Trump’s high decibel attacks on the court-approved FBI raid by calling it an “assault on democracy”.

Former law enforcement officials and scholars warn that using such conspiratorial rhetoric impugning the motives and actions of justice department and the FBI runs the risk of inciting threats of violence and actual attacks, fears that have already been proven warranted.

Consider Trump supporter Ricky Shiffer, who posted angry messages about the Mar-a-Lago raid on Trump Social, and then on 12 August armed himself with an assault rifle and attacked an FBI office in Cincinnati. After fleeing the scene he was hunted down and killed by police.

In another sign of potential violence, federal judge Bruce Reinhart in Florida, who had approved the FBI warrant to search Mar-a-Lago, reportedly received death threats after his name was cited in press accounts.

“I have been dealing with law enforcement and the criminal justice system for close to 40 years. I have never seen the type or virulence of attacks being made every day against the FBI, DoJ lawyers, and judges,” former justice department inspector general Michael Bromwich told the Guardian. “It’s a chorus led by Trump but that includes elected officials at every level. It is dangerous and unacceptable.”

Bromwich added: “It’s one thing for professional rabble rousers, liars, and nihilists – such as Bannon and Jones – to attack law enforcement and DoJ in the way that they have since the search; it’s quite another for so-called respectable political figures such as McCarthy and Graham to do so. Their recent actions and words reflect that theirs is a politics detached from facts and principle.”

Similarly, Chuck Rosenberg, a former US attorney for the sastern district of Virginia and ex-chief of staff to former FBI director James Comey, told the Guardian: “The attacks on federal law enforcement are sickening and reckless.”

FBI searches former US President Donald Trump’s Mar-a-Lago residence. Photograph: Jim Rassol/EPA

To historian Ruth Ben-Ghiat, who has studied authoritarian leaders and wrote the book Strongmen, Trump’s attacks on the FBI and justice department and his retention of classified documents are consistent with his “authoritarian” leadership style

“It’s very typical of authoritarians to claim that they’re the victims and that there are witch hunts against them,” Ben-Ghiat told the Guardian.

Trump’s furious assaults on law enforcement also targeted the National Archives and Records Administration, causing a notable uptick in threats against the agency, according to sources quoted by the Washington Post.

“No NARA official involved in negotiating the return of presidential records from Mar-a-Lago would have acted with any motive other than to ensure the safe return of all of the presidential records back into the custody of the government,” said Jason R Baron, the former director of litigation at the US National Archives. “It is unfortunate that some would impugn the motives of NARA staff in simply doing their job.”

The frenzied attacks on law enforcement began almost immediately after the raid and included some especially rabid Trump supporters.

The entrance to the FBI headquarters in Cincinnati, that was attacked by Ricky Shiffer Photograph: Liz Dufour/AP

Former White House adviser Bannon, who has been convicted on two counts of criminal contempt of Congress for defying a subpoena from the House January 6 panel, made unsupported claims to conspiracy monger Jones on Infowars that the FBI planted evidence against Trump during the Mar-a-Lago raid, and that the “deep state” is planning to kill Trump.

“I do not think it’s beyond this administrative state and their deep state apparatus to actually try to work on the assassination of President Trump,” said Bannon, who on 8 September was charged by New York prosecutors with fraud, money laundering and conspiracy involving his role in a private fundraising scheme to fund constructing the US-Mexico border wall.

Right before he left office, Trump pardoned Bannon who had been indicted on similar federal charges involving fraud and the border wall.

Graham provoked heavy criticism for making the suggestion in a Fox News interview that the FBI raid and investigation would lead to “riots in the street”, if charges were filed against Trump.

After critics noted Graham’s comments could fuel violence, Graham doubled down a week later saying he was just trying to “state the obvious”.

In a twist, some veteran justice department prosecutors point out that predictions of violence can potentially be criminal.

“The risk is that predictions of violence can easily become threats of violence bordering on extortion,” former justice department prosecutor Paul Rosenzweig told the Guardian. “Explicitly calling for violence against the government can, in context, become criminal. When Trump loyalists like Bannon and Graham seem to cross that line, they are risking criminal prosecution.”

