NANDO VILA: The Sinaloa Cartel is one of the most powerful criminal organizations in the world. Its drug distribution reaches dozens of countries through a network of hundreds of thousands of people, and yields an estimated annual profit of $3 billion.1

Since the 2014 arrest of its leader, Joaquin Guzman, also known as El Chapo, there has been a continuing battle between two divisions of the Cartel, for control over the organization.2

MEDIA CLIP: The Mexican city in the Northwest heartland of the Sinaloa Cartel has descended into a battleground.3

ROSE REID: Javier Valdez, a journalist based in Mexico was reporting on this feud when he was shot in 2017 near his newsroom. He was 50 years old.

MEDIA CLIP: He was one of the most revered journalists in Mexico. Javier Valdez’s murder, just one block from his office, has shocked the journalist community.4

NANDO: Reporting on drug cartels and corruption is a dangerous occupation in Mexico – Javier Valdez was one of 81 journalists and media workers who have been killed in the country in the past decade.5

On the other side of the Atlantic Ocean, two journalists based in Paris, Sandrine Rigaud and Laurent Richard, together with their colleagues at Forbidden Stories, have taken up the work of slain journalists

ROSE: Like Javier Valdez.

LAURENT RICHARD: I’m Laurent Richard. I’m the founder and the executive director of Forbidden Stories. Forbidden Stories is a nonprofit – our main mission is very simple. We are continuing the work of assassinated under threat or jailed reporters.

ROSE: Laurent believes that killing the journalist does not kill the story. The Forbidden Stories newsroom is unique in the world of journalism.

SANDRINE RIGAUD: My name is Sandrine Rigaud. I’m a French investigative journalist. I live in Paris. Forbidden Stories is a consortium of international journalists, which mission is to pursue the work of journalists who are killed or threatened or jailed. We started at Forbidden Stories coordinating the Cartel Project.

NANDO: For years Forbidden Stories focused on “the Cartel Project,” continuing the work of journalists whose reporting on drug cartels in Mexico had been disrupted by threats, imprisonment or – their murder.

LAURENT: We were continuing the work of a Mexican journalist who was killed. We were in the last phase of that. And in the meantime, we were given access to a list, a list of phone numbers that were the phone numbers of persons of interest who were selected as a potential target from NSO customers.

ROSE: One day in the summer of 2020 – Laurent and Sadrine received a list from an undisclosed source – it was a seemingly endless list of phone numbers – thousands of phone numbers…

LAURENT: We have access to 50,000 phone numbers of 50,000 person all over the world in many countries.

SANDRINE: The list of 50,000 numbers was really the beginning of the Pegasus project.

NANDO: 50,000 phone numbers. Based on information from the source, Sandrine and Laurent believed there could be a connection between the numbers on this list and Pegasus.

ROSE: The 50,000 cell phone numbers were concentrated in countries known to surveil their citizens and also known to have been clients of NSO Group.

NANDO: Who were these people? Why were they “persons of interest?” Laurent and Sandrine tried to make sense of it – the first thing they did was cross check the numbers with their own contact lists to see if they could identify any of the numbers.

SANDRINE: I used to be a political journalist in France so in my phone I had the contact of many French political people and so the first thing I did was to try to find out who among the people I was in contact with and I had the phone of had been potentially targeted, and surprisingly we found that some French political names popped up. It was kind of weird because we were not expecting that. We knew that Pegasus had been used in Mexico, we knew about Moroccan victims but we had never heard of French political victims.

We gathered all the numbers of political personalities in France and then cross-checked them with the list. And at that moment we realized that what we started to see in my phone was actually quite massive.

And we discovered the name of Emmanuel Macron. It was incredible, I mean nobody had suspected that.

ROSE: The Phone number of Emmanuel Macron – the president of France – was on the list.

LAURENT: A scoop like that is happening once in your life as a journalist. And for me and for Sandrine, it was the beginning of the largest and the most maybe complicated investigation.

