The New Frontiers of Sovereign and Digital Conflict

The concept of Westphalian sovereignty, which traditionally relied on physical borders and conventional military forces to protect national territory, is undergoing a profound transformation. In the twenty-first century, the battlegrounds of global geopolitics have expanded into the digital realm, transforming the internet into a persistent, borderless theatre of conflict. This shift is characterised by state-sponsored cyberattacks, the proliferation of corporate surveillance tools, and high-stakes legal battles between multinational technology companies and private intelligence firms.

The division between national security and corporate infrastructure has eroded, as private entities now develop sophisticated surveillance tools that allow state actors to project digital power globally. At the heart of this landscape is the commercial spyware industry, which creates tools capable of bypassing the encryption protocols of global communication platforms. The recent escalation of legal hostilities between Meta Platforms Inc. and the Israeli cyber-intelligence firm NSO Group highlights a broader systemic conflict over who controls data, user privacy, and state security.

This analysis examines how private spyware vendors have become key instruments of statecraft, the legal strategies used by tech giants to defend their platforms, and the threat these technologies pose to civil society, democratic institutions, and international human rights frameworks.

The Commercialization of Cyber-Espionage: From State Laboratories to Corporate Suites

Historically, advanced cyber-weapons were the exclusive domain of major intelligence agencies with substantial budgets, such as the U.S. National Security Agency (NSA) or Russia's GRU. These institutions possessed the specialised mathematical talent and computing power required to discover zero-day vulnerabilities—undisclosed software flaws that allow attackers to breach target devices without user interaction. However, the globalization of tech talent and the growth of private defense markets have led to the commercialization of cyber-espionage. Today, private intelligence firms package military-grade hacking capabilities into commercial software suites sold directly to government clients worldwide.

This commercial ecosystem operates on a highly profitable business model that pools global software exploit research for state use. Companies like NSO Group hire former military intelligence officers and elite computer scientists to build a continuous pipeline of exploits against major operating systems, including Apple’s iOS and Google’s Android. By outsourcing these offensive cyber capabilities, governments that lack sophisticated domestic intelligence apparatuses can acquire global surveillance capabilities.

This commercialization alters the regional balance of power. Medium and small states can now project covert influence across borders, targeting political dissidents, journalists, and foreign diplomats without the long-term investment needed to build a domestic cyber-command. The availability of these tools has normalized intrusive surveillance, lowering the technical and political barriers to entry for state-sponsored espionage.

Anatomy of a Silent Infiltration: Zero-Click Exploits and Mobile Vulnerabilities

The primary technical asset of modern spyware suites like Pegasus is their ability to execute zero-click infiltrations. Traditional cyberattacks rely on social engineering, requiring a target to click a malicious link or download an infected file—a method known as a "1-click" campaign. While 1-click campaigns remain common, they leave a digital trail and require user error to succeed. In contrast, zero-click exploits operate entirely in the background, requiring no interaction from the victim. They exploit hidden vulnerabilities in how mobile devices parse data, such as incoming text messages, voice calls, or image files.

When a device receives a specially crafted message via a platform like WhatsApp or iMessage, the operating system attempts to process the incoming data stream before alerting the user. If the data triggers a memory vulnerability within a core system library, the exploit can bypass built-in security protections and execute malicious code with root privileges. Once inside, the spyware grants the operator full access to the device's hardware and data structures. It can extract encrypted chat logs, emails, photos, GPS coordinates, and contact lists in real time.

Furthermore, the software can silently activate the device's microphone and camera, turning a personal smartphone into a persistent surveillance beacon. Because these tools operate within protected system layers, standard mobile security applications rarely detect their presence, making independent discovery difficult for targeted individuals.

Meta vs. NSO Group: A Structural Analysis of Platform Litigation

The legal battle between Meta Platforms Inc. and NSO Group represents a significant structural conflict between a multi-billion-user communications platform and a private intelligence vendor. The confrontation escalated following Meta's discovery that NSO Group had exploited a vulnerability in WhatsApp's video calling protocol to deploy spyware to approximately 1,400 mobile devices globally. Meta responded by filing a federal lawsuit in the United States, alleging that NSO Group had breached WhatsApp's terms of service, violated the Computer Fraud and Abuse Act (CFAA), and compromised its corporate infrastructure.

This litigation highlights the challenges of applying traditional computer fraud statutes to international cyber-espionage. NSO Group sought to dismiss the case by claiming derivative sovereign immunity, arguing that because it acted on behalf of foreign governments, its operations should be shielded from the jurisdiction of U.S. courts. The rejection of this defense by U.S. courts set a critical legal precedent: private defense contractors cannot claim state immunity when their software targets commercial communications platforms.

The ongoing litigation, including Meta's filing of a federal contempt order for alleged violations of permanent injunctions, demonstrates the limits of civil litigation in curbing state-backed cyber-intelligence operations.

