European politicians and media groups voiced outrage Monday over reports that an Israeli firm supplied phone malware used by governments to spy on activists, journalists, lawyers and politicians in several countries. The NSO Group and its Pegasus malware — capable of switching on a phone’s camera or microphone and harvesting its data — have been in the headlines since 2016, when researchers accused it of helping spy on a dissident in the United Arab Emirates. A collaborative investigation by The Washington Post, The Guardian, Le Monde and other media outlets, based on a leaked list of 50,000 phone numbers, revealed the spying may have been far more extensive. The leaked numbers are believed to be connected to people identified by NSO clients as potential surveillance targets. They include one linked to a murdered Mexican journalist and family members of murdered Saudi journalist Jamal Khashoggi. Speaking in Prague, European Commission chief Ursula von der Leyen said the spying, if confirmed, was “completely unacceptable” — sentiments echoed by France. “These are extremely shocking acts and, if proven, are extremely serious,” government spokesman Gabriel Attal said. Authoritarian regimes It is unclear how many devices were actually targeted or surveilled and NSO has denied any wrongdoing. But the claims that countries such as Azerbaijan, Hungary, India and Morocco, where authorities have cracked down on independent media, spied on dissident journalists at home and abroad sparked widespread indignation. The other countries that accounted for most of the numbers on the list were Azerbaijan, Bahrain, Kazakhstan, Mexico, Rwanda, Saudi Arabia and the United Arab Emirates. French investigative news site Mediapart claimed that the phones of its founder Edwy Plenel and one of its journalists were among those targeted by Moroccan intelligence services and said it had filed a criminal complaint. Morocco denied the claims, saying it “never acquired computer software to infiltrate communication devices”. ‘Rogue’ operators Pegasus is a highly invasive tool that can switch on a target’s phone camera and microphone, as well as access data on the device, effectively turning a phone into a pocket spy. In some cases, it can be installed without the need to trick a user into initiating a download. NSO insists it is only intended for use in fighting terrorism and other crimes, and that any other use is the work of “rogue” operators — claims rubbished by Amnesty International. “The Pegasus Project lays bare how NSO’s spyware is a weapon of choice for repressive governments seeking to silence journalists, attack activists and crush dissent, placing countless lives in peril,” Amnesty International chief Agnes Callamard said in a statement. “While the company claims its spyware is only used for legitimate criminal and terror investigations, it’s clear its technology facilitates systemic abuse.” The Post said the numbers on the list were unattributed, but other media outlets participating in the project were able to identify more than 1,000 people in more than 50 countries. They included several members of Arab royal families, at least 65 business executives, 85 human rights activists, 189 journalists and more than 600 politicians and government officials — including heads of state, prime ministers and cabinet ministers.