From LIMS to Pegasus: 8 Surveillance Tools and Their Cases

The alleged misuse of LIMS announced by Indonesia’s police criminal investigation agency, Bareskrim, this week has many people asking what other surveillance tools exist. The answer ranges from systems inside telecom networks to spyware that slips into phones and devices carried into the field. Here are eight surveillance tools and the documented cases behind them.

These eight tools can be grouped by where the interception happens. Some work inside operator networks without touching the target’s phone. Others have to get into the phone, either remotely or while it is in an officer’s hands. That difference shapes how people can protect themselves.

Every case below is drawn from court rulings, official statements, or research reports that can be traced. This piece explains how the tools work in general terms and what they teach, without technical guidance on using them.

Interception through operator networks

Tools in this group work inside telecom infrastructure. The phone owner does not need to click anything and will see no sign on the device.

1. LIMS and lawful interception systems

LIMS (Lawful Interception Management System) manages legal interception at the request of law enforcement. We covered how it works and Indonesia’s approval process in our article on LIMS and lawful interception. Lawful interception features are built into operator network equipment, so anyone who gains control of them can abuse them.

The best-known case happened in Greece in 2004 and 2005 and became known as the Athens Affair. According to an investigation published by IEEE Spectrum, rogue software was installed on Ericsson switches run by Vodafone Greece and used the equipment’s built-in lawful interception modules. The tapped phones included those of Prime Minister Kostas Karamanlis and several ministers. Greece’s communications privacy authority, ADAE, later fined Vodafone Greece 76 million euros in December 2006, as recorded by EDRi.

2. Operator interception systems breached: Salt Typhoon

On 13 November 2024, the FBI and CISA issued a joint statement on actors affiliated with the People’s Republic of China who compromised networks at multiple US telecommunications companies. The campaign, known as Salt Typhoon, was said to have stolen customer call records and compromised the private communications of a limited number of individuals.

The statement also cited the copying of certain information subject to US law enforcement requests under court orders. In other words, the systems built for lawful interception were themselves a target. Security experts often cite the case as a reason to guard lawful interception systems as tightly as an operator’s most sensitive assets.

3. Tracking through the SS7 signalling network

SS7 is a signalling protocol that operators worldwide use to exchange information, for example when a subscriber makes a call or roams onto a foreign network. It was designed when operators trusted one another, so a party with access to the SS7 network can request information about a number, including its approximate location.

A December 2020 Citizen Lab report, Running in Circles, examined Circles, a company known for selling systems that exploit SS7 weaknesses and that says it sells only to nation states. Citizen Lab found signs of Circles deployments in at least 25 countries. Circles belongs to the same corporate group as NSO Group, although NSO describes it as a separate company.

Spyware that gets inside the phone

The second group is commercial spyware, surveillance software that private companies sell to governments. Once installed, it can read messages, copy files, and switch on the camera and microphone without the owner knowing. What makes it dangerous is the zero-click flaw, a vulnerability that can be used without the target clicking anything.

4. Pegasus by NSO Group

Pegasus is spyware made by Israeli company NSO Group. In April and May 2019, it was delivered through a flaw in WhatsApp’s video calling feature (CVE-2019-3568) to around 1,400 devices. According to the lawsuit WhatsApp filed in October 2019, the targets included journalists, human rights activists, diplomats, and government officials. The flaw worked even when the call went unanswered.

The lawsuit took years. A federal court in California found NSO liable in December 2024. In May 2025, a jury awarded about $167.25 million in punitive damages and $444,719 in compensatory damages, as reported by BleepingComputer. On 17 October 2025, Judge Phyllis Hamilton cut the punitive award to about $4 million but permanently barred NSO from targeting WhatsApp, according to SecurityWeek.

Pegasus was also linked to the FORCEDENTRY exploit. In September 2021, Citizen Lab found it on the phone of a Saudi activist. The flaw in Apple’s image rendering library (CVE-2021-30860) worked through iMessage with no action from the victim. Apple patched it in iOS 14.8 on 13 September 2021, six days after Citizen Lab shared its findings.

5. Predator from the Intellexa consortium

Predator is spyware marketed by the Intellexa consortium to government clients. In 2022, security researchers found Predator on the phone of Greek journalist Thanasis Koukakis. Opposition party leader Nikos Androulakis was also among the targets. Greece’s data protection authority later identified more than 90 phone numbers that had been selected as targets.

The case spread across borders. On 5 March 2024, the US Treasury Department sanctioned several people and companies in the Intellexa consortium, described as the first sanctions against a commercial spyware firm. In late February 2026, a court in Athens convicted four people, including Intellexa’s founder, of breaching the confidentiality of communications and illegal access, according to Posteo. The verdict can still be appealed.

6. FinFisher and Remote Control System

The commercial spyware market existed long before Pegasus and Predator. Italy’s Hacking Team sold its Remote Control System (RCS) to government agencies. In July 2015, the company was hacked and about 400 GB of internal data leaked, including source code, emails, contracts, and customer lists, as reported by Engadget.

FinFisher, the German maker of FinSpy spyware, filed for insolvency in February 2022 while under investigation by Munich prosecutors, according to The Record. Both cases show that spyware vendors can themselves be hacked and investigated.

Field devices and phone forensics

The third and fourth groups require physical proximity. Officers have to be near the target, or the target’s phone has to be in their hands already.