SANDRINE: This was going to be a huge story and a much more dangerous story than even what we were thinking.

LAURENT: We were very concerned about our safety, the safety of our communication, because we were investigating these countries who was surveilling, and who can spend millions in targeting you. The first fear that we were having, Sandrine and I, were to be the next one on the list and to be surveilled.

SANDRINE: I mean you start reading about Pegasus and then as journalists, imagine you get the list of 50,000 phone numbers. And, you realize that your worst nightmare is there in a list and that indeed it doesn’t only concern Javier Valdez but hundreds of other journalists and journalists nobody has even heard of, on such a massive scale. It was frightening. It was frightening.

CARLOS DADA: They have all my photos, they have all my videos, they have the photos of my dear ones.

JOHN SCOTT-RAILTON: Many people are relieved to learn that they have been hacked. I think for a lot of people it is also clarity and truth in a scenario where those things are hard to come by.

ROSE: This is Shoot the Messenger, a biweekly investigative reporting podcast from EXILE Content Studio.

Every season, we investigate one international news story. You may have heard the headlines; this is the deep dive. I’m Rose Reid.

NANDO: And I’m Nando Vila. When Rose and I started reporting on this project we had one question: what is the biggest threat to journalists today?

When we put up a bulletin board and stuck a pin for every journalist threatened or assassinated in the past 5 years, we found one repeating link over and over. From Mexico, to DC, to the United Arab Emirates: Pegasus.

Over the course of ten episodes, we’re doing a special partnership with the Committee to Protect Journalists for our first season, “Espionage, Murder, and Pegasus Spyware.”

DANA PRIEST: Since we did the Pegasus Project, the circle of people that we now know were infected by Pegasus is five times greater than the one that we absolutely knew when we wrote the stories.

BILL MARCZAK: Researchers can extract that file and then look for telltale signs of Pegasus or other sorts of behaviors which might be indicative of spyware.

HANAN ELATR: I did not know, as a normal public individual, how much they have a technology to get them into my communications with my husband, Jamal Khashoggi.

AMITAI ZIV: I was a partner in the Pegasus Project, which is a project run by Forbidden Stories in France and included journalists all around the world that were jointly investigating NSO.

ROSE: On this series we have featured journalists and stories connected to the “Pegasus Project,” a global consortium of journalists who have reported on breaking news featuring Pegasus and the NSO Group.

Laurent and Sandrine created the Pegasus Project to help sift through the phone numbers and decipher if any of them were targeted by Pegasus. They enlisted the help of 80 reporters from 17 media organizations in 10 different countries.

They timed their first publications to be released simultaneously in July of 2021:

MEDIA CLIP: 17 media organizations that investigated the Israeli cyber surveillance company NSO Group… The biggest spying scandal in cyber history… A list of more than 50,000 phone numbers includes activists, journalists… Pegasus spyware, should we be afraid? Nobody is safe at this time…6

NANDO: A thousand people have been identified from this list of leaked data.

Of the identities that could be confirmed, there were – members of Arab royal families, 65 business executives, 85 human rights activists, 189 journalists, and 600 government officials and politicians – spread across more than 50 countries.7

That included:

• The prime minister of Pakistan, the former prime minister of Belgium, and the inner circle of the Dalai Lama;
• Opposition politicians in India, Mexico, Hungary;
• The president of Mexico and the President of France – Emmanuel Macron.

MEDIA CLIP: French President Emmanuel Macron has called for a series of investigations into the Pegasus Spyware case. It follows reports that his phone number was on a list for potential targets for potential surveillance by Morocco.8
MEDIA CLIP: NSO Group has denied the allegations saying that the list was false.9
MEDIA CLIP: Meanwhile French President Emmanuel Macron has changed his phone and number after reports that he was being targeted by the Israeli made spyware software Pegasus.10

ROSE: When President Macron discovered more than a dozen people in his office – and possibly his own phone – might have been targeted with Pegasus – it started a diplomatic crisis that sent ripple effects from Paris to Jerusalem. It sparked fights between Israel and some of its most important allies. The Minister of Defense was personally called to the Elysee Palace, the French Presidential Residence, to provide answers.

