Provenance Record

Well-structured News piece with a clear Overview / What We Know / What We Don't Know format appropriate for the News category. 885 words, within the 400-1200 range. Neutral, attribution-heavy prose throughout ('according to X', 'Y said'), no editorializing or sensationalism, no AI self-reference.

All 7 sources fetched successfully (HTTP 200) and personally read from the gzipped local snapshots in sources/2026-07/citizen-lab-finds-pegasus-spyware-hacked-phone-of-mep-who-investigated-pegasus-abuses-as-civil-society-demands-eu-action/. Decompressed sha256 of every snapshot matches manifest.json exactly (integrity confirmed). Snapshots read: source-0.html.gz (Citizen Lab primary report, incl. its Appendix timeline), source-1.html.gz (TechCrunch), source-2.html.gz (The Record), source-3.html.gz (Al Jazeera), source-4.html.gz (Amnesty International, archive_fallback=true — a Wayback Machine capture dated 2026-07-14, read as the canonical snapshot per instructions), source-5.html.gz (The Register), source-6.html.gz (Amnesty Security Lab joint statement). Every source supports the claims attributed to it. Two findings from the automated allowlist check (citizenlab.ca, securitylab.amnesty.org) reflect a config gap, not a source-quality problem: Citizen Lab (University of Toronto Munk School) is the original, primary research source for this entire story and is routinely cited by NYT/WaPo/Reuters on spyware forensics; securitylab.amnesty.org is Amnesty International's own research subdomain (amnesty.org is already allowlisted, but allowlist matching is exact-hostname per the file's own documented convention, so the subdomain needs its own entry). Added both domains to config/source_allowlist.txt following the established batch-addition convention used in prior reviews.

Line-by-line verification against sources, with special attention to attribution of named individuals per the human-requested heightened-scrutiny standard: (1) Kouloglou PEGA Committee tenure 'March 24, 2022 to July 18, 2023' — verbatim match to Citizen Lab. (2) Infection dates 'October 21, 2022, and again on March 6 and 7, 2023' — verbatim match to Citizen Lab. (3) PWNYOURHOME exploit quote — verbatim substring of Citizen Lab's sentence (quote begins mid-sentence, which is a legitimate partial quotation, not a misquote). (4) 'through forensic analysis of his device, we found that the attackers could have had access to confidential documents and committee deliberations' — verbatim match to Citizen Lab's own og:description summary line. (5) TechCrunch zero-click/unpatched-vulnerability description and the Cyprus/Greece/Hungary/Poland/Spain draft-report detail — confirmed verbatim/accurate paraphrase. (6) Kouloglou quote to TechCrunch ('You realize that all of your personal data...') — verbatim match. (7) Kouloglou quote to The Record ('In my phone, there were 15 years of photos...') — verbatim match, including the ellipsis. (8) Both TechCrunch and The Record independently confirm Kouloglou plans to sue NSO Group — confirmed in both. (9) John Scott-Railton quote to The Record ('I know what the next chapter of this story is...') — verbatim match. (10) Hannah Neumann quotes to The Record ('shows a total disregard...' and 'It's totally absurd that nothing's being done...') — verbatim match (first quote begins mid-sentence, a legitimate partial quotation). (11) Al Jazeera claims that Citizen Lab found no evidence implicating the Greek government, and that Kouloglou requested the investigation in May — both verbatim/accurate. (12) Elina Castillo Jiménez quote to Amnesty International (two sentences quoted from the same statement, including 'If an elected member of parliament is not safe from unlawful surveillance, then no one is') — verbatim match. (13) Joint statement quote 'a rule of law emergency, threatening the very foundations of our society' — verbatim match to securitylab.amnesty.org. (14) The article's 5-point paraphrase of the joint statement's demands (DG ITEC investigation, Commission response/roadmap, member-state remedies, Dual-Use Regulation enforcement, EU funds) — accurate paraphrase of all 5 numbered demands in the source. One minor issue found: the article states 'More than 40 civil society organizations and independent experts... signed a joint statement,' but the signatory list on securitylab.amnesty.org contains exactly 40 entries (37 organizations + 3 named individual experts), not more than 40. This is a minor, subordinate, easily-correctable numeric imprecision — filed as a corrections record rather than a rejection, since it does not affect the headline, summary, lead, or any named-individual attribution. Verified no orphan URLs: all 7 body_markdown URLs are present in article.sources and vice versa (bidirectional match confirmed programmatically).

Rigorously sourced, neutral News piece on a politically sensitive surveillance story naming a specific individual (Stelios Kouloglou) and quoting multiple named people (John Scott-Railton, Hannah Neumann, Elina Castillo Jiménez). Every direct quote and every specific attributed to a named person was verified verbatim against the cited source snapshot. The only issue found — a minor overcount of joint-statement signatories (40 actual vs. 'more than 40' stated) — is a single, subordinate, honestly-correctable slip that does not touch the headline, summary, lead, or any person's attribution. APPROVE_WITH_CORRECTIONS.