Three years after the Pegasus Project, is regulation in sight or further away than ever?

Three years after the publication of the Pegasus Project, one of the biggest cyber surveillance scandals, the sophisticated spyware tool continues to have global repercussions. New victims, among human rights activists or journalists, are frequently identified. Jeopardizing source protection through cyber surveillance poses a real threat to journalists’ capacity to inform the public about critical issues such as corruption, environmental crimes, and human rights violations.

The safeguarding of journalistic sources, through the regulation of spyware, is a cornerstone for press freedom, playing a crucial role in sustaining the health of our democracies. Four months after Forbidden Stories’ revelations, the U.S. Commerce Department blacklisted NSO Group, the Israeli company selling Pegasus. Since then, the White House announced in March 2023 an executive order to ban the U.S. government’s use of commercial spyware that “poses a risk to national security or has been misused by foreign actors to perpetrate human rights abuses around the world”. The “national security” exception has also been used by some European countries, including Greece, France, and Cyprus, during heated discussions over the European Media Freedom Act to prevent the ban on spyware. Those policies undeniably send a strong signal to the malicious spyware industries, but their impact is still unclear.

Organised in association with Forbidden Stories.