How and why did President Macron become a potential target of Pegasus?

Who else is on this leaked list?

This is Episode 9: 50,000 Numbers

NANDO: If you took 50,000 numbers and lined them all up, you’d have to print more than 150 pages of paper. Where does one start?

DONNCHA Ó CEARBHAILL: We started scrolling through this what seemed like infinite lists of phone numbers and what really in the end were actually people and individuals who were being targeted.

My name is Donncha Ó Cearbhaill. I’m originally from Ireland. I live in Berlin, I’ve been working at the Amnesty security lab for the past five years, working on investigating targeted threats and surveillance and how they affect civil society.

ROSE: Donncha Ó Cearbhaill is an engineer with Amnesty International. Amnesty International Security Lab is a global collective of advocates, campaigners, hackers, researchers and technologists defending human rights in a digital age.11

Amnesty and Forbidden stories were given the leaked data together.

Donncha and a small team of engineers from Amnesty worked with Sandrine and Laurent to run the forensics side of the investigation. From an early age Donncha has been captivated by technology and made it his work to make sense of it:

DONNCHA: I grew up on a dairy farm in rural Ireland. As a child, growing up was really also a lot of free time. I definitely spent a lot of time taking apart all the electronics in the house trying to understand that things are made and maybe frustrating my parents now and again when it didn’t go back together in a way that was fully functional. I remember even getting my first computer when I was about five or six, mind blowing for a young farmer son.

NANDO: One of the hardest – and biggest responsibilities of the Pegasus Project was protecting their source. Who are they? How did they get this information, and what motivated them to share it?

SANDRINE: Imagine the power of that list. Imagine how it is to have the list of people targeted by a dozen of governments, and imagine the pressure you could have if somebody would discover that you are the origin of that list. Some of the governments would try to find out how you get the list. Some might want to make you disappear, some might want to get the list. For us, there was no discussion about the efforts we were going to put to protect our source. I mean this was the most important thing for us protecting the security of the source.

DONNCHA: So, at the start, we had to keep it to a very small, close group.

ROSE: The team had to be super small. It was top secret and extremely confidential. Every additional person was a risk – to the source and to the research. When Donncha met with Sandrine and Laurent, they all left their phones and computers in a different room. They established strict protocols for new ways they would communicate.

Sandrine and Laurent created a rubric for the stories they would work on – prioritizing the confirmed identities of journalists and dissidents:

LAURENT: So the very first step was to cross-check with our own directory lists, are own contact list. So I took my phone and I export the file of my contacts. And then I saw that some numbers were matching with the lists.

SANDRINE: We discovered numbers of Mexican journalists we actually worked with. One of the first numbers I discovered was a phone number I was using. It was the number of a colleague who was partnering with me for the Cartel Project. It was the number of Jorge Carasco. Joge Carasco is today the director of Proceso. Proceso is an investigative media in Mexico and I was working with Jorge Carrasco on the story of a colleague of his who had been murdered in 2012 whose name was Regina Martinez. So we were discussing through signal and other ways about that investigation. I then realized that Jorge might have been spied on with Pegasus because his number was in the list of phone numbers. It was very complicated for me to tell him you might be spied on because how do you communicate with somebody who has Pegasus on his phone. We had to find a way to let him know that it was very dangerous for him to use his phone.

NANDO: Sandrine sent a colleague from Forbidden Stories in Paris to Mexico to carry the message to Jorge Carrasco in person that he might have been targeted. While in Mexico, Sandrine’s colleague ran Amnesty’s system –the one that Donnchae built– so they could check Carrasco’s phone.

SANDRINE: When she run the backup of his ah phone in that platform, there was a message that we could directly link to Pegasus that appeared so at that time we were sure that he had been targeted with Pegasus.

