You Can’t Investigate Pegasus Without Becoming Its Next Victim
A European politician set out to do what democratic institutions are supposed to do: investigate abuse of power. Specifically, he joined an EU committee tasked with examining surveillance spyware sold by NSO Group. For his efforts, his phone was hacked with Pegasus spyware — the very tool he was investigating. The attacker was a government customer of NSO Group itself.
This isn’t a plot twist in a thriller. It’s a functional description of how surveillance accountability works right now. And it reveals something more troubling than any single hack: the system is designed so that oversight of Pegasus makes you a target for Pegasus.
The Accountability Trap
Here’s the structural problem. Democratic oversight of surveillance tools requires people to ask uncomfortable questions of governments and their contractors. But those same governments have legal access to Pegasus. The moment you become visible as someone investigating the tool, you become a plausible target for the tool itself.
This isn’t a design flaw that can be patched. It’s a feature of how state-level surveillance operates. According to reporting from Wired, one EU Parliament member called the incident “a direct attack on the rule of law.” That’s precise language. It’s not metaphorical. The rule of law assumes that institutions can investigate power without the investigated party weaponizing that investigation against the investigator. Pegasus, in government hands, breaks that assumption at a fundamental level.
The irony cuts deeper: NSO Group and its defenders argue the tool is designed for legitimate law enforcement. But here we have a government customer using it against someone conducting lawful oversight. So either NSO’s controls are failing (in which case the tool is dangerous), or the controls are working as designed (in which case they’re worse than useless—they’re a façade). There’s no third option that makes this acceptable.
Why Legal Frameworks Can’t Keep Up
The EU has been trying to close the Pegasus loophole. Proposed regulations would restrict spyware sales. But regulatory solutions assume a basic fact that’s no longer true: that the threat to democratic oversight comes from outside the system. When a government can buy the weapon used to suppress oversight of its own power, regulation becomes a game of setting rules that the players are already breaking.
Export controls might help. Transparency mandates might help. But none of these address the core issue: a politician investigating Pegasus can be targeted by Pegasus because governments have a legal license to use it, and no mechanism currently exists to prevent them from using it against their critics.
Photo by Md Ishak Rahman on Unsplash
This is why we keep saying that surveillance tools inevitably escape their stated purpose. Not because vendors are incompetent—they’re not—but because governments are customers with veto power over accountability. Once Pegasus is in a government’s hands, democratic oversight becomes an act of risk assumption.
The Chilling Effect Is Already Working
We don’t need to speculate about what happens next. The message is already sent. Investigating Pegasus is now provably dangerous. Future investigators will know this. Some will step back. Others will take precautions that make their investigation weaker. The surveillance tool doesn’t have to hack many politicians to change the behavior of all of them.
This is the real cost of state-level spyware that escapes institutional control. Not the specific data stolen from one phone, but the paralysis induced across an entire oversight apparatus. When the apparatus knows it can be turned against itself, its work becomes cautious, compromised, or absent.
What Actually Needs to Change
The honest answer: this isn’t fixable at the regulatory level as long as Pegasus exists in its current form. NSO Group can’t build better controls that a determined government won’t circumvent. The EU can’t write rules that governments won’t break behind closed doors. The only functional solution is prohibition.
Not regulation. Not transparency reports. Not promises of “lawful use only.” Prohibition. The tool has proven it cannot coexist with democratic accountability. Selling it to governments, even democracies, creates a structural conflict of interest that will always resolve in favor of the surveillance.
Until that happens, we should be honest about what’s occurring: the people tasked with protecting citizens from surveillance abuse are now targets of the very surveillance they’re investigating. And the system that created this situation has no built-in mechanism to stop it.
—
What to watch: Whether the EU uses this incident to tighten export restrictions on spyware, or whether it becomes just another data point in an endless cycle of “we’re concerned” statements followed by continued sales. The next few months will tell us whether democratic institutions can actually constrain their own surveillance tools, or whether we’re just watching theater.
Related reading on HighTechz
- OpenAI AI regulation strategy captures market, not safety
- AI Voice Cloning and the Consent Crisis in Hollywood
- Geofence Warrants Ruling Threatens Thousands of Cases
Editor’s note: This article was researched and drafted with AI assistance (Claude), edited for accuracy and voice, and reviewed before publication. Source headlines that informed our analysis are linked inline. If you spot a factual error, let us know.
