Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

A 2022 European Parliament study reported that Germany’s Federal Criminal Police Office (BKA) bought Pegasus and used it in roughly half a dozen cases involving suspected terrorism and organized crime. But Germany’s public written parliamentary answer did not directly confirm that acquisition or use: it confirmed that a federal agency had contact with Pegasus maker NSO Group for market research, while withholding operational details.

What Germany’s official answer confirms

In its answer to Bundestag question 19/31809, transmitted on September 1, 2021, the federal government said the Central Office for Information Technology in the Security Sector (ZITiS) had been in contact with NSO Group Technologies Limited since 2018. The purpose was to review the company’s product portfolio and assess whether it might be suitable for federal security authorities.

The answer did not publicly say whether federal authorities acquired NSO products, identify any products acquired, or disclose how often they were used. The government said such information could reveal operational methods and capabilities. That makes the confirmed market contact distinct from confirmation of a purchase or deployment. Read the government’s Bundestag answer.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What was reported about BKA use

A 2022 European Parliament study summarized contemporaneous German media reporting and parliamentary discussion that the federal government had purchased Pegasus and that the BKA used it in roughly half a dozen cases involving suspected terrorism and organized crime. The figure is an approximate account attributed to the study, not a case count disclosed in the government’s written answer. See the European Parliament study.

#1 Best Overall
Yubico - Security Key C NFC - Basic Compatibility - Multi-Factor authentication (MFA) Security Key and passkey, Connect via USB-C or NFC, FIDO Certified
  • POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
  • WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
  • FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
  • TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
  • BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.

A 2023 draft compromise report by the European Parliament’s PEGA committee also summarized the government’s position on statutory limits for Pegasus use. It provides later context, but does not replace the primary written answer or turn the reported case count into an official statistic. Read the PEGA committee draft report.

What officials said in public briefings

July 19, 2021: operational details withheld

At a government press conference, Interior Ministry spokesperson Steve Alter declined to discuss which software security authorities used. He said serious telecommunications surveillance required judicial authorization. Asked specifically whether German federal authorities used Pegasus, he did not add to the government’s prior answer.

“Ich kann mich generell zu operativen Details der Arbeit unserer Sicherheitsbehörden ‑ etwa mit welcher Software wie gearbeitet wird – nicht äußern.”

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Translation: “I cannot comment generally on operational details of the work of our security authorities—for example, which software is used and how.” Read the July 19 briefing transcript.

Rank #2
Cryptnox FIDO2 Security Key with MIFARE DESFire NFC Smart Card for 2FA MFA
  • HARDWARE 2FA AND MFA: FIDO Alliance Certified FIDO2 v2.1 with CTAP2 plus legacy U2F and CTAP1 for strong two-factor login and passwordless sign-in on services that support security keys
  • BUILDING ACCESS ON ONE CARD: MIFARE DESFire EV2 4K applet with AES encryption adds office door and physical access control alongside digital authentication
  • CERTIFIED SECURE ELEMENT: An NXP Common Criteria EAL6+ certified secure controller and Java Card platform protects your keys on a tamper-resistant chip
  • DUAL INTERFACE SMART CARD: Contactless NFC ISO 14443 plus ISO 7816 contact reader support in an ISO 7810 ID-1 format that is passive and needs no battery
  • SWISS ENGINEERED DESIGN: Built by Cryptnox as a single card for authentication and access control and backed by a 2 year warranty

July 21, 2021: legal limits and oversight

Government spokesperson Martina Fietz said surveillance measures by German security authorities take place under statutory conditions and within prescribed limits. She added:

“Zudem unterliegt die Datenverarbeitung der deutschen Sicherheitsbehörden auch der Kontrolle unabhängiger Gremien.”

Translation: “In addition, data processing by German security authorities is also subject to the control of independent bodies.” The briefing described oversight but did not confirm Pegasus use. Read the July 21 briefing transcript.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What the legal framework does—and does not—establish

The government described telecommunications interception and online searches as technology-neutral powers. Its answer said they could be used only in individual cases, under strict legal conditions, to protect high-ranking legal interests or investigate serious or particularly serious crimes. It cited, among other provisions, sections 100a and 100b of the Code of Criminal Procedure (StPO), sections 49 and 51 of the Federal Criminal Police Office Act (BKAG), and provisions of the G-10 Act. See the legal-framework details in the government answer.

Rank #3
Sale
Thetis Pro-A FIDO2 Security Key Passkey Device with USB A & NFC, TOTP/HOTP Authenticator APP, FIDO 2.0 Two Factor Authentication 2FA MFA, Works with Windows/macOS/Linux/Gmail/Facebook/Dropbox/GitHub
  • FIDO2/Passkey Authentication – Secure, passwordless login with supported platforms. Check if your intended service supports hardware keys before purchase. Works with Gmail, Facebook, GitHub, Dropbox, and more.
  • Enhanced Multi-Factor Authentication (MFA): Strengthen account security using either FIDO2.0 authentication or TOTP/HOTP codes, providing flexible options for added protection.
  • Universal Connectivity: Features USB-A and NFC compatibility, making it easy to use across various devices including PCs, Macs, iPhones, and Android phones for seamless integration.
  • Durable & Portable Design: Built with a 360° rotating metal cover for extra durability. Compact and lightweight, it easily attaches to a keychain for on-the-go convenience. No batteries or network required, ensuring dependable use anywhere.
  • FIDO Certified & Business-Ready: Certified for FIDO standards and supported by a range of management software suites, ideal for both individual users and enterprise deployment.

Those general rules do not establish that a particular Pegasus operation met every legal requirement. The public answer does not provide the case-specific facts needed to assess any individual deployment.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Why the government’s other statements are not a blanket denial

The answer said the Federal Office for Information Security (BSI) had found no indications of NSO surveillance products in its regular review of cyberattacks against federal administration systems. It also said the government had no knowledge responsive to certain questions about people in Germany being spied on with Pegasus. These statements are limited to the questions and time covered by the answer; they do not establish that Pegasus was never used or that no one in Germany was targeted. See the relevant parliamentary question and answer.

The distinction matters: the written record confirms contact between ZITiS and NSO Group, while leaving acquisition and operational details undisclosed. The reported BKA use comes from the European Parliament study’s account of contemporaneous reporting, not an explicit public confirmation in that answer.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The Constitutional Court decision is broader context, not a Pegasus ruling

In a June 8, 2021 decision, Germany’s Federal Constitutional Court addressed the state’s responsibility to help protect information-technology systems from third-party attacks. It discussed the tension that can arise when police have an interest in keeping an undisclosed vulnerability available for source telecommunications surveillance, and said rules are needed to resolve that conflict.

The decision concerns vulnerability management and constitutional protections for the confidentiality and integrity of IT systems. It did not rule on Pegasus procurement, BKA operations, or the legality of any particular Pegasus deployment. Read the Federal Constitutional Court decision.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.