ROSE: Forbidden Stories continued sifting through the numbers – they concentrated on the 15,000 Mexican phone numbers on the list.12

SANDRINE: He was not the only one, we discovered a number of journalists, Mexican journalists who had been spied on or potentially targeted including Cecilio Pinedo.

NANDO: Cecilio Pineda. Pineda was a freelance journalist in Mexico, reporting on crime in San Miguel Totolapan, a hub for poppyfields.

ROSE: Heroin and drug trafficking had wreaked havoc on the everyday lives of the inhabitants – almost half of Cecilio’s town had either been kidnapped for ransom or had a family member who has – and as a result – more than half of the town has moved away.

On March 2, 2017, Pineda posted a video on Facebook claiming that the city’s mayor was an accomplice to the kidnappings.

CECILIO PINEDA: [In Spanish] “There are strong ties between the government and gang leaders. If they don’t act, people will die.”13

NANDO: In the video, Cecilio says, “There are strong ties between the government and gang leaders. If they don’t act, people will die.”

A few hours later, Pineda went to get his truck cleaned.14

He was shot and killed while he was laying in a hammock at the car wash. He was 37 years old.

SANDRINE: Cecilio Pineda is a journalist who was killed in 2017. Cecilio Pineda was investigating corruption stories in one of the most dangerous states of Mexico and it had been a story at the heart of Forbidden Stories from the beginning so we had his number and we actually discovered that Cecilio might have been spied on a few weeks only before his death.

Because somebody wanted to know exactly where he was at what moment. This example was quite tragic, because we had in our list somebody who had been potentially targeted by Pegasus and who was killed a few weeks only after his number was entered in NSO’s system. This is how we made the connection between the Cartel Project and the Pegasus Project.

ROSE: They didn’t have all the raw data. Forbidden Stories and Amnesty International had been given a copy of the list which only had phone numbers and dates. The dates went back almost five years and extended right up to the month when they received the list. Without raw data – they couldn’t betray their source, even if at some point they were forced under subpoena to hand over the list to authorities.15

But on the other hand, without the raw data, it was difficult to understand who had issued the targeting – who had given the order to target Cecilio Pineda?

Every single phone the group was able to identify had to be checked individually to see if it had been targeted by Pegasus. In this way Sandrine and Laurent were able to piece together a backstory and a motive. They had to go case by case, which they ultimately did.

That’s after the break.

MIDROLL

NANDO: In the years before the data leak, if an engineer at Amnesty International ran forensics to search for Pegasus – on two to four cell phones a year – that would be considered a lot.16 All of a sudden, Amnesty was looking at a list of tens of thousands of numbers to cross check. They used online databases and other methods to identify names to numbers.

Donncha developed a process to examine a phone’s backup and determine if and when it had been infected with Pegasus:

DONNCHA: When we started, it was a very manual process and it would take us days. Later on, we start automating much more of this process. And so at some point we can have an answer within 30 seconds or a few minutes. On exactly which dates and times they were being targeted and sometimes even how much data was stolen from their phone each day.

SANDRINE: The beginning 50,000 for numbers is something very theoretical. But then you start discovering names and stories behind each of the numbers. The name of Cecilia Pineda for example or the name of Jorge Carrasco. We discovered that people we knew – journalists we had worked with, people doing very brave investigative journalism in their country where they were threatened had been attacked with Pegasus and spied on with Pegasus. And it was not only in one country. It was not only 1 journalist – we’re speaking of dozens of journalists in different countries. We investigated the use of Pegasus in more than 10 countries.

NANDO: Sandrine and Laurent were focused on identifying as many journalists on the list as they could. And when they would identify a journalist, they would have to find a way to tell them that they may have been targeted with this spyware called Pegasus – and then convince them to let Amnesty run forensics on their phone.

This often meant that Sandrine or Laurent had to travel abroad, or persuade the journalist to meet in a “secure” manner – since their phone was considered compromised.