On another front, even some former close allies of Trump say that his shifting and hard edged attacks on law enforcement look desperate and don’t pass the smell test.

William Barr, Trump’s former attorney general who formerly was a close ally, told Fox News on 2 September he didn’t see any reason why classified documents were at Mar-a-Lago once Trump left office.

“People say this was unprecedented,” Barr told Fox News “But it’s also unprecedented for a president to take all this classified information and put them in a country club, okay?”

Donald Trump supporters walk down Southern Blvd to protest the FBI raid at Mar-a-Lago. Photograph: Joe Cavaretta/AP

To historian Ben-Ghiat, the fact that “Trump had those classified documents and they were mixed in with golf balls and family photos is very typical of authoritarian type leaders who don’t recognize any divides between public and private. Everything is theirs to trade, to sell and to use as leverage.”

For Bromwich, the attacks on law enforcement by Trump and his ardent allies is unprecedented and very dangerous.

“For those of us who have spent time with federal law enforcement personnel, the idea that they are members of the deep state or doing the bidding of the radical left is ridiculous. In my experience, the majority are conservative and Republican. Whatever their politics, they don’t let their political views affect their work.”

“The search of Mar-a-Lago was indeed unprecedented. It was preceded by an unprecedented and colossal theft of government property by the former president.”

Source

NSO Group’s Pegasus spyware can turn any infected smartphone into a remote microphone and camera, spying on its own owner while also offering the hacker – usually in the form of a state intelligence or law enforcement agency – full access to files, messages and, of course, the user’s location.

Pegasus is one of a number of proprietary tools sold as part of the hacker-for-hire industry – and one found at the very high-end of that dark market. Other companies offer less expensive services – for example, only providing geolocation services for its clients.

“Netanyahu bet everything on Trump”: Inside Israel’s Iran bind. LISTEN

<<< The NSO File: A Complete (Updating) List of Individuals Targeted With Pegasus Spyware >>>

So how can you protect yourself? And how can you check to see if your phone has been targeted in the past or is infected now?

Haaretz offers a simple, nontechnical explanation on how to check and stay safe…

The weakest link

Most cellphone spyware operates in a similar fashion: a message is sent to a phone with a nefarious message. The message usually contains a link that will either download the malware onto your device directly, or refer it to a website that will prompt a download – all unbeknown to the phone’s owner.

There are other ways to get your phone to download something that don’t involve a message. However, from the moment of infection, most spyware tools follow a similar protocol: once installed, the spyware contacts what is called a “command-and-control” server, which provides it with instructions remotely.

“Let’s say the Israel Police are the ones who installed Pegasus on your smartphone and they want to know where you – or, more precisely, your phone – has been in the previous 24 hours. To get that information, instructions to obtain that data are sent to a C&C server connected to the phone,” explains Dr. Gil David, a researcher and cybersecurity consultant.

The best way to stay safe, any cybersecurity expert will tell you, is to never – ever! – open any link sent to you, unless it’s a link you are expecting from someone you know and trust.

The reason is that, once infected, “the C&C server communicates between the hacker and the spyware installed on your phone. Without it, the hacker has no way of relaying instructions to Pegasus, and Pegasus has no way to get information from the victim’s phone back to the hacker,” David writes in Haaretz Hebrew.

Many times, the links sent to you will appear innocent. It may look like a message from the Post Office or Amazon. But don’t be fooled: Through some simple social engineering and a process called “DNS spoofing,” even an official-looking URL may be a trap.

Double zero

Sadly, staying safe is not always possible.

What makes Pegasus so expensive is its ability to not just potentially infect any smartphone selected for targeting remotely, but to do so with a “zero click” infection. This means your phone can be infected without you even having to click on a link – for example, with the code instructing your phone to reach out to the server secretly encoded into a WhatsApp message or even in a file like a photo texted to you via iMessage.

These “zero click” attacks make use of what is called “zero-day” exploits: unknown loopholes in your phone’s defenses that allow these hidden bits of code to kick into action without the victim doing anything.

So, another good practice is to make sure your phone’s operating system is as updated as possible: As new exploits are discovered, they are quickly “patched” by the likes of Apple and Google.

