There is an idea still floating around in many conversations: spyware is something used by authoritarian governments against dissidents in faraway countries. The documentary Surveilled, produced by Ronan Farrow and aired on HBO in November 2024, dismantles this reassuring illusion in ninety minutes. It does so with data, testimony and an uncomfortable truth: the global market for commercial surveillance is mature, profitable, and knows no geographic or political borders.
What Surveilled is about
Surveilled is an investigative documentary produced by Ronan Farrow — the New Yorker journalist who broke the Harvey Weinstein story — and directed by Perri Peltz and Matthew O’Neill. At its center is Pegasus, the surveillance software developed by the Israeli company NSO Group, capable of infecting a smartphone without the victim taking any action: no link to click, no file to open. Simply receiving a message is enough. Once installed, Pegasus can activate the microphone and camera, read every message (including encrypted ones), track location in real time, and exfiltrate the entire contents of the device. All of it invisibly, without leaving any obvious trace.
Farrow is not working purely as a journalist here: he is also one of the victims. The documentary shows that his own devices were targeted by Pegasus operators while he was investigating the Weinstein case. This autobiographical detail turns the film from a cold report into a first-person account, with a tension rarely found in documentaries on technical subjects.
The market that shouldn’t exist
What Surveilled does best is show how the industry works, not just the product. NSO Group does not sell Pegasus freely: it claims to grant licenses only to governments, only to fight crime and terrorism. But the documentary recounts the cases in Catalonia, where hundreds of Catalan pro-independence figures — including elected politicians — were surveilled with Pegasus on the orders of Spanish authorities. Not dissidents under a regime. Opposition politicians in a member state of the European Union.
There is also the case of Jamal Khashoggi, the Saudi journalist murdered in 2018 inside the Istanbul consulate: investigations revealed that his associates had been infected with Pegasus before the killing, likely to plan the attack. NSO Group has always denied direct responsibility. The documentary leaves it to the viewer to judge how credible those denials are.
The systemic lesson is this: once a tool of total surveillance has been created, controlling who uses it — and how — becomes almost impossible. Licenses get transferred, governments change, contracts carry on.
The connection to the Italian context
The Pegasus story is not far removed from Italy. In 2022 the European Parliament opened an inquiry into the use of commercial spyware in member states, documenting cases in Hungary, Poland, Greece and Spain. In Italy, the issue of advanced interception tools has been raised repeatedly in connection with anti-mafia and anti-terrorism investigations — often with little transparency about which technologies are actually being used and under what safeguards.
But the most important point Surveilled brings out has nothing to do with governments: it concerns the secondary market. Pegasus is the most famous, but it is not the only one. Paragon, Candiru, FinFisher: the commercial spyware market comprises dozens of companies, many of them European, that sell less powerful versions (though no less harmful for that) even to private buyers. When it comes to the security of your own smartphone, this is the concrete threat — not just hobbyist hackers, but professional tools designed specifically to be invisible.
What you can actually do
Surveilled is not a technical manual, but its practical implications are clear. A few measures significantly reduce the attack surface:
Always keep your operating system updated, whether iOS or Android: many Pegasus exploits take advantage of vulnerabilities that are already known and patched in later versions. An outdated device is an open door. Use a privacy-oriented operating system like GrapheneOS — which we covered in article 8 — because it drastically reduces the attack vectors available to any spyware. Do not rely on end-to-end encryption as your only protection: if the device is compromised, the spyware reads messages before they are encrypted, defeating Signal or any other app. Finally, restart your phone regularly: some Pegasus variants do not survive a reboot. It is not a definitive fix, but it shrinks the window of exposure.
Conclusion
Surveilled is one of those documentaries that make you look differently at the phone on the table. Not out of paranoia, but out of awareness: the tools it describes exist, they work, and the barrier to access drops every year. Ronan Farrow offers no easy solutions because none exist — but he shows that ignoring the problem does not make it any less real. The documentary is available on Max (HBO). It is worth ninety minutes of your time.
Sources: