Surveillance Technology, Encryption & Digital Privacy
The Origins of Electronic Surveillance & Modern Encryption
In 1973, a young British mathematician working at GCHQ developed a method of securing communications that would eventually help protect billions of internet users.
His name was Clifford Cocks, and his discovery remained classified for more than two decades.
The technology addressed a fundamental problem: how could two people communicate securely without first meeting to exchange a secret encryption key?
The answer would transform digital privacy, online banking and secure messaging.
Yet the story began much earlier, when governments first developed technologies for intercepting telephone calls, radio transmissions and encrypted military communications.
1917 — The Zimmermann Telegram Demonstrates the Power of Interception
In January 1917, British intelligence intercepted and deciphered a German diplomatic telegram proposing an alliance with Mexico against the United States.
The message, sent by German Foreign Secretary Arthur Zimmermann, was intended to remain confidential.
British codebreakers working in the Admiralty's Room 40 recovered its contents.
When the telegram became public, it caused international outrage and contributed to the circumstances surrounding America's entry into the First World War.
The incident demonstrated two distinct intelligence capabilities: intercepting a communication and defeating the encryption protecting its contents.
Both would become increasingly important as telecommunications developed.
1920s — Telephone Networks Create New Surveillance Opportunities
The expansion of telephone networks introduced new possibilities for listening to private conversations.
Unlike written correspondence, telephone calls transmitted electrical signals through physical circuits.
With access to suitable equipment and connection points, an interceptor could potentially monitor conversations without the participants knowing.
Governments and telecommunications authorities developed methods for intercepting calls during criminal and national security investigations.
At the same time, engineers began exploring ways to prevent unauthorised listeners from understanding transmitted speech.
This created an enduring technological contest between interception and communications security.
1935 — Bell Laboratories Develops the Vocoder
During the 1930s, American engineer Homer Dudley developed a speech analysis and synthesis system at Bell Telephone Laboratories.
The technology became known as the vocoder.
Rather than transmitting an ordinary speech waveform unchanged, the system analysed characteristics of the speaker's voice and used that information to reconstruct speech electronically.
The approach offered opportunities to reduce the information needed for voice transmission.
It also provided important foundations for later secure speech systems.
However, a vocoder was not inherently an encryption device. Additional cryptographic protection was required to prevent intercepted information from being understood.
1943 — SIGSALY Introduces Secure Digital Speech Communication
During the Second World War, Bell Laboratories developed SIGSALY, a highly sophisticated system designed to protect confidential Allied telephone conversations.
The equipment converted speech into coded electrical information and combined it with cryptographic key material.
The resulting transmissions were unintelligible to an interceptor without the corresponding key.
SIGSALY entered service in 1943 and connected important Allied communications centres, including Washington and London.
The equipment occupied an entire room and required extensive technical support.
Nevertheless, it demonstrated that secure long-distance speech communication could be achieved through electronic processing and encryption.
1949 — Claude Shannon Establishes the Mathematical Foundations of Secrecy
In 1949, American mathematician Claude Shannon published Communication Theory of Secrecy Systems.
His work provided a rigorous mathematical framework for understanding encryption.
Shannon examined how information could be concealed, how encryption systems could be analysed and what conditions were necessary for strong secrecy.
He demonstrated the concept of perfect secrecy, including the properties required for a correctly implemented one-time-pad system.
The research helped establish cryptography as a mathematical discipline rather than simply a collection of secret codes.
It would influence generations of engineers designing secure communications systems.
1960s — Computers Transform Cryptographic Research
As computers became more powerful, governments and research organisations developed increasingly sophisticated encryption techniques.
Electronic systems could process information far more rapidly than mechanical cipher machines.
However, computer networks also created a growing problem.
Traditional encryption generally required communicating parties to possess the same secret key.
Securely distributing those keys across large networks was difficult, particularly when participants had never met.
Solving this problem became one of the most important challenges in modern cryptography.