According to digital forensics experts Amnesty International and Citizen Lab, Pegasus’ zero click infections have only been found on iPhones. “Most recently, a successful ‘zero-click’ attack has been observed exploiting multiple zero-days to attack a fully patched iPhone 12 running iOS 14.6 in July 2021,” Amnesty notes in its instructive report “How to Catch NSO Group’s Pegasus.”

It seems Pegasus’ ability to infect iPhones was based on a previously unknown loophole in the iMessage service, and this too has subsequently been patched. However, other Israel firms, for instance QuadDream, reportedly have such abilities as well.

“From 2019, an increasing amount of vulnerabilities in iOS, especially iMessage and FaceTime, started getting patched thanks to their discoveries by vulnerability researchers, or to cybersecurity vendors reporting exploits discovered in-the-wild,” Amnesty writes – so make sure your phone is updated.

Indicators of compromise

Groups like Amnesty and Citizen Lab find NSO’s spyware on phones using two different methods. Both involve searching for what is termed “indicators of compromise,” or IOCs.

Amnesty maintains a database of nefarious domains used by NSO’s clients. The list is constantly updating as more bogus URLs are found. Citizen Lab, meanwhile, also maintains a database of so-called vectors: messages sent to victims containing nefarious code or URLS. The two groups each maintain updated lists of Pegasus’ related processes that together permit attribution.

The only thing that has changed with Pegasus over the years is the way your phone is referred to the server, and the way the so-called payload is delivered.

“While SMS messages carrying malicious links were the tactic of choice for NSO Group’s customers between 2016 and 2018, in more recent years they appear to have become increasingly rare,” Amnesty wrote in its July 2021 report.

The newer trend, discovered in the case of Moroccan journalist Omar Radi, who was infected with Pegasus in 2020, is what is known as “packet injection.” This means that the download order is delivered not through a message but instead through your network, in the form of a hidden command “injected” into the phone through what Amnesty describes as “tactical devices, such as rogue cell towers, or through dedicated equipment placed at the mobile operator.

“The discovery of network injection attacks in Morocco signaled that the attackers’ tactics were indeed changing. Network injection is an effective and cost-efficient attack vector for domestic use especially in countries with leverage over mobile operators,” it explained.

As NSO’s clients are state agencies, they can easily make use of the mobile infrastructure to infect phones.

Therefore, and though such injection infections can also be forced upon you, other good practices include never using free Wi-Fi; never connecting to wireless networks you do not absolutely know are secure – as these networks can easily be hacked so they infect your phone and refer it to the snooping server. Not using so-called VPNs is also advisable for the same reason.

Get checked, get vaccinated

Chances are you have not been infected with Pegasus. However, if you have cause for concern and are scared you are or were infected, there are a few options:

Amnesty offers a useful, free and open source tool called the Mobile Verification Toolkit that can check a backup of your device or its logs for any IOC. The MVT will scan your iPhone’s logs for Pegasus-related processes or search your Android’s messages for nefarious links.

The tool can be downloaded here. The bad news is that it requires some technical know-how and is currently devoid of a simple-to-use interface.

To get it to work, you first need to make a specific type of backup of your phone, and then you need to download the program and run the code on your computer so it can scan the file you created.

Running the program requires you to download Python. Luckily, the tool comes with very clear instructions, and even those unskilled in code can make use of it with a bit of effort. Furthermore, it also allows you to conduct the test yourself.

A similar product is iMazing, a phone-backup platform that runs on your desktop and provides a MVT-like analysis of your device. It does not prevent infections but can check your phone for IOCs.

If the best offense is defense, there’s also a growing cellphone security market. Cyberdefense firms like ZecOps offer organizations like the BBC and Fortune 2000 companies a platform that inspects phones for current infections or traces of historic attacks. ZecOps also provides this service pro bono for journalists involved in the Pegasus Project.

Private users can also buy such services. For example, the Israeli-Indian security firm SafeHouse Technologies offers an app called “BodyGuard” that provides defenses for your phone, for a small price. It already has more than a million users, mostly in India.

If you can’t get the Mobile Verification Toolkit to work and are reluctant to use an app, and you genuinely fear you have been targeted, you can also drop us a tip here and we at Haaretz will get you checked.

