Intelligence activity appears in the public record unevenly. Declassified material identifies historical agency relationships, while court judgments sometimes establish that intelligence or police powers were exercised unlawfully. Corporate documents reveal business relationships without necessarily showing who controlled a covert operation. The records here distinguish what the evidence proves from the questions it leaves open.
Original sources through October 19, 2026Each searchable case explains a documentary conclusion, not a separate criminal investigation. Some cases concern judicial decisions that establish a rights violation. Others rely on regulatory findings or a company's own claims about its services. Read the source and its stated limitations before concluding that two named people or institutions conducted the same operation.
The map shows source-documented relationships between institutions and locations, not where an individual intelligence target lived. A similarly named company in Britain and another in Nigeria are retained only as an identity check, with no connecting line. Redacted foreign counterparties are not identified through speculation.
The UK tribunal judgment establishes a reporter's unlawful source-data surveillance. A U.S. foreign-agent filing records consulting payments but cannot independently establish their influence on intelligence decisions. Both belong in the Atlas, with different evidentiary consequences.
A statutory supervisor's conclusion about unlawful data retention can establish a specific compliance failure. An exploratory inspection of new technology may identify management shortcomings without ruling on the legality of any deployment. A government sanctions decision states an executive agency's determination, while company marketing describes a claimed service rather than verified payment execution. Court filings require attention to what a judge actually resolved. Each case links its controlling document and records the limits of that evidence.
Each geographic connection has a documentary source. A public cybersecurity advisory signed by several agencies establishes co-authorship; a consultancy payment establishes a financial transaction. Neither automatically demonstrates a covert operation or a recipient's knowledge of misconduct.
Read the named institution, year and type of inspection before treating cases as comparable. Independent watchdogs can collaborate on review techniques without their intelligence services coordinating an operation. A staff secondment between oversight bodies is documented as supervisory cooperation and remains separate from the map of operational relationships.
Three intelligence AI reviews illustrate why legal classification is essential. Denmark's overseer demonstrated that an internally operated language model could return personal data to employees and required additional attention to data handling; the agency reported safeguards and reactivation. The Dutch inspector described governance and policy weaknesses without making findings about the legality of particular AI tools. The New Zealand inspector reported human decision-making in reviewed AI-assisted workflows while identifying documentation improvements. The Danish original report provides the underlying prompt-test finding. These reports address different systems and do not themselves establish collaboration in surveillance.
Sixteen geographic relationships have documentary support. Their labels describe exactly what the underlying source establishes: a contract, payment, collaboration agreement, government advice or commercial deployment. A location on this map is a public institutional anchor, not the route an intercepted message followed. Redacted or unnamed foreign intelligence partners are not included as additional geographic links, even when independent inspectors identify a failure to obtain approval for contact with them.
A UK-registered business and a similarly named Nigerian firm were checked in company records. They are distinct legal entities, and the current sources establish no ownership, payment or operational relationship between them. The comparison remains documented, but it no longer draws a map line or appears in the list of geographical relationships. Review the UK company filing.
Canada's reviewer discussed deletion procedures for intelligence shared with redacted partners. Australia's inspector separately identified one unapproved disclosure by its national intelligence office, plus potential permission problems at another agency. None of those sources identifies a counterpart. Denmark's documented Canadian staff secondment occurred between watchdogs, not between covert operating units. These records can be searched without being depicted as country-to-country missions.
The Australian report offers a practical example of legal distinctions. A historical ASIS liaison disclosure and an ONI disclosure to an unapproved recipient are described as confirmed legal breaches. A separate ASD foreign-cooperation episode is described as potentially noncompliant, with ministerial authorization obtained afterward. Its inspector observed no related human-rights violation. The original Australian oversight report records those different results, while Canada's technical deletion inspection assesses how selected records were actually erased. The agencies and time periods should not be merged into a single operation.
Choose a topic or search by country, institution or company. Select a map marker to read the associated case. The map is schematic; coordinates indicate places connected to the evidence, not private addresses or crime scenes.
Points are geographic approximations associated with the source documents. Lines represent only the described relationships; dashed comparison paths do not assert a direct organizational connection.
The Ghana National Communications Authority's $4 million transfer to Infraloks is the starting amount in one procurement chain. The Ghanaian court separately identified $1 million in the supplier transaction and discussed a further $3 million remittance that bank conditions delayed. Those figures describe stages in the same commercial arrangement. The records do not support combining them into a larger confirmed payment total. Read the court judgment with the national audit.