1970 — James Ellis Conceives Non-Secret Encryption at GCHQ
In 1970, GCHQ mathematician James Ellis developed the concept of what he called non-secret encryption.
His idea challenged the assumption that communicating parties must first exchange a shared secret key.
Ellis recognised that a system might allow information to be encrypted using publicly available information while retaining a separate secret needed for decryption.
The concept became the foundation of public-key cryptography.
Because Ellis worked within Britain's classified intelligence establishment, his discovery was not made public at the time.
1973 — Clifford Cocks Develops a Public-Key Encryption Method
In 1973, Clifford Cocks, a mathematician working at GCHQ, developed a practical mathematical approach to public-key encryption.
His method relied on the difficulty of factoring very large numbers.
A sender could use a public key to encrypt information, while the recipient retained a private key needed to decrypt it.
The discovery anticipated the mathematical principles of the RSA cryptosystem subsequently developed independently by civilian researchers.
However, Cocks's work remained classified.
As a result, the wider scientific community was unaware that British intelligence researchers had already made this breakthrough.
1974 — Malcolm Williamson Develops a Secret-Key Agreement Method
In 1974, GCHQ mathematician Malcolm Williamson developed a method enabling two parties to establish a shared secret through exchanges over an insecure communications channel.
His work anticipated the principles of what later became publicly known as Diffie–Hellman key exchange.
The significance was considerable.
Two communicating parties could establish cryptographic protection without first transporting a secret key through a secure physical channel.
Together, the work of Ellis, Cocks and Williamson placed British intelligence researchers at the forefront of modern cryptography.
Their achievements nevertheless remained hidden from public scientific discussion.
1976 — Diffie and Hellman Publish a Cryptographic Breakthrough
In November 1976, American researchers Whitfield Diffie and Martin Hellman published New Directions in Cryptography.
Their paper introduced a public approach to key establishment and described the possibilities of public-key cryptographic systems.
The research transformed the scientific discussion surrounding secure communications.
For the first time, the underlying principles could be examined, developed and challenged openly by researchers outside government intelligence organisations.
The publication helped establish the foundations of modern civilian cryptography.
1977 — RSA Provides a Practical Public-Key Cryptosystem
In 1977, Ronald Rivest, Adi Shamir and Leonard Adleman developed the RSA public-key cryptosystem at the Massachusetts Institute of Technology.
Their method used mathematical relationships involving large prime numbers.
RSA provided a practical means of encrypting information and supporting digital signatures.
The system was independently developed without knowledge of Clifford Cocks's classified work at GCHQ.
RSA subsequently became one of the most influential technologies in computer security.
Its mathematical principles contributed to the development of secure electronic transactions, authentication systems and internet communications.
1997 — Britain's Earlier Discoveries Are Finally Revealed
In December 1997, GCHQ publicly acknowledged the pioneering cryptographic work carried out by James Ellis, Clifford Cocks and Malcolm Williamson during the early 1970s.
The announcement revealed that British intelligence researchers had developed key principles of public-key cryptography before their independent publication in the United States.
Ellis had died only weeks before the disclosure.
The revelation changed the recognised history of modern encryption.
It also demonstrated an unusual consequence of intelligence secrecy: a major scientific discovery could remain unknown to the wider research community for decades.
The technologies developed during this period would eventually make secure communication practical across global computer networks.
They would also create new challenges for intelligence agencies seeking access to information protected by increasingly sophisticated encryption.
The Internet, Encryption Wars & the Fight for Digital Privacy
1991 — Phil Zimmermann Releases Pretty Good Privacy
In June 1991, American software developer Phil Zimmermann released Pretty Good Privacy, commonly known as PGP.
The software allowed ordinary computer users to encrypt emails and files using public-key cryptography.
Previously, sophisticated encryption had largely been associated with governments, military organisations and specialist commercial systems.
PGP made strong encryption accessible to individuals who wanted to protect private communications.