In Israel’s legislature, Arab politicians are leading a modest movement to examine the state’s relationship with NSO. The Arab party leader Sami Abou Shahadeh told me, “We tried to discuss this in the Knesset twice . . . to tell the Israeli politicians, You are selling death to very weak societies that are in conflict, and you’ve been doing this for too long.” He added, “It never worked, because, first and morally, they don’t see any problem with that.” Last fall, an investigation by the watchdog group Front Line Defenders identified Pegasus infections on the phones of six Palestinian activists—including one whose Jerusalem residency status had been revoked. Abou Shahadeh argued that the history of Israel’s spyware technology is tied to the surveillance of Palestinian communities in the West Bank, East Jerusalem, and Gaza. “They have a huge laboratory,” he told me. “When they were using all the same tools for a long time to spy on Palestinian citizens, nobody cared.” Asked about the targeting of Palestinians, Hulio said, “If Israel is using our tools to fight crime and terror, I would be very proud of it.”

“I know there have been misuses,” Hulio said. “It’s hard for me to live with that. And I obviously feel sorry for that. Really, I’m not just saying that. I never said it, but I’m saying it now.” Hulio said that the company has turned down ninety customers and hundreds of millions of dollars of business out of concern about the potential for abuse. But such claims are difficult to verify. “NSO wanted Western Europe mainly so they can tell guys like you, Here’s a European example,” the former Israeli intelligence official, who now works in the spyware sector, said. “But most of their business is subsidized by the Saudi Arabias of the world.” The former employee, who had knowledge of NSO’s sales efforts, said, “For a European country, they would charge ten million dollars. And for a country in the Middle East they could charge, like, two hundred and fifty million for the same product.” This seemed to create perverse incentives: “When they understood that they had misuse in those countries that they sold to for enormous amounts of money, then the decision to shut down the service for that specific country became much, much harder.”

Asked about the extreme abuses ascribed to his technology, Hulio invoked an argument that is at the heart of his company’s defense against WhatsApp and Apple. “We have no access to the data on the system,” he told me. “We don’t take part in the operation, we don’t see what the customers are doing. We have no way of monitoring it.” When a client buys Pegasus, company officials said, an NSO team travels to install two racks, one devoted to storage and another for operating the software. The system then runs with only limited connection to NSO in Israel.

But NSO engineers concede that there is some real-time monitoring of systems to prevent unauthorized tampering with or theft of their technology. And the former employee said, of Hulio’s assurances that NSO is technically prevented from overseeing the system, “That’s a lie.” The former employee recalled support and maintenance efforts that involved remote access by NSO, with the customer’s permission and live oversight. “There is remote access,” the former employee added. “They can see everything that goes on. They have access to the database, they have access to all of the data.” The senior European law-enforcement official told me, “They can have remote access to the system when we authorize them to access the system.”

NSO executives argue that, in an unregulated field, they are attempting to construct guardrails. They have touted their appointment of a compliance committee, and told me that they now maintain a list of countries ranked by risk of misuse, based on human-rights indicators from Freedom House and other groups. (They declined to share the list.) NSO also says that customers’ Pegasus systems maintain a file that records which numbers were targeted; customers are contractually obligated to surrender the file if NSO starts an investigation. “We have never had a customer say no,” Hulio told me. The company says that it can terminate systems remotely, and has done so seven times in the past few years.

The competition, Hulio argued, is far more frightening. “Companies found themselves in Singapore, in Cyprus, in other places that don’t have real regulation,” he told me. “And they can sell to whoever they want.” The spyware industry is also full of rogue hackers willing to crack devices for anyone who will pay. “They will take your computers, they will take your phone, your Gmail,” Hulio said. “It’s obviously illegal. But it’s very common now. It’s not that expensive.” Some of the technology that NSO competes with, he says, comes from state actors, including China and Russia. “I can tell you that today in China, today in Africa, you see the Chinese government giving capabilities almost similar to NSO.” According to a report from the Carnegie Endowment for International Peace, China supplies surveillance tools to sixty-three countries, often through private firms enmeshed with the Chinese state. “NSO will not exist tomorrow, let’s say,” Hulio told me. “There’s not going to be a vacuum. What do you think will happen?”