ROSE: Forbidden Stories was working remotely during the pandemic – and for Donncha that meant running phones through his sprawling computer setup either at a kitchen table in Berlin or at his parents home in Ireland.

After Donncha would confirm a target had been infected with Pegasus, he would examine the timestamps listed within the data:

DONNCHA: We were seeing cases that individuals are being targeted literally every second day, and they would reinfect the phone and then still steal the data from the device and wait until after the phone was rebooted.

NANDO: Donncha would cross reference time stamps of the infections with the phone owner’s backstory – what were they working on? When did they publish their big stories? When did they meet with their sources? That helped him make sense of the infection patterns:

DONNCHA: They can access your cloud accounts, pull down your calendar, and then maybe if they see that, oh, you’re having a meeting coming up that they want to investigate and they want a monitor, they can send the new zero click attack, turn on the microphone for the one hour of this meeting, steal data and then turn up the phone again.

We were also able to get forensic proof showing that the same Pegasus customer was targeting multiple people in this list. We found a unique iCloud address that was being used to deliver a zero click attack to target them.

NANDO: The unique iCloud addresses Donncha found in the infected phones led him to uncover NSO-generated iCloud accounts with specific email addresses – grouped by country.17

DONNCHA: When we started looking in France, for example, we again found the same two three emails that we had already found in Morocco on the devices of these individuals.

LAURENT: So the list came in clusters where you have a lot of people targeted by the same account, and then you can see that a lot of Moroccan dissidents are targeted by the same person. So you can identify who is behind the attacks.

DONNCHA: For example, we find a system log file -such as a data usage file- which contains records of which software on the phone had communicated with an Internet website. And in that we can again find malicious persons’ names that we know have been used by the Pegasus as part of their attacks in different countries.

LAURENT: When you have a cluster of many Moroccan dissidents, it’s obvious that it’s Moroccan regime that is targeting them.They were using some specific account to send the first zero click infection. And so we were able to identify as well country per the kind of vector that we’re using because it was the same kind of vector that they were able to see in the forensic analysis.

DONNCHA: When I started digging into it, I was able to make a fingerprint for how the server in that message looked like. And from that one fingerprint, we could then scan the entire Internet and look for every other server online that may have a similar configuration of the web server. Then our breakthrough came when we found that one single domain that had previously been used by NSO’s Pegasus two years earlier in 2016 and was identified by Citizen Lab being used to target individuals in Mexico.

ROSE: Based on the phone forensics of those who had been infected with Pegasus, Donncha was able to connect the Pegasus infection to NSO Group servers.

LAURENT: It’s more about the profile of the victims. Because you can know who is the person. So if the person can discover that the person is a Moroccan dissident that were who was jailed for years in Morocco and now and now is based in France and is tracked, there is a lot of reasons to believe that Morocco is behind that.

ROSE: But they couldn’t tell the targets how … or even with certainty if they had been infected with Pegasus unless the person let them check their phone.

SANDRINE: Let’s say people like Emmanuel Macron – we needed before publishing any story on Macron to have the evidence of the targeting of Macron. The problem is if we had contacted Macron the chances that he would have given us his phone were absolutely null. We knew that whatever we were going to do it was going to be very complicated for us to get the confirmation of the attacks.

For the French government there were reports published after our investigation and after the Pegasus Project was revealed showing that there had been official analysis and that the French authorities confirmed at least the targeting of 5 members of the French government. So there were many official reports published after the Pegasus Project that confirmed our findings.

NANDO: It appeared that it was the Moroccan government (led by King Mohammed the VI) – that had targeted President Macron:

DONNCHA: It wasn’t just Macron that we found on this list, but we found many other names of senior French politicians. I think we finally realized here with the Pegasus Project and with some of these cases of politicians being targeted, that this may be some leverage to try and get meaningful action and meaningful steps being taken.

NANDO: It appeared that Macron was selected when he was traveling in Africa. But why would Morocco have reason to spy on Macron?