Zimmermann initially developed the software partly because of concerns about expanding government surveillance powers.
Its distribution across international computer networks soon attracted the attention of American authorities.
1993 — The United States Investigates PGP's International Distribution
In 1993, American federal authorities began investigating whether the international distribution of PGP had violated export restrictions governing cryptographic technology.
At the time, strong encryption software was subject to controls associated with military equipment.
The investigation raised an unusual question.
Could publishing computer software constitute the export of a controlled technology, even when the program was distributed freely across the internet?
Zimmermann became a prominent figure in the debate over whether governments should restrict access to encryption.
The investigation ended in 1996 without criminal charges.
April 1993 — The Clipper Chip Is Announced
On 16 April 1993, the Clinton administration announced an initiative involving a government-designed encryption device known as the Clipper Chip.
The system was intended to protect telephone and other communications while allowing authorised government access under specified circumstances.
Its central feature was a key escrow arrangement.
Special cryptographic keys would be held by designated authorities, potentially enabling law-enforcement agencies to recover encrypted communications.
Supporters argued that the approach could preserve both communications security and lawful interception capabilities.
Critics warned that creating a mechanism for exceptional government access could introduce security vulnerabilities and undermine public confidence in encryption.
1994 — Matt Blaze Discovers a Weakness in the Clipper System
In 1994, American cryptographer Matt Blaze published research identifying a weakness in the Clipper Chip's implementation.
His findings demonstrated that aspects of the system's law-enforcement access mechanism could be circumvented.
The discovery was particularly damaging because the technology had been promoted as a secure compromise between privacy and government interception.
It also highlighted the importance of independent technical examination.
A cryptographic system designed behind closed doors could contain weaknesses that became apparent only when researchers were able to investigate its operation.
The Clipper proposal subsequently lost political and commercial support.
1994 — Netscape Introduces Secure Internet Connections
As the World Wide Web expanded, businesses needed ways to protect information transmitted between web browsers and online services.
Netscape developed the Secure Sockets Layer protocol, known as SSL, during the mid-1990s.
SSL was designed to encrypt communications between internet users and web servers.
Early versions contained weaknesses, but subsequent development established the foundation for secure web connections.
The technology helped make online banking, electronic commerce and private account access commercially practical.
Encryption was becoming an essential part of everyday internet use rather than a specialist intelligence capability.
1995 — The First SSL Deployment Changes Online Commerce
Netscape released SSL 2.0 in 1995, making encrypted web connections available through its browser technology.
The system combined cryptographic techniques to authenticate servers and protect information exchanged during a connection.
Users could transmit sensitive information, including payment details, with greater protection against interception.
However, early SSL implementations were not immune to technical vulnerabilities.
Security researchers subsequently identified weaknesses that encouraged improvements in cryptographic protocols.
The development marked a turning point in the commercial adoption of encrypted communications.
1996 — The Bernstein Case Challenges Encryption Export Controls
American mathematician Daniel J. Bernstein challenged US government restrictions on publishing encryption software.
He argued that controls affecting his cryptographic source code infringed constitutional protections for freedom of expression.
In 1996, a federal district court ruled that computer source code could qualify as protected speech.
The litigation continued through further proceedings and became an important episode in the struggle over government restrictions on cryptographic research.
Although the case did not eliminate every export restriction, it helped establish that encryption software raised questions extending beyond national security.
It also concerned academic freedom and the public exchange of scientific knowledge.
1997 — Britain Debates Government Access to Encryption Keys
During the late 1990s, the British government considered proposals for regulating cryptographic services and access to encrypted information.
A 1997 consultation on licensing trusted third parties explored arrangements involving organisations that could manage encryption keys.
The proposals attracted criticism from privacy campaigners, technology companies and security specialists.
Critics argued that compulsory or strongly encouraged key recovery arrangements could weaken trust in electronic communications.
The debate reflected the same conflict emerging in the United States.
Governments wanted to preserve investigative access, while businesses and individuals increasingly depended on encryption to protect information from criminals and unauthorised interception.
