amnestytech/inside-pegasusA curated set of NSO Group internal documents, product materials and sworn testimony that entered the public record in WhatsApp Inc. and Meta Platforms, Inc. v. NSO Group
A curated set of NSO Group internal documents, product materials and sworn testimony that entered the public record in WhatsApp Inc. and Meta Platforms, Inc. v. NSO Group Technologies Limited and Q Cyber Technologies Limited, Case No. 4:19-cv-07123-PJH (US District Court, Northern District of California).
This repository accompanies a technical analysis Inside Pegasus: The evolution of the world's most notorious spyware system, published by Amnesty International's Security Lab in it's role as technical partners to a new collaborative investigation coordinated by Forbidden Stories Pegasus Project: Inside Morocco’s Spying Machine.
Every file here is an extract from documents filed on the public court
docket. Each page carries the court's filing stamp (Case 4:19-cv-07123-PJH … Filed …) and the parties' Bates numbers
(NSO_WHATSAPP_…, WA-NSO…), so any extract can be traced back to its source
filing and page.
All documents in this repository are now in the public domain as public court exhibits. Some carry a "HIGHLY CONFIDENTIAL – ATTORNEYS' EYES ONLY" stamp. That was their designation during the litigation, before the court ordered them filed publicly; the stamp is a record of that history and has no bearing on their status now.
Due the volume of material, automated tooling was used to identify and extract key documents from the extensive court filings, and to build this index. All documents cited in the accompanying research breifing have been manually reviewed and references.
| Docket | Filed | Filed by | What it is |
|---|---|---|---|
| Dkt. 796 | 15 September 2025 | NSO / Q Cyber (Defendants) | Notice of Public Filing of Previously-Sealed Exhibits. The primary source, with 20 attachments containing depositions, expert reports and NSO's own internal product and engineering documents. |
| Dkt. 679-6 | 4 April 2025 | WhatsApp / Meta (Plaintiffs) | Exhibit 6 to Plaintiffs' Notice of Filing of the sanctions briefing: 139 pages of NSO documents produced in discovery (revenue, targeting, sales materials). |
| Dkt. 674 | 4 April 2025 | NSO / Q Cyber (Defendants) | Notice of Public Filing of Exhibits in support of NSO's opposition to Plaintiffs' sanctions motion. |
| Dkt. 320 | 26 June 2024 | WhatsApp / Meta (Plaintiffs) | Motion for issuance of a letter rogatory. Its Exhibit 11 reproduces the original October 2019 complaint and its attachments, including the NSO–Ghana reseller agreement filed as Document 1-1. |
| Dkt. 825 | 26 December 2025 | NSO / Q Cyber (Defendants) | Excerpts of record for NSO's Ninth Circuit appeal (No. 25-7380), reproducing previously-sealed exhibits including a 2018 Q Cyber customer licence agreement (originally Dkt. 813-4). |
Each attachment of Dkt. 796 is one exhibit. Some attachments bundle several
exhibits; the "Pages" column below always gives the page range within the
cited attachment, matching the Page X of Y stamp printed on every page.
Every entry links to the curated PDF in this repository (left) and to the source filing on CourtListener (right).
The three successive zero-click vectors NSO built to install Pegasus through WhatsApp, and the server that drove them.
