Stelios Kouloglou was sitting in a committee room in the European Parliament in the fall of 2022, investigating how spyware had been used against various targets. Three days earlier, Al-Haq, a Palestinian human rights organization, had contacted Front Line Defenders after suspecting that its staff had been hacked — a suspicion later confirmed when experts found that six Palestinian devices had been targeted by Pegasus, the first time NSO Group's spyware had been used against Palestinians. Kouloglou was there to understand this. He travelled, he conducted interviews, he probed high-profile cases. And then, according to a new forensic analysis by the University of Toronto's Citizen Lab, Kouloglou's own iPhone was infected with the very same spyware — not once, but multiple times.
What happened to Kouloglou is not an aberration. It is the system working exactly as designed. The tool penetrated the investigator investigating the tool. And nobody needed to break into a building, forge a document, or even touch his device. NSO Group markets Pegasus as a product for fighting crime and terrorism, but governments around the world have routinely used the spyware to surveil journalists, lawyers, political dissidents, and human rights activists. The sale of Pegasus licenses to foreign governments must be approved by the Israeli Ministry of Defense.
That approval process is the hinge. It transforms a private company's product into an instrument of state policy. And the state that approves every sale has been documented to use surveillance tools against those documenting activities it undertakes.
The Architecture of Revocable Access
Here is the thread that connects a Greek MEP's hacked phone, a Palestinian economist's violated privacy, and a British PlayStation user losing access to Paddington 2: none of them owned what they thought they owned. Not the security of their device, not the integrity of their data, not the movie in their digital library. In every case, access was granted by a more powerful party and could be revoked without consent.
Sony recently told its PlayStation customers in the UK that they will no longer be able to watch previously purchased movies and shows from StudioCanal — as of September 1, 551 titles will be removed from their libraries. The company's legal notice attributes this to licensing agreements. Sony already pulled 314 StudioCanal titles from libraries in Germany and Austria in 2022 and deleted people's Funimation digital libraries after merging the anime service with Crunchyroll. You paid for it. You no longer have it. This is not a bug. It is what a "purchase" means in a system where you never actually hold the thing.
For most people reading about Sony, this registers as consumer annoyance. Someone in London loses access to Terminator 2. It is a minor indignity. But the architecture behind it — the principle that a remote authority can decide, unilaterally and at any time, what you are allowed to access through a device you paid for — is the same architecture that structures far more consequential forms of dispossession.
Israel occupies and controls the entire telecommunications infrastructure used by Palestinian companies and internet service providers. In 2014, 43 veterans of Unit 8200 sent a letter to Prime Minister Benjamin Netanyahu to protest "the continued control of millions of people and in-depth inspection that's invasive to most areas of life." Palestinians in the West Bank and Gaza are excluded from global platforms such as PayPal and Payoneer, while these services remain available to Israeli citizens, including settlers in the West Bank. Palestinians in the West Bank remain limited to 3G services, while Gaza remains largely limited to 2G, compared to 4G and 5G networks in Israel.
This is what revocable access looks like when it is applied not to entertainment but to livelihood, documentation, and survival. The same structural logic — you may use this, until we decide you may not — governs a PlayStation library and an occupied population's telecommunications. The difference is the stakes.
Who Made These Decisions
NSO Group works closely with the Israeli government. Its founder, Shalev Hulio, served as a major in the IDF and recruited heavily from elite IDF intelligence units. Active Israeli intelligence officials worked closely with NSO developers to create Pegasus. The Israeli Defense Ministry classified Pegasus exports as weapons and must approve every sale. Prime Minister Netanyahu stated this plainly: "With our Defense Ministry sitting at the controls of how these systems move around, we will be able to exploit them and reap diplomatic profits."
On October 19, 2021, Israel's Defense Minister Benny Gantz designated six Palestinian human rights organizations — Addameer, Al-Haq, Bisan Center, Defense for Children International-Palestine, the Union of Agricultural Work Committees, and the Union of Palestinian Women's Committees — as terrorist organizations. No evidence for the terrorism links was made public. The ban was widely criticised by human rights organizations. Multiple European states rebuffed the designation, and the CIA determined that the accusations were unsupported by evidence.
According to reporting on these designations, the sequence of events—surveillance detection followed by organizational designation—raised questions about the timing and motivations. As Front Line Defenders noted, the Israeli designation of these organizations as "terrorists" after Pegasus was detected but just days before the investigation was published appears to be a clear effort to cover its actions.
Meanwhile, the AI systems that shape what information reaches whom are exhibiting their own version of narrowed access. A new Australian startup called Springboards found that major LLMs like ChatGPT and Claude produce strikingly uniform responses — ask for a random number between 1 and 10 and you get 7, almost always. This might seem trivial. But when the same models increasingly mediate search, recommendation, and content moderation, their built-in tendencies toward convergence become a form of soft gatekeeping. The system's defaults become the system's boundaries. And those defaults are set by a handful of companies, in a handful of cities, accountable to no one who uses them.
What Dignity Looks Like Here
Dignity is not an abstraction. It is material. In this context, it looks like specific, achievable things:
It looks like Palestinian telecommunications infrastructure that Palestinian authorities actually control — not infrastructure routed through an occupying power's systems and subject to that power's surveillance at will. It looks like access to PayPal, to Payoneer, to 4G networks that Israeli settlers in the same geographic territory already use. It looks like digital purchases that are actual purchases — where a license cannot be revoked without compensation, and where the terms of access are governed by law rather than by corporate discretion.
It looks like export controls on spyware that treat the technology as what it is: a weapon. Not a diplomatic commodity to be traded for favorable international support, not a product to be used in one context and then sold abroad as "battle-proven."
And it looks like this: when a European parliamentarian investigating surveillance is himself surveilled by the tool he is investigating, and the institution he serves cannot name who did it or impose any consequence, then the investigation was never the point. The architecture of revocable access — over your phone, your movie library, your right to document abuses — is not a set of separate problems. It is one problem, applied at different scales, by actors who benefit from the fact that most people experience only the mildest version of it.
The people who lose Paddington 2 and the people who lose the ability to document violations of international law are governed by the same logic. The difference is that one group has the luxury of calling it an inconvenience.