7. IMSI catchers, or fake cell towers

An IMSI catcher is a device that poses as a cell tower. Nearby phones connect to it, revealing their identity and location. In the United States, these devices are known by trade names such as Stingray and Hailstorm.

In April 2015, a Baltimore police detective testified in court that the department had used such devices more than 4,300 times since 2007, according to The Intercept. On 30 March 2016, Maryland’s Court of Special Appeals ruled that police need a warrant before using one. The court rejected the argument that turning on a phone amounts to voluntarily sharing one’s location with the police.

8. Cellebrite and phone extraction tools

Cellebrite UFED is a forensic tool used by law enforcement in many countries to extract data from seized phones. Its use is lawful when it follows legal procedure. Problems arise when it is used for other purposes.

On 16 December 2024, Amnesty International reported that Serbian authorities used Cellebrite tools to break into the phones of a journalist and an activist and, in some cases, installed spyware it named NoviSpy. On 25 February 2025, Cellebrite announced it had stopped the relevant customers in Serbia from using its technology, according to TechCrunch.

A pattern repeats across these eight cases. Tools built for lawful purposes can be misused by their owners, breached by outsiders, or sold to buyers who use them outside the law. Oversight often begins only after researchers, journalists, or insiders bring the abuse to light.

What this means for organizations and users

Most organizations will never face state-grade spyware. Even so, officials, executives, journalists, lawyers, and people who handle sensitive data face higher risk. Protection can be scaled to each person’s level of risk.

For all users:

1. Install system updates promptly. Flaws like FORCEDENTRY are patched within days. A phone that lags behind on updates stays exposed until the gap is closed.
2. Use an authenticator app or security key for important accounts. SMS one-time codes depend on the mobile network, which can be abused as the SS7 case shows.
3. Trim apps and features you do not use. Every messaging app, link preview, and attachment adds another entry point for zero-click flaws.

For people at high risk:

1. Consider Lockdown Mode on iPhone. Apple introduced it on 6 July 2022 for users who may be targeted by mercenary spyware. It restricts message attachments, link previews, and other functions, so some convenience is lost.
2. Ask for a forensic check if you have concerns. Amnesty International released the Mobile Verification Toolkit (MVT) in July 2021 to look for traces of spyware. It requires forensic skills, and a check that finds nothing does not guarantee a phone is clean.

For organizations that run sensitive tools or data, such as telecom operators, law enforcement agencies, and government system operators:

• Treat interception and forensic systems as your most sensitive assets. The Athens Affair and Salt Typhoon show that these systems are prime targets for attackers.
• Record every use in logs their users cannot delete. We describe the practice in our article on audit logs and LIMS.
• Tie every use of a forensic tool to a legal basis and an official record. The Serbian case shows that physical access to a phone can become a route for spyware.

If your organization wants to review its exposure to interception and data leaks, Merakit’s cybersecurity services team can help map weak points and repair priorities.

Frequently asked questions

What is the difference between lawful interception and spyware?

Lawful interception runs through operator networks at the request of law enforcement, with a legal basis and recorded approvals. Commercial spyware gets directly into the target’s phone and can take almost everything on it. Both can be abused when oversight is weak.

How can I tell if my phone has spyware?

State-grade spyware is designed to stay hidden, so signs like fast battery drain are not a reliable guide. A more dependable check uses forensic tools such as MVT, ideally with help from an experienced organization. Since 2021, Apple has also sent threat notifications to users it believes were targeted by mercenary spyware.

Should everyone turn on Lockdown Mode?

No. Apple designed Lockdown Mode for the small number of users at risk of being personally targeted, because it disables several everyday functions. For most people, regular system updates and strong account authentication already provide meaningful protection.

Conclusion

Surveillance tools keep evolving, from telephone switches in Athens to zero-click flaws in messaging apps. The common thread holds. The most powerful tools need the closest oversight, and the records of their use must be open to review by others. If you are assessing how ready your organization is for these risks, we are happy to talk.

Sources

• The Athens Affair (IEEE Spectrum, July 2007)
• Wiretapping scandal in Greece ends with record fine (EDRi, December 2006)
• Joint Statement from FBI and CISA on the People’s Republic of China Targeting of Commercial Telecommunications Infrastructure (CISA, 13 November 2024)
• Running in Circles: Uncovering the Clients of Cyberespionage Firm Circles (Citizen Lab, 1 December 2020)
• NSO Group fined $167M for spyware attacks on 1,400 WhatsApp users (BleepingComputer, May 2025)
• NSO Ordered to Stop Hacking WhatsApp, but Damages Cut to $4 Million (SecurityWeek, October 2025)
• FORCEDENTRY: NSO Group iMessage Zero-Click Exploit Captured in the Wild (Citizen Lab, 13 September 2021)
• Greece: Four found guilty in spyware scandal (Posteo, 4 March 2026)
• How spyware peddler Hacking Team was publicly dismantled (Engadget, 9 July 2015)
• Surveillance software firm FinFisher declares insolvency (The Record, March 2022)
• Maryland Appellate Court Rebukes Police for Concealing Use of Stingrays (The Intercept, 31 March 2016)
• Serbia: Authorities using spyware and Cellebrite forensic extraction tools to hack journalists and activists (Amnesty International, 16 December 2024)
• Cellebrite suspends Serbia as customer after claims police used firm’s tech to plant spyware (TechCrunch, 26 February 2025)
• Mobile Verification Toolkit (Amnesty International Security Lab)
• About Apple threat notifications and protecting against mercenary spyware (Apple Support)