Abstract
This essay examines the regulatory lacuna in international governance that permits cross-border state surveillance technologies such as the Pegasus spyware to operate with minimal accountability, particularly in the Global South. It advances the concept of a “surveillance asymmetry of regulation,” a structural misalignment in which transnational spyware markets distribute surveillance capability across borders while confining regulatory authority within territorially fragmented domestic systems. As a result, exporting states regulate transfer, importing states absorb constitutional risk, and individuals experience rights violations within jurisdictions that lack authority over upstream supply chains. While India’s Supreme Court proceedings illuminate domestic constitutional remedies, similar patterns of judicial intervention are evident in Mexico, Brazil, and Morocco, where courts have acted as compensatory regulatory actors in the face of weak executive oversight and ineffective international norms. Pegasus, developed by the Israeli firm NSO Group, exemplifies a class of commercial intrusion software capable of covertly infiltrating personal devices and facilitating comprehensive monitoring. Empirical evidence demonstrates that its deployment frequently extends beyond counter-terrorism and serious crime investigations to journalists, political opponents, lawyers, and human rights defenders. By situating these developments within international export control regimes, human rights law, and cyber norms, the essay argues that contemporary international law regulates the circulation of surveillance technology without adequately regulating its constitutional consequences. In the absence of structural reform, domestic courts in the Global South remain reactive institutions tasked with addressing harms generated by transnational surveillance markets over which they exercise limited upstream control.



![Author ORCID: We display the ORCID iD icon alongside authors names on our website to acknowledge that the ORCiD has been authenticated when entered by the user. To view the users ORCiD record click the icon. [opens in a new tab]](https://www.cambridge.org/engage/assets/public/coe/logo/orcid.png)