1999 — TLS Becomes a Standard for Secure Internet Communications
In January 1999, the Internet Engineering Task Force published Transport Layer Security version 1.0.
TLS developed from earlier SSL technology and provided a standardised framework for securing communications across computer networks.
The protocol enabled systems to establish encrypted connections and verify aspects of the identity of communicating parties.
TLS would eventually become fundamental to HTTPS, the secure version of the web's communication protocol.
Its development helped protect passwords, financial transactions and private information travelling across public networks.
The security of these connections nevertheless depended on correct implementation, trustworthy certificates and the absence of exploitable vulnerabilities.
2000 — Britain's Investigatory Powers Law Addresses Encryption
The Regulation of Investigatory Powers Act 2000 introduced provisions allowing authorities, under specified conditions, to require the disclosure of protected electronic information or cryptographic keys.
These powers became associated with Part III of the Act, although the relevant provisions did not come into force until October 2007.
The legislation recognised that investigators might obtain encrypted material without possessing the means to read it.
Rather than requiring encryption systems to contain universal access mechanisms, the provisions created legal procedures for compelling disclosure in particular circumstances.
The distinction became important in later debates about encrypted smartphones and messaging services.
2003 — Skype Popularises Internet-Based Voice Communication
In August 2003, Skype launched a service allowing users to make voice calls over the internet.
The technology helped popularise internet-based communication as an alternative to conventional telephone networks.
Skype used encryption to protect communications, although its early security architecture was proprietary and did not provide the same transparency as openly reviewed cryptographic protocols.
The service demonstrated how voice communications were moving away from traditional telephone infrastructure.
For intelligence and law-enforcement agencies, this created new technical challenges.
Monitoring internet-based services required different approaches from intercepting calls on conventional telephone circuits.
2004 — Researchers Challenge the Security of Wireless Networks
By the early 2000s, wireless networking had become increasingly common in homes, businesses and public spaces.
The original Wired Equivalent Privacy protocol, known as WEP, was found to contain serious cryptographic weaknesses.
Researchers demonstrated attacks capable of recovering information needed to compromise protected wireless connections.
The weaknesses encouraged the adoption of stronger security arrangements, including WPA and subsequently WPA2.
The episode illustrated an important lesson in digital privacy.
A communications system could advertise encryption while still providing inadequate protection because of weaknesses in its design or implementation.
2005 — Encryption Becomes Essential Infrastructure
By 2005, encryption had become embedded in ordinary digital life.
Banks relied on secure internet connections to protect financial transactions.
Businesses used encrypted networks to connect offices and employees.
Individuals increasingly depended on cryptographic protection when accessing online accounts and exchanging sensitive information.
At the same time, governments continued investigating ways to obtain communications relevant to criminal and national security inquiries.
The encryption debates of the 1990s had established a lasting conflict between two objectives: protecting digital communications against unauthorised access and preserving the ability of authorities to investigate serious threats.
The arrival of smartphones, encrypted messaging applications and commercial surveillance software would make that conflict considerably more complex.
Smartphones, Encrypted Messaging & the Rise of Commercial Spyware
2007 — The iPhone Transforms Mobile Communications
On 9 January 2007, Apple unveiled the first iPhone, combining a mobile telephone, internet browser and multimedia device.
Its introduction helped accelerate the transition towards smartphones capable of storing and transmitting substantial quantities of personal information.
Photographs, emails, contact lists, browsing histories and location information increasingly became accessible through a single device.
For intelligence agencies and criminal investigators, smartphones presented new opportunities to obtain evidence.
However, the concentration of sensitive information also created significant privacy and security risks.
A compromised smartphone could potentially reveal far more about its owner than a traditional intercepted telephone call.
2009 — WhatsApp Introduces Internet-Based Messaging
In 2009, WhatsApp emerged as a mobile messaging service that used internet connections rather than conventional SMS networks.
