> How are they supposed to know the nationality of the user of a phone? That's why you do recon before targeting somebody. Do you suppose they just sprayed th

> How are they supposed to know the nationality of the user of a phone? That's why you do recon before targeting somebody. Do you suppose they just sprayed the malware onto random phones? I get the impression that Pegasus is meant to be used in a very targeted way, at people you have identified before, and have some reason to spy on. If you do that way, what are you chances of wanting to target somebody else, and accidentally getting 11 US embassy employees? NSO promised oversight, they can't just weasel they way out by saying "there's no way would could have implemented effective oversight".