NSO is also competing with Israeli firms. Large-scale hacking campaigns, like the one in Catalonia, often use tools from a number of companies, several founded by NSO alumni. Candiru was started in 2014, by the former NSO employees Eran Shorer and Yaakov Weizman. It was allegedly linked to recent attacks on Web sites in the U.K. and the Middle East (Candiru denies the connection), and its software has been identified on the devices of Turkish and Palestinian citizens. Candiru has no Web site. The firm shares its name with a parasitic fish, native to the Amazon River basin, that drains the blood of larger fish.

QuaDream was founded two years later, by a group including two other former NSO employees, Guy Geva and Nimrod Reznik. Like NSO, it focusses on smartphones. Earlier this year, Reuters reported that QuaDream had exploited the same vulnerability that NSO used to gain access to Apple’s iMessage. QuaDream, whose offices are behind an unmarked door in the Tel Aviv suburb of Ramat Gan, appears to share with many of its competitors a reliance on regulation havens: its flagship malware, Reign, is reportedly owned by a Cyprus-based entity, InReach. According to Haaretz, the firm is among those now employed by Saudi Arabia. (QuaDream could not be reached for comment.)

Other Israeli firms pitch themselves as less reputationally fraught. Paragon, which was founded in 2018 by former Israeli intelligence officials and includes former Prime Minister Ehud Barak on its board, markets its technology to offices within the U.S. government. Paragon’s core technology focusses not on seizing complete control of phones but on hacking encrypted messaging systems like Telegram and Signal. An executive told me that it has committed to sell only to a narrow list of countries with relatively uncontroversial human-rights records: “Our strategy is to have values, which is interesting to the American market.”

In Catalonia, Gonzalo Boye, an attorney representing nineteen people targeted by Pegasus, is preparing criminal complaints to courts in Spain and other European countries, accusing NSO, as well as Hulio and his co-founders, of breaking national and E.U. laws. Boye has represented Catalan politicians in exile, including the former President Carles Puigdemont. Between March and October of 2020, analysis by the Citizen Lab found, Boye was targeted eighteen times with text messages masquerading as updates from Twitter and news sites. At least one attempt resulted in a successful Pegasus infection. Boye says that he now spends as much time as possible outside Spain. In a recent interview, he wondered, “How can I defend someone, if the other side knows exactly everything I’ve said to my client?” Hulio declined to identify specific customers but suggested that Spain’s use of the technology was legitimate. “Spain definitely has a rule of law,” he told me. “And if everything was legal, with the approval of the Supreme Court, or with the approval of all the lawful mechanisms, then it can’t be misused.” Pere Aragonès, the current President of Catalonia, told me, “We are not criminals.” He is one of three people who have served in that role whose phones have been infected with Pegasus. “What we want from the Spanish authorities is transparency.”

Last month, the European Parliament formed a committee to look into the use of Pegasus in Europe. Last week, Reuters reported that senior officials at the European Commission had been targeted by NSO spyware. The investigative committee, whose members include Puigdemont, will convene for its first session on April 19th. Puigdemont called NSO’s activities “a threat not only for the credibility of Spanish democracy, but for the credibility of European democracy itself.”

NSO Group also faces legal consequences in the U.K.: three activists recently notified the company, as well as the governments of Saudi Arabia and the U.A.E., that they plan to sue over alleged abuses of Pegasus. (The company responded that there was “no basis” for their claims.)

NSO continues to defend itself in the WhatsApp suit. This month, it filed an appeal to the U.S. Supreme Court. “If we need to go and fight, we will,” Shmuel Sunray, NSO’s general counsel, told me. Lawyers for WhatsApp said that, in their fight with NSO, they have encountered underhanded tactics, including an apparent campaign of private espionage.

On December 20, 2019, Joe Mornin, an associate at Cooley L.L.P., a Palo Alto law firm that was representing WhatsApp in its suit against NSO, received an e-mail from a woman who identified herself as Linnea Nilsson, a producer at a Stockholm-based company developing a documentary series on cybersecurity. Nilsson was cagey about her identity but so eager to meet Mornin that she bought him a first-class plane ticket from San Francisco to New York. The ticket was paid for in cash, through World Express Travel, an agency that specialized in trips to Israel. Mornin never used the ticket. A Web site for the documentary company, populated with photos from elsewhere on the Internet, soon disappeared. So did a LinkedIn profile for Nilsson.

