Suspecting is not knowing

Summary

• On 23 November 2021 Apple e-mailed twelve staff members of the Salvadoran news outlet El Faro, and on the same day sued the spyware maker NSO Group. By then an independent investigation of El Faro phones was already about two months old. Its findings, published on 12 January 2022, named 35 people whose phones had been infected with Pegasus.
• A notification is a high-confidence signal that you may be a target. Apple says it does not attribute attacks to anyone and does not explain what triggered the alert. It is the start of a question, not the answer.
• The sequence that the public guidance supports is to verify the message, stop and ask before you change the phone, get help through a channel that is not the phone, and let a trained examiner decide how to preserve data. Decide about legal, editorial or safety steps after you have a result.
• Resetting, deleting, replacing or even updating a phone can change the very data an examiner would read. A 2025 iOS logging change showed how fragile such traces are.
• If the person you fear is someone close to you, removing a monitoring app can alert them and can destroy evidence. Safety planning comes first.
• An examiner who finds nothing can say what was and was not checked. That is not the same as saying the phone is clean.

An email that changes everything

The El Faro case is one of the best documented examples of what happens after a warning arrives, because the people involved and the researchers published what they did. The facts below come from the sources in the References, and Figure 1 puts them on one line.

Citizen Lab, a research group at the University of Toronto, reports that its investigation began in September 2021, after independent journalists tested their own devices with Amnesty International's Mobile Verification Toolkit and contacted Access Now's Digital Security Helpline [1]. ICIJ, which reported on the findings with the researchers, says the analysis ran from September to December 2021 [2]. On 23 November 2021, Apple began sending threat notifications to some iPhone users and filed its lawsuit against NSO Group the same day [3]. Twelve El Faro journalists were among the people notified [1] [2].

The researchers' report of 12 January 2022 says 35 journalists and members of civil society had phones successfully infected with Pegasus, on 37 devices, between July 2020 and November 2021 [1]. Amnesty International's Security Lab reviewed a sample of the cases and independently confirmed the findings [1] [2]. ICIJ reports that 22 El Faro staff were targeted 226 times; note that ICIJ says "targeted", and that Citizen Lab's report does not give a total number of events [1] [2]. Access Now says some people were infected more than 40 times [5]. El Salvador's presidential communications office told Reuters that El Salvador is not an NSO Group customer, according to ICIJ [2]. This article makes no claim about who operated the spyware.

The order matters. The journalists did not wait for a company e-mail to start asking, and the notification did not replace the investigation. It arrived as one more input to it.

What a threat notification is, and is not

Apple's own page describes its threat notifications as high-confidence alerts that a person has been individually targeted by mercenary spyware, typically a very small number of people such as journalists, activists, politicians and diplomats, and says they should be taken very seriously [4]. The same page says that Apple does not attribute attacks to any attacker or region, that it will not say what triggered an alert, and that investigations of this kind can never reach absolute certainty [4]. Apple also says that these attacks are hard to detect and change over time [4]. We found no Apple statement that a missing notification means a phone is safe.

Figure 2 sets out what the notification can support and what it cannot.

Other warnings exist, for example from other phone makers and from security researchers who contact people directly. The same discipline applies. Check that the message is genuine through a route you open yourself, and treat it as a reason to ask, not as a verdict.

What to do first, in order

The public guidance is consistent on three points: get expert help, do not act on a link in the message, and be careful with anything that cannot be undone. The ordering below is the Lab's synthesis of that guidance and of what examiners need. It is not a tested protocol. Figure 3 marks which part is sourced and which is the Lab's reading.

Why not reset the phone

A factory reset removes data from a phone. It may also remove an infection, or not. We do not claim either. What we can say is that the traces an examiner relies on are held in the phone's own files and logs, and a reset ends the chance to read them. The Mobile Verification Toolkit documentation asks users to decide on a plan before they acquire or analyze data, and says a backup holds only a subset of the files on a device [7].

An example of fragile traces

On 21 October 2025 the security firm iVerify reported that iOS 26 overwrote a log file on each restart instead of adding to it, a file that researchers had used in Pegasus and Predator investigations, and advised people to save a diagnostic archive before updating [8]. CyberInsider reported on 19 February 2026 that iVerify's research chief confirmed Apple had reversed the change in iOS 26.2, and that the fix does not bring back entries already lost [9]. Whether the change was intended is not known from these sources. The point for a reader is general: an ordinary software update can change the evidence, so ask before you update a phone that may need to be examined.

When the person watching may be someone close to you

Most people who fear that their phone is monitored are not the target of a company-built tool. The monitoring may be a commercially sold app, often called stalkerware, installed by a partner, ex-partner, relative or employer. The Federal Trade Commission has acted against a provider of such apps: in September 2021 it announced an order banning SpyFone and its chief executive from the surveillance business and requiring deletion of data the company had collected, and it alleged the company failed to protect that data [11]. That is the agency's account and a settlement. This article makes no claim about any other company.

The Coalition Against Stalkerware advises that removing stalkerware can be detected by the person who installed it and could increase the abuse, that deleting it also deletes evidence, and that you should only remove it if you believe it is safe. It suggests making a safety plan on a safer device, with a trusted survivor-support program [10]. The same page says that, once it is safe, a factory reset is almost as effective as a new phone [10]. So the order here differs from the El Faro case in one way: safety comes before evidence, and the decision to reset can be right. What stays the same is that you decide it deliberately, with help, and not in a panic.

Confronting the suspected person before you have a plan carries the same two risks, escalation and destroyed evidence, which is why the Coalition's advice puts support first [10].

Getting a real answer

Confirmation comes from forensic examination, not from a consumer scan. In El Faro, Citizen Lab rated its findings as high confidence and based them on analysis of device logs and other traces linked to Pegasus [1]. Amnesty International's Security Lab released the Mobile Verification Toolkit in July 2021 as a tool for consensual forensic analysis of Android and iOS devices, and it is still maintained [7]. These tools look for known traces. They need a person who can read the result.

The time to an answer can be long. In El Faro the analysis ran from September to December 2021 and the results were published on 12 January 2022 [1] [2]. That timeline reflects the work, and an instant answer from a consumer scan should be treated with caution.

What an examiner can and cannot conclude

This section is the Lab's own reading, as a mobile forensics research lab. It is not a finding from the sources, except where marked.

An examiner can say which data were examined and how, which known traces were found, with their dates and the confidence the evidence supports, and which were not found. If a known trace is found, the examiner can say the device shows indicators consistent with that tool, and give the file or record. Where an examination has found nothing, the examiner can say that nothing was found in the data available.

An examiner cannot say, from a clean result alone, that the phone was never compromised. Citizen Lab notes that Pegasus may delete evidence of data theft, so missing traces of exfiltration do not prove it did not occur [1]. Traces also age out, are overwritten, or are never collected from some kinds of extraction. Lab work on empty results makes the same point: a claim that nothing happened needs a store that could have recorded it (LAB-TR-0034).

An examiner also cannot usually say who did it. Device evidence can show that a tool ran. It rarely shows who held the controls, and Apple says it does not attribute [4]. Attribution work, such as Citizen Lab's, uses outside evidence and states its confidence, and it is a separate task from detection. Nor can an examiner say what was taken unless the data show it.

What this article does not claim

References

Pages were read on 8 November 2026. The Apple page was read in its version dated 13 August 2026. Details from the Salvadoran case that we could not verify in these sources were left out.

Version history and corrections

Corrections log

No corrections have been published for this article. Corrections to any article are listed on Corrections, with the version they apply to.

Related