Keep Factually independent
Whether you agree or disagree with our analysis, these conversations matter for democracy. We don't take money from political groups - even a $5 donation helps us keep it that way.
Which Israeli spyware was banned from iPhones and why?
Executive summary
Apple sought a legal ban and technical fixes to stop NSO Group’s Pegasus spyware from infecting iPhones after researchers and Apple found it was used to target journalists, activists and officials; Apple sought a permanent injunction preventing NSO from using any Apple software, services or devices [1] [2]. Citizen Lab and others documented active exploits that led Apple to patch iOS vulnerabilities used to deliver Pegasus [3] [4].
1. What was banned — the name and nature of the spyware
Apple’s legal action focused on Pegasus, a commercial spyware product developed by the Israeli firm NSO Group that can be delivered remotely to iPhones and Android devices and can exfiltrate messages, photos, microphone and camera data once installed [1] [5].
2. Who sought the ban and what form did it take
Apple filed a federal lawsuit in November 2021 seeking a permanent injunction to ban NSO Group from using any Apple software, services or devices — effectively trying to cut NSO off from the Apple ecosystem and block further exploitation of iPhones by that firm [1] [2].
3. Why Apple moved: documented abuse and active exploits
Apple and independent researchers said NSO’s tools were used in “concerted efforts” to target and attack Apple customers; Citizen Lab and other forensic teams notified Apple of vulnerabilities that were being actively exploited to deliver Pegasus, prompting emergency iOS patches [1] [3].
4. Legal and policy context: U.S. government and other actions
The U.S. government placed NSO and related firms on a trade blacklist, citing evidence they supplied spyware to foreign governments which used it against journalists, dissidents and others — a move that preceded and reinforced Apple’s civil case [1]. Apple also faced similar litigation from Meta/WhatsApp over alleged misuse of the same surveillance technology [6].
5. Technical countermeasures Apple used
Beyond suing, Apple released iOS security updates to patch vulnerabilities used by Pegasus (notably in September 2023 when Citizen Lab warned of active exploitation), and Apple said it notifies affected users when it detects forced or targeted exploitation attempts [3] [4].
6. NSO’s position and industry arguments
NSO Group has denied wrongdoing in public statements and argues its tools are sold to governments to fight crime and terrorism; the firm and similar vendors contend such capabilities are legitimate investigative tools when used appropriately [3] [4].
7. Wider ecosystem: other Israeli firms and continuing threats
Reporting shows other Israeli companies (for example Quadream/QuaDream and newer vendors) produced similar spyware products — Reuters and Times of Israel described second firms exploiting iPhone flaws, indicating the problem is not limited to a single company [4] [7]. Independent researchers and news outlets continued to find infections and new vendors, underscoring an ongoing security challenge [8].
8. What the ban would (and would not) accomplish
A permanent injunction against NSO would bar it from using Apple software and services and make it harder for NSO to exploit iPhones directly — Apple said such a ban could render Pegasus far less effective against Apple devices [1] [2]. Available sources do not mention a universal, government-level ban on all Israeli spyware across iPhones by Apple beyond this targeted legal action; instead, Apple combined legal pressure with technical patches [1] [3].
9. Disagreements, limitations and open questions
There are competing narratives: human-rights researchers and governments say NSO-enabled surveillance facilitated abuses [1], while surveillance vendors maintain they sell to lawful government clients [3]. The sources show Apple sued and sought injunctions, but they do not establish the full legal outcome of every motion or whether every exploit vector has been permanently closed; later reports document other firms and continued targeting, indicating residual risk [9] [8].
10. Takeaway for users and policymakers
Journalists, activists, and officials should understand that Pegasus-style spyware is powerful, has been used against civil-society actors, and that platform vendors (Apple) respond with both legal and technical measures — but the ecosystem includes multiple vendors and evolving exploits, so vigilance, timely updates, and broader policy responses (including export controls and blacklisting) remain essential [3] [1] [4].