United States

In May 2019, American tech company WhatsApp discovered that a vulnerability in its messaging app had allowed NSO Group to target over 1,400 mobile phones using Pegasus. With assistance from Citizen Lab, the company identified over 100 cases of targeting of human rights activists and journalists in at least 20 countries. According to WhatsApp, an American number was on the list. Judicial documents of the case mentioned that American citizens were on the list. In the absence of technical analyses, however, it is impossible to know whether the infection was successful. In an unprecedented stance from a major tech company, WhatsApp openly condemned the incident and sued NSO Group in the US for exploiting its platform. Major tech companies such as Microsoft, Google and LinkedIn filed a legal brief in support of WhatsApp's complaint. (In January 2023, the U.S. supreme court decided that WhatsApp could pursue its lawsuit against NSO Group.)

In 2020, Citizen Lab revealed the first known case of Pegasus targeting an American citizen: New York Times journalist Ben Hubbard.

In July 2021, the Pegasus Project identified nearly a dozen foreign numbers of U.S. citizens, including government officials, listed as persons of interest by NSO Group customers. The investigation further revealed that the U.S. number of a U.S. diplomat was on the list (NSO Group said it was "technically impossible" to deploy Pegasus against U.S. numbers). According to the technical analysis of the investigation, it seemed that this number was selected by the government of Morocco (Morocco denied having used Pegasus).

In response to the Pegasus Project, NSA whistleblower Edward Snowden and WhatsApp CEO Will Cathcart each called for a global moratorium on the trade and use of international surveillance technology. So too did 156 civil society organizations and 26 independent experts in a joint open letter to states, as well as UN human rights experts. Amazon Web Services shut down infrastructure and accounts linked to NSO Group. On July 26, four prominent US lawmakers jointly issued a statement calling the Biden administration to take action against surveillance companies following the Pegasus Project. On July 29, the White House spoke with Israeli officials about spyware concerns. In September, then-UN High Commissioner for Human Rights Michelle Bachelet issued a statement to the Committee on Legal Affairs and Human Rights, Parliamentary Assembly Council of Europe, asking states not only to implement a moratorium on the sale and transfer of surveillance technology, but also to “rein in the surveillance industry.

In November 2021, the US government blacklisted NSO Group.

The same month, media outlets reported that Apple had revealed the existence of dozens of new victims around the world, who the company had alerted individually. The tech company also announced that it had filed a lawsuit against NSO Group.

In December 2021, Reuters reported that Apple alerted several US embassy employees in Uganda (11 according to The Washington Post, who confirmed the information) that their iPhones had been hacked using Pegasus in the past months (Ugandan officials did not immediately reply to the journalists).

In January 2022, The New York Times revealed that the U.S. Federal police had obtained Pegasus spyware and that it had once debated with the U.S. Justice Department whether to deploy it for use in domestic law enforcement investigations (the FBI confirmed a few days later, in early February, the purchase of a "limited license" of the spyware, but said there has been "no operational use in support of any investigation" and that it used the software "for product testing and evaluation only"). The Times also revealed that the CIA had purchased a Pegasus license for the government of Djibouti (Djibouti denied and the CIA declined to comment).

In February, the members of the Pegasus Project disclosed that the U.S. Department of Justice had launched a criminal investigation into NSO Group and that a whistleblower had alleged that an NSO Group executive offered “bags of cash” to an US-based mobile security company in exchange for access to a global signaling network used to track mobile phones.

The New Yorker revealed in April that the Biden Administration was investigating “additional targeting of U.S. officials” and was considering banning the purchase or use of foreign commercial spyware by the U.S. government, or others, if it has been “improperly used abroad.”

In June, The Guardian, Haaretz and The Washington Post reported on discussions between a U.S. defense contractor, L3Harris, and NSO Group about a sale of the latter’s surveillance technology. A White House official said that "such a transaction, if it were to take place, raises serious counterintelligence and security concerns for the US government", which led L3Harris to abandon talks to purchase NSO Group’s surveillance technology, as the three media outlets reported in July. According to the New York Times, several sources familiar with the negotiations said that American defense officials once supported L3Harris’ plans to purchase NSO Group.

In September 2022, Jamal Khashoggi’s wife, Hanan Elatr, announced she planned to sue NSO Group as well as the Saudi and Emirati governments in the U.S. over alleged surveillance attempts on her. The Washington Post reported in June 2023 that she had indeed launched a lawsuit in the U.S. against the Israeli firm.

In November 2022, 15 staffers at Salvadoran news outlet El Faro filed a lawsuit against NSO Group in California, the first lawsuit brought by journalists against the Israeli company in the U.S. One of the El Faro staffers to sue the firm is American journalist Roman Gressier, the first US citizen whose phone was infected by Pegasus to sue NSO Group for damages.

The same month, The New York Times reported how close the FBI had come to deploying Pegasus in its criminal investigations – until it decided not to on July 22, 2021, four days after the Pegasus Project was published. Court documents indicated the Bureau remained interested in potentially using spyware in future investigations, the news outlet reported.

In March 2023, the White House announced an executive order to ban the use by the U.S. government of commercial spyware that “poses a risk to national security”. The United States and 10 other countries, including France, Australia, Canada and the United Kingdom, also published a joint statement to counter “the proliferation and misuse of commercial spyware” that month, the first of its kind. Senior U.S. officials also said that at least 50 U.S. government employees in at least 10 countries have had their mobile phones targeted with commercial spyware, a number that was expected to grow as the investigation unfolds (they did not specify which company’s spyware or who had deployed it).

A couple of days later, The New York Times revealed that a company acting as a front for the U.S. government had signed a contract in November 2021 with the American affiliate of NSO Group for a geolocation tool, Landmark, that was intended to be deployed in Mexico. The contract was signed five days only after the White House had blacklisted the Israeli company, and it still appeared to be active, the Times reported.

In 2022, the year after the US Commerce Department had blacklisted the company, NSO Group paid over $1.1 million to public relations companies and law firms in the U.S. for lobbying operations, Open Secrets reported in May 2023. It was more than what the government of Israel spent for its lobbying operations in the U.S. that year.

In June 2023, The Guardian reported that Hollywood producer Robert Simonds and chewing gum heir William “Beau” Wrigley considered acquiring assets of NSO Group. The White House warned that an attempted takeover of the Israeli firm by American buyers could prompt a review of whether the acquisition posed a counterintelligence threat to the U.S.