In the past few years Macron has strengthened the relationship between France and Algeria18 – and there is contention in the region over the battle for control over Western Sahara – which Morocco has occupied since the 70s.19 The French newspaper Le Monde sites these two issues as reasons for a cooled relationship between France and Morocco – but there’s no way to know for sure.

ROSE: There were 10,000 phone numbers dominated by Moroccan targets on the list. Members of King Mohammed’s inner circle and even some family members – like his father-in-law – were also on the list.20

Morocco has denied the allegations of using Pegasus or targeting Macron.21

Donncha and Amnesty International were going to publish the results of their forensic analysis which included tracing the Pegasus infection to the spyware server named in their report. They asked NSO for comment – and the next day they discovered that the server named in their report had been taken offline. This confirmed for Donncha and his team that NSO was controlling the infrastructure and was able to shut it down.

DONNCHA: Yeah, this is a real bit of a faux pas from, uh from NSO here. We were just shocked when we we sent the report to NSO for comment. And only a few days later, we actually thought, hey, maybe we should check it out, are the servers still online. And then when we looked at it we realized it had gone down almost immediately once we had reported to NSO. And so it couldn’t have been a bigger flashing light saying, yes, this is us, you can confirm it.

ROSE: After working on the project for close to year – Laurent and Sandrine coordinated with outlets around the world to all publish the biggest findings on the same day in July 2021:

LAURENT: When you are right on the finish line, you are exhausted. It’s a kind of relief as well, because it’s going to be finished. This is always the mistake you make that you think is going to be is going to finish. Actually, it’s only start on the day you are publishing. That’s the thing to keep in mind that you think you will have some rest after that once you will be publishing – that’s exactly the opposite. We publish that. 5 seconds later, Edward Snowden made a tweet saying “That’s going to be the story of the year.” 10 seconds later, 20 emails, 1 minute later, hundreds of emails. Can you tell me if my number is on the lists? So from all around the world, we were getting some requests from journalists, lawyers, opponents, random citizens wanting to know if they were infected by Pegasus.

NANDO: “Am I infected with Pegasus?” Laurent and Sandrine were inundated with questions like this. Amnesty International set up a platform for people to run their own tests.

After President Macron’s office got new phones – they wanted the list, and they asked Forbidden Stories for their data.22

LAURENT: The French services, the French administration, the French authorities, the French secret services were pressurizing a lot to get the lists. And we say, no, we won’t give you the list because we are journalists. We did our work. We have to protect our sources as well. The French president decided to call the Ministry of Defense of Israel and ask him to come to Paris immediately.

In India, the Supreme Court decided to launch a commission, a special commission about that. In Hungary, there is some protest about that. The US authorities decided to blacklist the NSO group. We’re talking about a military weapon used against civilians.

ROSE: And what about the other numbers – that don’t belong to journalists – did Sandrine and Laurent discover some of the world’s ‘worst of the worst’ on the list as well?

SANDRINE: It’s very complicated to find that the numbers of ah yeah, um, criminals or ah or traffickers because we we don’t have those numbers. Basically ah, you don’t have a place where where you you can find those numbers those people change. Ah, changed phones every two days.

Potentially there are probably hundreds and thousands of numbers ah of criminals or pedophiles or traffickers in that list but during that investigation. Ah, we yeah, we didn’t find those numbers and it was. Not even what we were looking at because the story we were working on was the story of the misuse of Pegasus against journalists, human rights activists or political opponents. That is the story.

ROSE: Do you worry about your safety now in terms of Pegasus now that the story is out.

SANDRINE: Actually I know that whatever I do I cannot guarantee the security of my communications. So if I need to communicate with somebody who is potentially threatened -which is what I do every day- I find a way to do it safely because I don’t trust my phone anymore.

