Spies for centuries have trained their sights on those who shape destinies of nations: presidents, prime ministers, kings.

And in the 21st century, most of them carry smartphones.

Such is the underlying logic for some of the most tantalizing discoveries for an international investigation that in recent months scrutinized a list of more than 50,000 phone numbers that included — according to forensics analyses of dozens of iPhones — at least some people targeted by Pegasus spyware licensed to governments worldwide.

The list contained the numbers of politicians and government officials by the hundreds. But what of heads of state and governments, arguably the most coveted of targets?

Fourteen. Or more specifically: three presidents, 10 prime ministers and a king.

None of them offered their iPhones or Android devices to The Washington Post and 16 other news organizations that scrutinized the list of phone numbers. That means the forensic testing that might have revealed infection by NSO’s signature spyware, Pegasus, was not possible. Nor was it possible to determine whether any NSO client attempted to deliver Pegasus to the phones of these heads of state — much less whether any succeeded in turning these highly personal devices into pocket spies capable of tracking a national leader’s nearly every movement, communication and personal relationship.

But here’s who’s on the list: Three sitting presidents, France’s Emmanuel Macron, Iraq’s Barham Salih and South Africa’s Cyril Ramaphosa. Three current prime ministers, Pakistan’s Imran Khan, Egypt’s Mostafa Madbouly and Morocco’s Saad-Eddine El Othmani.

Seven former prime ministers, who according to time stamps on the list were placed there while they were still in office, including Lebanon’s Saad Hariri, Uganda’s Ruhakana Rugunda, and Belgium’s Charles Michel.

And one king: Morocco’s Mohammed VI.

The Post and its partner news organizations in 10 countries confirmed the ownership of these numbers and others cited in this article through public records, journalists’ contact books, and queries to government officials or other close associates of the potential targets — though in some cases it was not possible to determine whether the phone numbers were active ones or former ones. The Post confirmed five of the numbers itself. The rest were confirmed by its partners.

Calls to almost all of the phone numbers on Monday and Tuesday yielded canceled calls or changed numbers. A handful of people picked up the line. Others responded to text messages.

A French journalism nonprofit, Forbidden Stories, and the human rights group Amnesty International had access to the list of more than 50,000 numbers. They shared the list with The Post and the other news organizations.

The purpose of the list is unknown, and NSO disputes that it was a list of surveillance targets. “The data has many legitimate and entirely proper uses having nothing to do with surveillance or with NSO,” a Virginia attorney representing the company, Tom Clare, wrote to Forbidden Stories.

But forensic examination by Amnesty’s Security Lab of 67 smartphones affiliated with numbers on the list found 37 that had either been successfully penetrated by Pegasus or showed signs of attempted penetration. The analyses by Amnesty also found that many of the phones showed signs of infection or attempted infection minutes or even seconds after time stamps that appeared for their numbers on the list.

NSO — just one of several major players in this market — says it has 60 government agency clients in 40 countries. In every case, the company says, the targets are supposed to be terrorists and criminals, such as pedophiles, drug lords and human traffickers. The company says it specifically prohibits targeting law-abiding citizens, including government officials carrying out their ordinary business.

NSO chief executive Shalev Hulio said his company has policies to guard against abuse in a phone interview with The Post on Sunday, after an initial set of stories about his company appeared in news reports worldwide, under the heading of the Pegasus Project.

“Every allegation about misuse of the system is concerning me. It violates the trust that we give customers,” Hulio said. “I believe that we need to check every allegation. And if we check every allegation, we might find that some of it is true. And if we find that it is true, we will take strong action.”

However common spying on national leaders may be in general, public revelations about it often spark controversy. When former National Security Agency contractor Edward Snowden revealed in 2013 that the United States had tapped into a phone used by German Chancellor Angela Merkel, it caused months of uproar in that country and strained otherwise close relations between the two nations.

In response to detailed questions from the investigative consortium, NSO said it monitors how its spyware is used and cancels access to the system for any client that misuses it. But it also says its clients, not the company itself, are responsible for its use.

“NSO Group will continue to investigate all credible claims of misuse and take appropriate action based on the results of these investigations,” the statement said. “This includes shutting down of a customers’ system, something NSO has proven its ability and willingness to do, due to confirmed misuse, done it multiple times in the past, and will not hesitate to do again if a situation warrants.”

In a separate letter Tuesday, it also said “we can confirm that at least three names in your inquiry Emmanuel Macron, King Mohammed VI, and [World Health Organization Director General] Tedros Ghebreyesus — are not, and never have been, targets or selected as targets of NSO Group customers.”

A person familiar with NSO operations who has spoken earlier on the condition of anonymity to discuss internal matters told The Post that among clients the company had suspended in recent years were agencies in Mexico. The person declined to detail which agencies had been suspended.

But reports of Pegasus abuse have been rampant in Mexico, and more than 15,000 Mexican phone numbers are on the list, including that of former president Felipe Calderón. The investigation found he had been added to the list after his term ended in 2012.

Burundi’s prime minister, Alain-Guillaume Bunyoni, was added to the list in 2018, before he took office, the records show. So were the numbers of Kazakhstan’s future president, Kassym-Jomart Tokayev, and its future prime minister, Askar Mamin.

Key figures in major international organizations were not exempt from inclusion on the list. The list contained numbers for several United Nations ambassadors and other diplomats. It also contained a phone number for a former staffer for the WHO’s Tedros.

Overall, the list contained phone numbers for more than 600 government officials and politicians from 34 countries. In addition to the countries where top leaders’ phone numbers appeared were numbers for officials in Afghanistan, Azerbaijan, Bahrain, Bhutan, China, Congo, Egypt, Hungary, India, Iran, Kazakhstan, Kuwait, Mali, Mexico, Nepal, Qatar, Rwanda, Saudi Arabia, Togo, Turkey, the United Arab Emirates, the United Kingdom and the United States.

According to NSO marketing materials and security researchers, Pegasus is designed to collect files, photos, call logs, location records, communications and other private data from smartphones, and can activate cameras and microphones as well for real-time surveillance at key moments. Often these attacks can happen without the targets getting any kind of alert or taking any action. Pegasus can just slip in — to both iPhones and Android devices — and take over smartphones in what the surveillance industry calls “zero-click” attacks.

Geographic clues

A review of the list showed that some of the leaders’ phones were entered more than once, as were phone numbers for their friends, relatives and aides. Phone numbers for associates of Mexican President Andrés Manuel López Obrador were added to the list during the run-up to the 2018 election, which he ultimately won, unseating the ruling party. Among those on the list were smartphones belonging to his wife, sons, aides, dozens of his political allies, and even his personal driver and cardiologist. There was no indication that López Obrador’s phone was on the list; aides say he used it sparingly.

Which NSO client might have added the numbers could not be learned definitively from the records. But the numbers for Calderón and the many associates of López Obrador were among a portion of the records from 2016 and 2017 dominated by Mexican targets. Also listed were dozens of sitting governors, federal lawmakers and other politicians.

“Now we are learning that they also spied on my wife, my sons, even my doctor, a cardiologist,” López Obrador told reporters on Tuesday. “Apart from the issue of this spying, imagine how much cost! How much money went for this spying?”

Numbers belonging to Michel, Macron and dozens of French officials appeared amid a group of more than 10,000 numbers dominated by Moroccan targets and those in neighboring Algeria, a Morocco rival. The numbers for Mohammed VI and the Tedros staffer also were found in that group. So was the number of Romano Prodi, a former Italian prime minister.

“We were aware of the threats and measures were taken to limit the risks,” Michel told a reporter for Belgium’s Le Soir, a partner in the Pegasus Project.

Prodi picked up at the phone number that was on the list on Tuesday, but he declined to comment.

Pakistan’s Khan appeared among a group dominated by numbers in India. Iraq’s Salih and Lebanon’s Hariri were grouped among numbers dominated by the United Arab Emirates and a separate grouping dominated by Saudi numbers.

South Africa’s Ramaphosa, Uganda’s Rugunda and Burundi’s Bunyoni were among a group dominated by Rwandan phone numbers.