The application subsequently expanded to support photographs, group conversations and voice communications.
Its growing popularity demonstrated how private communications were moving from traditional telecommunications infrastructure to internet-based platforms.
At this stage, WhatsApp did not provide the comprehensive end-to-end encryption later associated with the service.
That protection would be introduced progressively during the following years.
2011 — FinFisher Spyware Attracts International Attention
During the Arab Spring, researchers and journalists began examining commercial surveillance products marketed to governments.
One prominent system was FinFisher, developed by the company Gamma International.
Its FinSpy software was designed to monitor targeted computers and mobile devices.
Depending on the version and level of access obtained, such software could capture communications, record activity and extract information from infected devices.
Documents discovered in Egypt in 2011 raised questions about the attempted sale of surveillance technology to the country's security authorities.
The controversy highlighted a developing industry in which private companies supplied sophisticated monitoring capabilities to government customers.
2012 — Researchers Identify FinSpy Surveillance Infrastructure
In 2012, researchers at the University of Toronto's Citizen Lab investigated FinFisher software and associated command-and-control infrastructure.
Their findings identified servers linked to FinSpy in several countries.
The research demonstrated that commercial surveillance systems could operate across international networks.
However, identifying a server associated with spyware did not necessarily establish which government controlled it or whether particular individuals had been targeted.
The investigation helped establish independent technical analysis as an important method of examining commercial surveillance technology.
2013 — Hacking Team's Remote Control System Comes Under Scrutiny
The Italian company Hacking Team marketed surveillance software known as the Remote Control System.
The technology was designed to provide investigators with access to information from targeted computers and mobile devices.
Once installed, software of this type could potentially collect files, messages and other information from a device.
Researchers raised concerns about the sale of intrusive surveillance capabilities to governments with poor human rights records.
The controversy concerned not only the technical capabilities of the software but also the possibility that it could be used against journalists, opposition figures and political activists.
2014 — Apple Strengthens Smartphone Encryption
In September 2014, Apple introduced iOS 8, incorporating stronger protections for information stored on compatible devices.
The changes made it more difficult for Apple itself to access certain encrypted information on a locked device.
This represented a significant development in smartphone security.
Previously, investigators could sometimes obtain assistance from technology companies in extracting information from devices.
Stronger device encryption reduced the circumstances in which such assistance could provide access.
Law-enforcement authorities expressed concern that important evidence might become inaccessible even when investigators possessed a valid search warrant.
2014 — Signal Introduces Encrypted Messaging
In 2014, Open Whisper Systems released Signal as a secure messaging application for mobile devices.
The service developed from earlier encrypted communication projects, including TextSecure and RedPhone.
Signal used end-to-end encryption to protect messages and calls.
Under this approach, the content is encrypted on the sender's device and decrypted on the recipient's device.
The service provider does not ordinarily possess the cryptographic keys needed to read the protected conversation.
The development demonstrated how sophisticated encryption could be made accessible through ordinary smartphone applications.
July 2015 — Hacking Team Suffers a Major Data Breach
On 5 July 2015, Hacking Team experienced a substantial security breach.
Approximately 400 gigabytes of internal company information were leaked online.
The material included emails, commercial records, technical documentation and software-related information.
The disclosures revealed details about the company's surveillance products and relationships with government customers.
They also exposed the existence of software vulnerabilities and techniques used in surveillance operations.
The breach provided researchers with an unusually detailed view of the commercial spyware industry.
It demonstrated that companies selling intrusion capabilities could themselves become targets of serious cyberattacks.
February 2016 — Apple Challenges an FBI Demand
Following the December 2015 terrorist attack in San Bernardino, California, the FBI sought Apple's assistance in accessing an encrypted iPhone used by one of the attackers.
In February 2016, a federal court ordered Apple to provide technical assistance that would help investigators attempt to unlock the device.
Apple opposed the order, arguing that creating the requested software would undermine security protections and establish a dangerous precedent.