U.S. foreign-agent records provide a second distinction. NSO's 2021 signed consultancy agreement credited the initial $100,000 retainer toward monthly fees. Chartwell's later receipt ledger records that payment on January 10, 2022; the earlier exhibit says payment on January 11 activated the agreement. Pillsbury's subsequent payment entries to Chartwell also appear as Chartwell receipts and therefore refer to the same money. The original contract, Chartwell supplemental report and Pillsbury ledger preserve the individual reporting dates and the direction of each entry.
A7 International's October 2026 platform described a USDT-funded invoice service using unnamed settlement providers. This is a current commercial description without bank-execution receipts. A sanctions designation or proposed financial restriction must be evaluated according to its own legal status; neither proves that an identified A7 International transfer cleared through an identified bank.
The same intelligence system can appear in a statutory inspection, a court judgment and an annual statistical report. Those documents do not make equivalent claims. A tribunal can decide that an identified intrusion was unlawful. A legislative transparency report can establish aggregate use of an authority without deciding whether each operation complied with the law. A supervisory recommendation identifies a control weakness, which must not be inflated into proof of a crime.
The UK's July 2026 tribunal judgment found unlawful access and later use of Vincent Kearney's telephone source information, and awarded £10,000 each against MI5 and Northern Ireland police. The separate participation of GCHQ as a named respondent was not a finding of liability. The court's full public judgment supplies the chronology and the specific remedy.
US Section 702 target estimates concern non-US persons. American-person query terms can refer to more than one term per individual, while identity unmasking is a separate type of administrative disclosure. The 2025 counts are not interchangeable, nor does an increase show that any named person was unlawfully monitored. ODNI's full original 2025 report documents the counting rules and approved judicial certification changes.
Sweden's defence-intelligence watchdog counted 33 completed review files in 2025, with three agency observations. Finland's Intelligence Ombudsman separately counted 148 visits and 15 investigation requests. A completed inspection, an on-site supervisory visit and a submitted complaint are different events. None is automatically a count of intelligence abuses or surveillance targets.
The original Swedish SIUN report, signed February 18, 2026, records both inspector comments and sampled checks producing no objection. Two of the 33 closed review files had begun in 2024. Neither annual totals nor favorable samples support universal claims about lawful or unlawful surveillance.
The Finnish Intelligence Ombudsman's original summary reports visits and complaints in separate graphs. Its section on exchanging oversight methods with Nordic counterparts concerns independent statutory reviewers, not a documented joint intelligence operation.
Each case identifies the document behind a specific conclusion. A judicial ruling, annual watchdog review, contract and official survey establish different facts. Several cases may derive from the same primary report, so the number of entries is not a count of illegal acts, affected persons or separately acquired documents.
The timeline includes historical events and dates on which official records were released. Some archival sources identify only a year, which is displayed without claiming an exact day. A 2026 watchdog report may investigate older conduct and a proposed law is not enacted power. Open the underlying document for precise chronology.
Select a document to inspect the original in the page or open it in a new tab. Government orders, archived intelligence records and independent forensic reports retain their original evidentiary classifications. External sites may block embedding, so direct links always remain available.
An empty viewer means the external publisher prevents embedded display. Use the original source link above.
These two photographs come from the U.S. Department of Justice's October 13 press release concerning an alleged recording-device case. They are evidence presented with an unadjudicated criminal complaint. The captions identify what the government says the images show.
DOJ exhibit, criminal complaint context. Government attribution; no foreign-intelligence sponsor established.
The image is presented in the release as part of the government's complaint. It is not a finding of guilt.
Optional computer-generated narration of the selected case file, produced by your device. This is not an original intelligence recording or witness testimony.
Video evidence: No case-specific video has been verified and licensed for embedding in this version. Original footage can be added only after its provenance and playback rights are established. The Citizen Lab BlackCore case study contains documented screenshots of an influence operation; its images remain on the originating publication for attribution and licensing.
The FARA disclosure registers contain three distinct reporting firms. Pillsbury's payments to Chartwell are the same four transactions that Chartwell reported as receipts. The separate Paul Hastings receipts are not part of this confirmed matched quartet.
NSO Group → Pillsbury → Chartwell
Chartwell received four $50,000 consulting installments between October 2024 and January 2025, for a total of $200,000. Pillsbury reports the matching $200,000 paid out. This is one stream recorded twice, not $400,000.
Q Cyber / NSO Technologies → Paul Hastings
In December 2024, Paul Hastings separately reported three receipts totaling $60,000, some paying for services undertaken in 2023. These are not represented as a fourth firm's downstream commissions.
December 20, 2021: NSO–Pillsbury–Chartwell signed agreement. October 16, November 13 and December 11, 2024: three $50,000 transfers reported. January 29, 2025: fourth $50,000 transfer. February 25, 2025: Pillsbury's registered representation ended. February 28, 2025: Chartwell's registered representation ended. The original agreement's $100,000 opening retainer was credited to the first two months, not an extra fee.