The Geopolitical Economy of Export Controls and Entity Blacklists

The proliferation of commercial spyware has transformed cybersecurity into a key focus of international trade policy and export control frameworks. Recognizing that unrestricted access to offensive cyber capabilities poses risks to international security, several governments have integrated spyware vendors into their national security sanctions regimes. A prominent example is the United States Department of Commerce’s decision to place NSO Group on its Entity List, restricting the company’s access to U.S.-origin software, hardware, and components. This designation reflects a policy shift that treats offensive software tools as dual-use technologies requiring strict export controls.

The inclusion of a firm on the Entity List impacts its corporate operations and long-term financial viability. Modern software development relies on global supply chains, including cloud infrastructure, specialized developer tools, compilers, and hardware components produced by U.S. technology companies. Being cut off from these ecosystems limits a spyware vendor's ability to maintain its codebases, secure server hosting, and source new exploit vectors.

However, the efficacy of unilateral blacklists is often limited by the fluid nature of the global surveillance market. Spyware firms can restructure, create front companies in lenient jurisdictions, or migrate their development teams to countries without strict export controls. This creates a regulatory challenge where state sanctions must keep pace with a corporate ecosystem designed to operate through offshore structures and shell corporations.

Weaponized Interconnectivity: The Infiltration of Critical Civilian Infrastructure

The threat of commercial spyware extends beyond individual privacy violations; it poses risks to the security of critical civilian infrastructure. Modern societal functions—including banking systems, transportation networks, energy grids, and water management systems—rely on mobile applications, cloud platforms, and remote administrative tools for daily operations. When spyware compromises a smartphone or device belonging to a senior corporate executive, network engineer, or government administrator, it grants attackers a foothold inside protected institutional networks.

Once a device is infected, operators can extract session tokens, cryptographic keys, enterprise credentials, and multi-factor authentication passcodes stored in the phone's memory. This data allows actors to move laterally from an individual's personal device into sensitive corporate directories and industrial control systems. A compromised device can be used to map internal network layouts, intercept proprietary source code, or monitor confidential industrial communications.

By targeting the mobile devices of individuals who manage critical physical systems, state-backed actors can conduct long-term reconnaissance and position offensive tools within vital infrastructure. This dynamic turns consumer electronics into potential gateways for disruptive cyber-operations against public services.

The Deep-State Proxy Market: Sovereign Ambivalence and Geopolitical Alliances

The commercial spyware market operates within a complex web of state intelligence requirements and foreign policy objectives. While some governments publicly condemn unregulated surveillance tools, many maintain a pragmatic relationship with the private cyber-intelligence sector. For these states, commercial spyware firms serve as convenient proxies, allowing them to conduct sensitive intelligence operations while maintaining a layer of plausible deniability. If an operation is exposed, the state can attribute the attack to an independent contractor rather than its own formal intelligence agencies.

This proxy dynamic is further complicated by regional security balances and intelligence-sharing partnerships. Governments frequently view the sale of surveillance software as a diplomatic lever, using export licenses to strengthen strategic alliances or incentivize counter-terrorism cooperation. Consequently, a spyware firm's target selection often reflects the geopolitical priorities of its home country or primary state patrons.

This dynamic leads to institutional ambivalence in multilateral forums. Efforts to establish international bans on offensive cyber-tools often face quiet resistance from states that view these technologies as essential for domestic stability or external intelligence gathering. The intersection of private profit and state power creates an environment where corporate actors are shielded by the security requirements of the governments they serve.

Societal Dissolution and the Erosion of Democratic Accountability

The widespread availability of commercial spyware poses significant challenges to the internal stability and democratic accountability of open societies. In states with weak institutional checks and balances, the ruling elite can use advanced surveillance tools to consolidate power, target political opposition, and undermine democratic processes. When state agencies use military-grade spyware against domestic political opponents, the traditional separation between state security and partisan politics collapses.

The impact on civil society is immediate and widespread, creating a chilling effect that stifles public dissent, independent journalism, and human rights advocacy. Investigative journalists who expose government corruption or human rights abuses frequently find themselves, their families, and their sources targeted by intrusive surveillance. The knowledge that a digital device can be silently subverted undermines the trust required for investigative journalism and political organizing.

Sources become reluctant to share information, whistleblowers face retaliation, and civil society organizations must divert limited resources from advocacy to complex digital defense measures. By making private communications visible to state authorities, commercial spyware removes a key requirement for democratic accountability: the ability of citizens to organize, critique, and challenge state power without fear of reprisal.

The Digital Arms Race: Tech Giants, Patch Management, and Zero-Day Exploitation

The rise of commercial spyware has accelerated an ongoing technical arms race between private security researchers and multinational software developers. Companies like Apple, Google, and Meta invest heavily in hardening their operating systems, implementing advanced encryption, and redesigning software architectures to resist zero-click incursions. This includes creating specialized, isolated sandboxes—such as Apple’s Lockdown Mode—that restrict specific device functionalities to minimize the available attack surface for advanced exploits.