The FBI subsequently obtained access to the phone through assistance from an outside party, and the government withdrew its request.
The case became one of the most prominent confrontations between smartphone security and criminal investigation.
April 2016 — WhatsApp Completes Its End-to-End Encryption Rollout
On 5 April 2016, WhatsApp announced that end-to-end encryption had been enabled across supported forms of communication on its service.
The implementation used technology developed in cooperation with Open Whisper Systems.
Messages, calls and shared media were protected so that the service provider could not ordinarily read their contents while transmitted between users.
The development extended strong encryption to a vast international user base.
However, end-to-end encryption did not prevent someone who compromised a user's device from potentially accessing messages after decryption.
This distinction would become increasingly important in the development of commercial spyware.
August 2016 — Pegasus Spyware Is Discovered
In August 2016, human rights activist Ahmed Mansoor, based in the United Arab Emirates, received suspicious text messages containing links.
He forwarded the messages to Citizen Lab researchers.
Working with the security company Lookout, investigators identified an attempted infection involving previously unknown vulnerabilities in Apple's iOS operating system.
The attack was linked to Pegasus, spyware developed by the Israeli company NSO Group.
The exploit chain could have enabled extensive access to Mansoor's iPhone if he had followed the malicious links.
Apple released security updates after the vulnerabilities were reported.
The discovery exposed a commercial surveillance product capable of compromising modern smartphones.
2019 — WhatsApp Identifies a Pegasus-Linked Attack
In May 2019, WhatsApp disclosed a vulnerability that could be exploited through its calling functionality.
The company attributed exploitation of the vulnerability to NSO Group technology.
The attack could compromise targeted devices without requiring the victim to answer a call.
WhatsApp subsequently brought legal proceedings against NSO Group in the United States, alleging that approximately 1,400 users had been targeted.
The case illustrated how attackers could attempt to bypass end-to-end encryption by compromising the device itself.
The encryption protecting a message during transmission could remain intact while spyware accessed information at one of its endpoints.
2020 — Zero-Click Attacks Become a Growing Concern
Security researchers increasingly documented smartphone exploits that required little or no interaction from the intended victim.
These became known as zero-click attacks.
Unlike traditional phishing attempts, a zero-click exploit might compromise a device through the processing of specially crafted data without requiring the user to open a malicious link.
Such attacks depended on vulnerabilities in operating systems, messaging applications or other software components.
Their existence challenged the assumption that careful browsing habits alone could prevent sophisticated spyware infections.
However, the technical feasibility of zero-click exploitation did not mean that every smartphone was vulnerable to every reported attack.
July 2021 — The Pegasus Project Reveals Alleged Global Targeting
In July 2021, an international journalistic investigation known as the Pegasus Project examined the use of NSO Group's surveillance technology.
The investigation was coordinated by Forbidden Stories with technical support from Amnesty International's Security Lab and reporting partners.
Journalists examined a leaked list of telephone numbers associated with potential surveillance targets.
The list included journalists, political figures, activists and other individuals.
Forensic examinations identified evidence of Pegasus infections or attempted infections on some devices.
However, inclusion of a telephone number on the leaked list did not, by itself, prove that the associated device had been infected.
NSO Group disputed aspects of the reporting and maintained that its technology was intended for use by authorised government customers investigating serious crime and terrorism.
September 2021 — Apple Patches the FORCEDENTRY Exploit
In September 2021, Citizen Lab disclosed a zero-click exploit known as FORCEDENTRY.
Researchers identified the attack while examining an iPhone belonging to a Saudi activist.
The exploit targeted Apple's image-processing capabilities through iMessage and was associated with Pegasus spyware.
Apple released an emergency security update to address the vulnerability.
The discovery demonstrated that attackers could exploit complex software components involved in processing incoming messages.
It also showed the importance of independent security researchers in identifying surveillance techniques that might otherwise remain undetected.
Encryption and Device Surveillance Become Separate Battles
By 2021, two technological developments had reshaped digital privacy.
