Keeping Pegasus on the wing: legitimizing cyber espionage

NSO Group is an Israeli cyber surveillance firm notorious for Pegasus–an intrusive malware capable of covertly taking control of smartphones and remotely extracting their contents. In 2019, after a series of unflattering reports on governments’ use of Pegasus to infiltrate the phones of activists and journalists, NSO embarked on an uncharacteristically public legitimation campaign. This article focuses on this campaign and explores how this otherwise secretive spyware company publicly legitimizes its surveillance. Based on an empirical analysis of hundreds of public documents across various media, we explore NSO's legitimacy management practices and identify the audiences and contexts of this legitimation. Our analysis identified four legitimation practices: securitization, Zionist patriotism, ethics washing, and normalization. We argue that these legitimation strategies operate across two interrelated axes of legitimation: a local axis that echoes a particularly Israeli ‘security-driven populism’; and a universal axis that follows Silicon Valley's ethics washing. We show that these legitimation axes are designed to simultaneously ensure the company's survivability and to sustain surveillance realism–the perception of surveillance as the only viable option This article contributes to the emerging literature on cyber surveillance firms and to the burgeoning research on the legitimation of surveillance by shedding light on the discursive infrastructures behind contemporary cyber espionage. Moreover, while surveillance is often understood as a global phenomenon, this article highlights the need to focus on the local contexts from which surveillance originates to understand its sustainability, expansion, and vulnerabilities.