DONNCHA: The reason Pegasus has been so successful and why they’ve expanded so much over the last years is is probably because we’re actually making progress in terms of how we have privacy and security for people around the world. If you think back to the Snowden revelations in 2013, at the time everyone was using an unencrypted phone, everyone was sending unencrypted text messages being on unencrypted phone calls. Most Internet traffic was unencrypted, and so it was easy for states to wiretap people at scale. I’m sure states were doing this.

ROSE: Donncha Ó Cearbhaill is not alone in thinking of the impact of the Edward Snowden leaks, and the development of products like Pegasus.

Because of all of the work done by tech companies and civil society to encrypt the traffic in the aftermath of Edward Snowden, to make apps like Signal, which encrypt all of your messages and to make encryption available to everyone, governments and companies like NSO started needing to develop tools like Pegasus to hack the phones and get this data that they could no longer access by outdated wiretapping methods.

LAURENT: For the very first time in history in the cyber surveillance knowledge since the Snowden revelation, we were having access to the real faces of the victims all over the world of cyber surveillance – that was entirely new. And having access to that has changed a lot of things. Because for the very first time we were able to break the narrative of NSO.

ROSE: 37 phones from the list of 50,000 have been confirmed targets of Pegasus.23

There have been shockwaves reverberating for the NSO Group after some of the biggest headlines were published by Forbidden Stories and the consortium (like The Guardian, Le Monde, and the Washington Post – among more than a dozen others):

• It was discovered that Hanan Elatr, Jamal Khashoggi’s wife, had Pegasus on her phone;24
• Germany and Belgium have been identified as customers of the NSO Group;
• The Biden administration blacklisted the NSO Group and Pegasus in the United States;
• NSO Group’s CEO and co-founder Shalev Hulio has since stepped down – and the company’s financial situation has become tumultuous.

The NSO Group firmly denies that this list reflects their work or their customers. They issued a public statement claiming Forbidden Stories has published false information and that the data might be from a public source like HLR lookup. NSO underscored that their technology is only sold to governments and that Pegasus is being used to stop heinous crimes around the world:25

RONEN: People say, you know, it’s only thanks to Pegasus that we were able to catch the biggest network of pedophile material production in the world. They saved people. They saved children. They saved babies who were victims of those horrible network.

NANDO: How to live with – or without – Pegasus? For the last episode of this first season, we ask the big question, and we also try to understand, what does Pegasus mean for Americans?

A bombshell story from The New York Times’ Ronen Bergman and Mark Mazzetti revealed that after the Biden Administrations blacklisted NSO and initiated an executive order prohibiting the purchase of Pegasus – an American agency has set up a front company to do just that.

MARK: We pushed the FBI about the status of their Pegasus license. And they said on the record that it’s been deactivated. We’re really at the early days of this class of weapons and how they’re going to be used. We may look back in the period we are now where it’s still in the hands of governments.

NANDO: That’s on the next episode of Shoot the Messenger.

Follow Shoot the Messenger on Apple Podcasts. And, if you can, leave a written review – it really helps other people find our show. And, if you haven’t already, share it with a friend 🙂

ROSE: Shoot the Messenger is a production of Exile Content Studio.

We are distributed by PRX.

Hosted by me, Rose Reid with Nando Vila. Produced by me, Rose Reid, with Sabine Jansen, Nora Kipnis, and Ana Isabel Octavio.

Written by me, Rose Reid. With story editing by Gail Reid.

Production assistance by Stella Emmett.

Daniel Batista oversees audio at Exile Content Studio.

Sound design and mixing by Pachi Quinones.

Executive producers are myself, Rose Reid, Nando Vila, Carmen Graterol, and Isaac Lee.

Special thanks to Andres Bayona and Sonic Union.

For more information on the status of journalists and freedom of the press – visit the Committee to Protect Journalists at cpj.org.

To learn more about EXILE, our other podcasts and films, visit exilecontent.com.

We want to hear from you – so find us on Twitter and Instagram @exilecontent.

Or, send us a voice memo with your questions about Pegasus to stm@exilecontent.com.