Rwanda, Morocco and India have all issued official statements denying involvement in spying on journalists and politicians.

Rwanda’s minister of foreign affairs, Vincent Biruta, said his country “does not possess this technical capability in any form.” In a statement, Morocco expressed “great astonishment” at the publication of “erroneous allegations … that Morocco has infiltrated the telephones of several national and foreign public figures and officials of international organizations.” The statement added, “Morocco is a State governed by the rule of law, which guarantees the secrecy of personal communications by the force of the Constitution.”

In India, the home minister called suggestions it has spied on journalists and politicians the work of “disrupters,” which he defined as “global organizations which do not like India to progress.” In a separate statement, the government said, “The allegations regarding government surveillance on specific people has no concrete basis or truth associated with it whatsoever.”

Mexico, Saudi Arabia, Kazakhstan and the United Arab Emirates did not respond to requests for comment.

'Unjustifiable violation’

Macron’s phone number was added to the list as he was about to embark on a tour of Africa, with stops in Kenya and Ethiopia. Added about the same time were the phones of 14 French ministers and Belgium’s Michel.

At the time, Morocco’s neighbor Algeria was in turmoil. Its longtime authoritarian ruler, Abdelaziz Bouteflika, had just announced he did not plan to run for reelection. Algeria fought a bloody war of independence from France in the 1950s, and many French citizens are of Algerian descent; the two countries retain strong ties and intelligence relationships.

African Union nations were also ratifying a major free-trade agreement at the time. Trade and other international negotiations historically have been major targets for government intelligence-gathering as all sides seek insight into the thinking of their negotiating partners.

Senior French government officials typically have access to secure devices for official communications, but French political insiders say some business also gets transacted on less-secure iPhones and Android devices.

In addition to his personal iPhone, Macron uses two special highly secure cellphones for more sensitive conversations, aides say. His personal iPhone is the least secure of the devices he regularly uses, and he routinely shared its number with journalists and other associates before he was elected to high office. The number for one of his personal cellphones was also published online in 2017 after someone stole the phone of a journalist who had Macron’s contact details.

But officials familiar with his habits say he does not usually use any of the phones for discussions of classified information, for fear of being spied on. For that he sticks to encrypted landlines and other tools, the officials said, speaking on the condition of anonymity to discuss sensitive matters.

Mexico’s Calderón told The Post that such intrusions were “an unjustifiable violation of the most elemental rights of liberty and privacy, as well as others that constitute elemental guarantees of human dignity.”

He added he wasn’t surprised his phone number was on the list. “It’s not the first time, and I fear it won’t be the last, that I suffer from espionage,” he said. “On another occasion, the so-called WikiLeaks revealed that I had been the object of surveillance by the United States.”

An investigation by a consortium of media organizations has found that military-grade spyware licensed by an Israeli firm has been used to hack smartphones. (Jon Gerberg/The Washington Post)

Timberg and Harwell reported from Washington. Birnbaum reported from Brussels. Sabbagh is a reporter for the Guardian. Reed Albergotti in San Francisco; Karen DeYoung, John Hudson and Dana Priest in Washington; Niha Masih and Joanna Slater in New Delhi; Mary Beth Sheridan in Mexico City; Sarah Dadouch in Beirut; Sam Sole of the investigative nonprofit amaBhungane in South Africa; Damien Leloup and Martin Untersinger of Le Monde; Michael Safi and David Pegg of the Guardian; Bastian Obermayer and Frederik Obermaier of Süddeutsche Zeitung; Kristof Clerix of Knack; Joël Matriche of Le Soir; Hala Nasreddine, Alia Ibrahim and Hazem Amine of Daraj; Miranda Patrucic, Vyacheslav Abramov and Peter Jones of the Organized Crime and Corruption Reporting Project; Holger Stark of Die Zeit; Jacques Monin of Radio France; and Sandrine Rigaud of Forbidden Stories contributed to this report.

The Pegasus Project is a collaborative investigation that involves more than 80 journalists from 17 news organizations coordinated by Forbidden Stories with the technical support of Amnesty International’s Security Lab. Read more about this project.