Several months later, a woman claiming to be Anastasia Chistyakova, a Moscow-based trustee for a wealthy individual, contacted Travis LeBlanc, a Cooley partner working on the WhatsApp case, seeking legal advice. The woman sent voice-mail, e-mail, Facebook, and LinkedIn messages. Mornin identified her voice as belonging to Nilsson, and the law firm later concluded that her e-mail had come from the same block of I.P. addresses as those sent by Nilsson. The lawyers reported the incidents to the Department of Justice.

The tactics were similar to those used by the private intelligence company Black Cube, which is run largely by former officers of Mossad and other Israeli intelligence agencies, and is known for using operatives with false identities. The firm worked on behalf of the producer Harvey Weinstein to track women who had accused him of sexual abuse, and last month three of its officials received suspended prison sentences for hacking and intimidating Romania’s chief anti-corruption prosecutor.

Black Cube has been linked to at least one other case involving NSO Group. In February, 2019, the A.P. reported that Black Cube agents had targeted three attorneys involved in another suit against NSO Group, as well as a London-based journalist covering the case. The lawyers—Mazen Masri, Alaa Mahajna, and Christiana Markou—who represented hacked journalists and activists, had sued NSO and an affiliated entity in Israel and Cyprus. In late 2018, all three received messages from people who claimed to be associated with a rich firm or individual, repeatedly suggesting meetings in London. NSO Group has denied hiring Black Cube to target opponents. However, Hulio acknowledged the connection to me, saying, “For the lawsuit in Cyprus, there was one involvement of Black Cube,” because the lawsuit “came from nowhere, and I want to understand.” He said that he had not hired Black Cube for other lawsuits. Black Cube said that it would not comment on the cases, though a source familiar with the company denied that it had targeted Cooley lawyers.

“People can survive and can adapt to almost any situation,” Hulio once told me. NSO Group must now adapt to a situation in which its flagship product has become a symbol of oppression. “I don’t know if we’ll win, but we will fight,” he said. One solution was to expand the product line. The company demonstrated for me an artificial-intelligence tool, called Maestro, that scrutinizes surveillance data, builds models of individuals’ relationships and schedules, and alerts law enforcement to variations of routine that might be harbingers of crime. “I’m sure this will be the next big thing coming out of NSO,” Leoz Michaelson, one of its designers, told me. “Turning every life pattern into a mathematical vector.”

The product is already used by a handful of countries, and Hulio said that it had contributed to an arrest, after a suspect in a terrorism investigation subtly altered his routine. The company seemed to have given little consideration to the idea that this tool, too, might spur controversy. When I asked what would happen if law enforcement arrested someone based on, say, an innocent trip to the store in the middle of the night, Michaelson said, “There could be false positives.” But, he added, “this guy that is going to buy milk in the middle of the night is in the system for a reason.”

Yet the risk to bystanders is not an abstraction. Last week, Elies Campo decided to check the phones of his parents, scientists who are not involved in political activities, for spyware. He found that both had been infected with Pegasus when he visited them during the Christmas holiday in 2019. Campo told me, “The idea that anyone could be at risk from Pegasus wasn’t just a concept anymore—it was my parents sitting across the table from me.” On his mother’s phone, which had been hacked eight times, the researchers found a new kind of zero-click exploit, which attacked iMessage and iOS’s Web-browsing engine. There is no evidence that iPhones are still vulnerable to the exploit, which the Citizen Lab has given the working name Homage. When the evidence was found, Scott-Railton told Campo, “You’re not going to believe this, but your mother is patient zero for a previously undiscovered exploit.”

During a recent visit to NSO’s offices, windows and whiteboards across the space were dense with flowcharts and graphics, in Hebrew and English text, chronicling ideas for products and exploits. On one whiteboard, scrawled in large red Hebrew characters and firmly underlined, was a single word: “War!” ♦

Georgia Gee conducted additional research for this piece.

An earlier version of this story misstated the time of a Pegasus infection on a device connected to the network at 10 Downing Street.