End-to-end encryption had become widely available through ordinary messaging applications.
At the same time, commercial spyware developers had demonstrated techniques for compromising the devices on which encrypted communications were created and received.
These developments revealed an important distinction.
Strong encryption can protect information while it travels between devices, but it cannot guarantee the security of a device already compromised by malicious software.
The investigations involving FinFisher, Hacking Team and Pegasus demonstrated how surveillance had evolved from intercepting communications networks towards gaining direct access to personal devices.
They also exposed a growing international market for capabilities once associated primarily with specialist government intelligence organisations.
Modern Digital Privacy, Spyware Investigations & the Future of Encryption
November 2021 — The United States Restricts NSO Group
On 3 November 2021, the US Department of Commerce added Israeli spyware developer NSO Group to its Entity List.
The decision followed concerns that its technology had been supplied to foreign governments and used to target journalists, officials, activists and other individuals.
The restrictions limited the company's ability to obtain certain American technologies without government authorisation.
It was a significant development for the commercial spyware industry.
A company whose products had been marketed for counterterrorism and criminal investigations was now facing restrictions over their alleged misuse against civil society.
July 2022 — Apple Introduces Lockdown Mode
On 6 July 2022, Apple announced Lockdown Mode, an additional security feature designed for individuals facing highly sophisticated digital attacks.
The feature became available with iOS 16 later that year.
It restricted selected functions commonly exploited by advanced spyware, including certain message attachments, web technologies and connection methods.
Lockdown Mode was not intended to replace ordinary smartphone security.
It was designed to reduce the opportunities available to attackers targeting journalists, human rights defenders, political figures and other individuals at elevated risk.
The development demonstrated how commercial spyware investigations were directly influencing the design of consumer technology.
July 2022 — Greece's Predator Spyware Scandal Intensifies
In July 2022, Greek opposition politician Nikos Androulakis discovered that his telephone had been targeted with a malicious link associated with Predator spyware.
The discovery followed an examination of his device by European Parliament technical specialists.
It subsequently emerged that Greece's National Intelligence Service had separately placed Androulakis under lawful interception.
The revelations triggered a major political controversy.
The head of Greece's intelligence service and a senior government official resigned in August 2022.
Although the surveillance activities attracted intense scrutiny, the discovery of a Predator targeting attempt did not, by itself, establish who had ordered it.
2022 — European Investigators Examine Pegasus and Predator
In March 2022, the European Parliament established a committee to investigate the use of Pegasus and equivalent surveillance spyware.
The committee examined allegations involving several European countries, including Greece, Hungary, Poland and Spain.
Investigators heard evidence from journalists, researchers, politicians and individuals who believed they had been targeted.
The inquiry examined whether powerful surveillance tools had been used for legitimate investigations or to monitor political opponents and critics.
It also raised questions about companies selling intrusion technology across international borders.
May 2023 — European Parliament Investigators Publish Their Findings
On 8 May 2023, the European Parliament's spyware inquiry committee adopted its final report.
The investigation identified serious concerns about the misuse of commercial spyware against political figures, journalists and civil society organisations.
It also criticised weaknesses in national oversight and the difficulty of obtaining reliable information about secret surveillance operations.
On 15 June, the European Parliament adopted recommendations calling for stronger safeguards and more effective investigations.
These included independent authorisation, meaningful oversight and remedies for people subjected to unlawful surveillance.
The findings demonstrated that spyware misuse was not confined to authoritarian states outside Europe.
September 2023 — Pegasus Is Found on a Russian Journalist's Phone in Germany
In September 2023, Citizen Lab reported that the iPhone of Galina Timchenko, co-founder of the independent Russian news organisation Meduza, had been infected with Pegasus spyware.
The infection was identified after Timchenko attended a gathering of Russian journalists in exile in Berlin earlier that year.
The discovery was particularly concerning because she had left Russia and was working outside the country's jurisdiction.