These are original self-reported U.S. regulatory filings. No later criminal finding or agency approval is implied.
A jury verdict is not always the entered final judgment, an appellate stay is not an appeal judgment, and a company's commercial autonomy does not necessarily tell you who legally owns it. The source distinctions below remain attached to individual Atlas cases.
May 2025 jury verdict: $167,698,719. November 12, 2025 final district judgment: $4,447,190, following remittitur of punitive damages. The final judgment is under appeal.
Case 25-7380: the court denied a motion to stay the injunction on January 28, 2026. Case 26-874: the appeal of the final judgment opened February 12, 2026. An appeal filing is not a merits ruling.
United Stream (INN 9701326060, OGRN 1267700083529) shares a founder with PV Bridge according to the EU's October 15, 2026 annex. HURUS TRADE FZE is separately described as supplying crude oil to Nayara Energy. These are regulatory findings, not demonstrated direct transactions with A7 or intelligence services. This reader links to a third-party reproduction of the official annex because the official EUR-Lex page could not be read in the research environment.
Read the reproduced legal annex · Read the official EU announcement
Two NSO lawsuits can produce different outcomes without contradicting each other. The parties, places, procedural questions and evidence were different. Start with the court's precise decision.
$4,447,190 damages entered November 12, 2025 after reduction of the earlier jury amount. $15,914,095 separate attorney's fees awarded January 30, 2026.
This case concerns NSO access to WhatsApp systems, resulting in a California liability judgment. The litigation is subject to separate appellate proceedings; the fees are not confirmed as paid.
Dismissed for lack of personal jurisdiction in a May 21, 2025 Fourth Circuit decision.
The appeals court held that NSO's alleged conduct was insufficiently connected with Virginia to permit the lawsuit there. It did not find that the alleged spyware use did not happen, nor did it identify a proven state operator.
2019 filing: WhatsApp identified Q Cyber as an NSO majority shareholder and OSY Technologies SARL as Q Cyber shareholder based on dated corporate annual reports referenced in the lawsuit. Its pleading calls WestBridge the U.S. sales arm.
2024 testimony: An NSO witness described operational autonomy for the U.S. company. That does not necessarily exclude an earlier equity relationship.
Still unavailable: certified historical corporate registry extracts, ownership instruments and post-2019 changes. The documents support dated descriptions, not present ownership.
The financial numbers come from Britain's audited security and intelligence accounts. The partnerships are backed by signed government statements and joint agency publications.
Britain's MI5, SIS and GCHQ combined departmental resource and capital spending in 2025–26, compared with £5.214 billion in the preceding financial year.
FBI, CISA, NSA, UK NCSC, Australia's ASD cyber centre, Canada's Cyber Centre, Japan's NPA and National Cybersecurity Office, New Zealand's NCSC and Spain's CNI jointly issued one evidence-based October 2026 cyber advisory.
2025–26 departmental budget expenditure was £5.762bn, made up of £4.090bn resource outturn and £1.672bn capital outturn. Separately, the IFRS consolidated financial statement reports £4.642bn net operating expenditure, which is not an additional sum. Published reporting covers the three agencies together.
Canada publicly disclosed 323 foreign intelligence arrangements, while its independent reviewer documented specific failures in joint surveillance authorization and safeguards for Canadians.
323 foreign arrangements in 158 countries and territories. In the same year CSIS reported 100 warrants and 16 threat-reduction measures. Foreign arrangements do not name all partners, and measures are separate from court authorization.
NSIRA identified two incidents contrary to Federal Court directions during joint CSIS–CSE collection, and insufficient safeguards against indirect targeting of Canadians. The examined operations were primarily from 2016–2021, even though the review was published in 2026.
NSIRA also examined how CSIS authorized conduct that would ordinarily be prohibited under section 20.1. It found sampled operations stayed within the framework’s statutory limits, but separately identified possible failures of authorization, designation and reporting, including missing 2019–2022 public reports.
Independent inspectors did not all reach the same legal conclusion. The source documents identify the conduct and the standard actually applied.
The CTIVD found bulk personal data accessed by staff without legal authority and stored too long. Its 2026 report issued thirteen remedial recommendations.
AI analysis tools expanded before a complete centralized inventory and adequate policies were in place. This separate inquiry assessed governance risks, not the legality of every system.
The intelligence inspector found activities related to the 2023 general election lawful and politically neutral. Some data intended for deletion remained stored, and records of political briefings were incomplete.
The June 2026 review found AI used to assist human analysts rather than make decisions independently. The inspector identified documentation improvements even in this more cautious deployment.