Despite these efforts, the economic incentives driving the discovery of new vulnerabilities remain high. A single zero-day exploit that can bypass current mobile defences can command millions of dollars on the private market, providing a strong financial motive for exploit developers. This creates a persistent cycle of patch management and exploitation:

1. Discovery: Spyware vendors discover or acquire a new zero-day flaw in an operating system component.
2. Exploitation: The vulnerability is weaponised and used covertly against targets for months or years.
3. Detection: Security researchers or platform operators detect anomalies, capture an exploit payload, and report the underlying flaw to the software vendor.
4. Remediation: The software vendor develops, tests, and deploys a security patch to millions of devices worldwide.
5. Re-adaptation: The spyware vendor shifts resources to locate another vulnerability, rendering the previous exploit obsolete and restarting the cycle.

This technical competition highlights a core vulnerability of modern digital infrastructure: the complexity of modern software means that software codebases inevitably contain undiscovered flaws, ensuring that the exploit pipeline remains active.

Digital Imperialism and the Global South: Exploitation of Regulatory Vacuums

The impact of the commercial spyware industry is felt acutely across the Global South, where regulatory vacuums, limited data protection frameworks, and weak judicial oversight create permissive environments for intrusive surveillance. Many developing nations lack the comprehensive legal frameworks required to regulate state surveillance, oversee intelligence budgets, or protect individual digital privacy rights. This regulatory gap makes these jurisdictions attractive markets for spyware vendors seeking to sell their software without the strict compliance demands of Western export regimes.

Furthermore, this dynamic creates a form of digital dependency, where governments in the Global South rely on foreign corporate technologies to manage domestic security and surveillance infrastructure. This dependency gives external corporate entities and their home states considerable insight into the domestic political dynamics of the importing nations. Because the data paths, exploit validation mechanisms, and infrastructure maintenance often pass through servers located in third-party jurisdictions, the sovereign autonomy of the importing state is compromised.

The Global South becomes a testing ground for advanced cyber-weapons, where state authorities deploy intrusive surveillance tools against local populations, while remaining dependent on foreign tech companies for the maintenance of their internal security infrastructure.

International Human Rights Frameworks in the Age of Ubiquitous Surveillance

The scale of commercial cyber-espionage presents a critical challenge to international human rights frameworks, which were largely developed for a pre-digital era. Article 12 of the Universal Declaration of Human Rights and Article 17 of the International Covenant on Civil and Political Rights (ICCPR) establish that no one shall be subjected to arbitrary or unlawful interference with their privacy, family, home, or correspondence. However, the borderless nature of modern spyware operations complicates the enforcement of these international protections.

When a government client contracts a private firm based in one country to deploy an exploit via an app infrastructure hosted in a second country to target an individual located in a third country,

determining jurisdictional responsibility is extremely difficult. Traditional human rights litigation relies on establishing state accountability within defined geographic borders. Commercial spyware breaks these geographic boundaries, allowing states to violate the rights of individuals worldwide with minimal risk of international legal accountability.

Human rights bodies and United Nations experts have increasingly called for a global moratorium on the sale, transfer, and use of commercial surveillance technology until binding regulatory frameworks are established. These proposed frameworks would require mandatory human rights impact assessments, strict end-user verification, and independent judicial authorization for all electronic surveillance operations, aiming to realign state intelligence practices with international legal norms.

Reclaiming Sovereignty and Rebuilding Digital Trust

The confrontation between multinational tech platforms and the commercial spyware industry represents a defining issue for the future of digital governance, state sovereignty, and human rights. The traditional assumption that national security is purely a state responsibility has been upended by a commercial ecosystem where private companies develop, package, and sell global surveillance capabilities to state actors. This commercialization has expanded the reach of state espionage, giving governments the power to monitor citizens, journalists, and political rivals globally.

Addressing the challenges of this commercial spyware ecosystem will require a multi-faceted approach that goes beyond platform updates and corporate litigation. It requires developing robust international legal frameworks that treat offensive cyber-tools with the same regulatory rigour applied to conventional military hardware. Governments must implement strict, verifiable export controls, establish transparent procurement policies, and enforce meaningful penalties for companies that enable human rights abuses.

At the same time, international legal bodies must update jurisdictional rules to allow victims of transnational digital surveillance to seek legal redress against both the state actors and the corporate vendors involved. Until global standards are established to hold private intelligence firms and their state clients accountable, the security of digital communication platforms will remain vulnerable, and the fundamental right to privacy will continue to be challenged by state-sponsored cyber-surveillance.

References and Academic Sources

1. Al Jazeera. (2026). "Meta to take legal action against Israeli spyware company NSO." Al Jazeera News, Published June 8, 2026.
2. Deibert, R. (2020). Isolating the Cyber-Threat: How Commercial Spyware Subverts Global Civil Society. Toronto: Citizen Lab Research Monographs.
3. Ziolkowski, K. (2022). Peacetime Cyber Espionage and International Law. Tallinn: NATO CCDCOE Publications.
4. United Nations High Commissioner for Human Rights. (2024). The Right to Privacy in the Digital Age: Report on the Impact of Commercial Surveillance Tools. Geneva: United Nations Publishing.
5. Maurer, T. (2018). Cyber Mercenaries: The State, Hackers, and Power. Cambridge: Cambridge University Press.
6. Computer Fraud and Abuse Act, 18 U.S.C. § 1030 (amended 2021).
7. Rid, T. (2020). Cyber War Will Not Take Place. London: Oxford University Press.

.    .    .