Researchers established evidence of a Pegasus infection but did not identify the government responsible.
The case demonstrated that journalists living in European countries could remain vulnerable to sophisticated digital surveillance.
October 2023 — The Predator Files Expose a Wider Spyware Industry
An international investigation known as the Predator Files examined surveillance technology associated with the Intellexa alliance.
The reporting identified commercial relationships, technical infrastructure and alleged targeting involving Predator spyware.
The investigation raised concerns about the export of intrusive surveillance capabilities from companies with connections to European jurisdictions.
It also examined attempts to target politicians, journalists and officials.
The disclosures revealed that Pegasus was not the only commercial product capable of conducting sophisticated smartphone surveillance.
2024 — Europe Strengthens Protections for Journalists
In April 2024, the European Union adopted the European Media Freedom Act.
The legislation included protections concerning the deployment of intrusive surveillance software against journalists and other people connected with media organisations.
It provided for limited exceptions subject to specified conditions and safeguards.
The measures followed years of concern that spyware could expose confidential journalistic sources and interfere with independent reporting.
The legislation represented an attempt to address surveillance risks through protections specifically connected to press freedom.
December 2024 — A US Court Finds NSO Group Liable
On 20 December 2024, a federal court in California ruled in favour of WhatsApp in its long-running legal dispute with NSO Group.
The case concerned the exploitation of WhatsApp infrastructure during a 2019 spyware campaign affecting approximately 1,400 targeted users.
The court found NSO liable under American computer misuse law.
The decision was significant because it established legal responsibility for activities associated with the deployment of commercial spyware.
The case subsequently proceeded to a trial concerning financial damages.
February 2025 — Apple's Encryption Dispute with Britain Becomes Public
In February 2025, reports emerged that the British government had sought technical assistance from Apple concerning access to encrypted information.
The dispute involved Apple's Advanced Data Protection feature, which provides end-to-end encryption for additional categories of information stored in iCloud.
On 21 February, Apple announced that it could no longer offer Advanced Data Protection to new users in the United Kingdom and that existing UK users would eventually need to disable the feature.
The company stated that it had never created a back door or master key to its products and would not do so.
The controversy highlighted the difference between obtaining information held by a service provider and demanding access to data protected by encryption keys the provider does not possess.
May 2025 — A Jury Awards Damages Against NSO Group
On 6 May 2025, a California jury awarded WhatsApp approximately $167.7 million in damages in its case against NSO Group.
The award included compensatory and punitive damages.
The decision followed the earlier ruling establishing NSO's liability.
It represented a major legal development for the commercial spyware industry, demonstrating that companies supplying intrusion technology could face substantial civil consequences.
The damages award was subsequently reduced by the court, so the original jury figure should not be confused with the final judgment.
November 2025 — A Court Issues a Permanent Injunction Against NSO
On 12 November 2025, the California court entered a final judgment that included a permanent injunction against NSO Group and an adjusted damages award.
The ruling followed further proceedings after the jury's decision.
The injunction restricted conduct connected with unauthorised access to WhatsApp systems.
The case established an important precedent for technology companies seeking legal remedies against commercial spyware operators.
However, it did not establish that every government use of Pegasus was unlawful or that the entire commercial spyware industry had been prohibited.
2026 — Digital Privacy Remains a Technological Contest
By 2026, encryption and smartphone security had become central to the relationship between technology companies, governments and individual users.
Modern encrypted messaging services can protect communications during transmission, while secure hardware and operating-system protections can make unauthorised access more difficult.
At the same time, commercial spyware investigations have demonstrated that attackers may seek to compromise devices directly, bypassing the need to break the encryption protecting messages in transit.
The resulting challenge extends beyond any single surveillance product.
It concerns the security of the devices people use, the vulnerabilities discovered by researchers, the capabilities sold to governments and the safeguards governing their deployment.
The history of encryption demonstrates that protecting communications is an ongoing technological process rather than a permanent achievement.