> that the plausible deniability goes out the window the minute they host their own infrastructure NSO operates the infrastructure and customers provide a list

> that the plausible deniability goes out the window the minute they host their own infrastructure NSO operates the infrastructure and customers provide a list of phone numbers. They will launch exploitation against the provided numbers without any knowledge of who owns the phone (as long as the number isn't from a restricted country like Israel or the US). Once the implant calls back it goes to a portal where the customer can control it. I'd fault NSO for a lot of things, but they just aren't in a position to know if a burner phone belongs to a journalist or a foreign diplomat until it has been popped. They do have to trust their customers to an extent.