An Israeli government probe into allegations of police spying on citizens using Pegasus malware on February 21 said police successfully infected the phone of one individual subject to a court order.

The finding represents the first time the Israeli government has confirmed that the deeply controversial spyware – ostensibly developed by Israeli firm NSO Group as a counter-terror tool for government clients – has been deployed against a citizen of the Jewish state.

But the probe, backed early this month by Prime Minister Naftali Bennett, challenged allegations in Israeli business daily Calcalist that police had hacked the phones of dozens of Israelis who were not criminal suspects.

“There is no indication that the Israeli Police used the Pegasus system in its hands to infect, without a court order, a mobile phone from the list of people that was published in the press,” said the three-person investigation team, headed by Deputy Attorney General Amit Merari.

But “two people who were subject to a court order authorising tracking of computer communications were found”, and there was “an attempt at infection” in those two cases.

“The infection succeeded” in one of those cases, the investigation found.

Pegasus enables users to remotely activate a phone’s microphone and camera and suck up the data inside.

The US blacklisted NSO Group in November following a global investigation that revealed Pegasus has been used by repressive regimes to target journalists, dissidents, diplomats and others.

Israel itself was then rocked last month when Calcalist reported police used Pegasus on citizens, a claim police denied.

The newspaper said ex-advisors of former prime minister Benjamin Netanyahu, as well as his son Avner, senior leaders of government ministries and protest leaders figured among a list of 26 people targeted by police using the malware.

A key witness in an ongoing trial of Netanyahu for alleged corruption was one of those named as a target.

Prime Minister Naftali Bennett said the reported conduct was “unacceptable in a democracy”.

Calcalist said in an editorial on February 21 that the preliminary probe “requires serious consideration and a new check of the findings . . . published in Calcalist”, promising to undertake such a check.

Israeli public security minister Omer Bar Lev on February 21 wrote on Twitter that the report was “a resounding acquittal for the Israeli police”.

Anat Ben-David, associate professor of communication at the Open University of Israel and co-founder of Privacy Israel, said the probe’s findings “refute the claims made by Calcalist about the infection of these individuals’ phones without a court order”.

However, she said, the report revealed that police had been using Pegasus, and that they appeared to be relying on court orders to authorise the spying.

Merari’s team said it will continue its probe to find whether Pegasus or other software was used without a court order on Israelis by extending the search beyond the 26 individuals listed by Calcalist.

She wrote that the probe will also examine whether police exceeded their authority in using spyware on citizens.