An Israeli commission reviewing allegations that NSO Group’s Pegasus spyware was misused by its customers to target journalists and human rights activists will examine whether rules on Israel’s export of cyberweapons such as Pegasus should be tightened, a senior MP has said. The move came as the French president, Emmanuel Macron, convened an emergency cybersecurity meeting after reports his mobile phone and those of government ministers appeared in the leaked list. An official in Macron’s Elysee Palace said that the president’s phone and phone numbers had been changed. NSO has said Macron was not a “target” of any of its customers, meaning the company denies he was selected for surveillance using its spyware, saying in multiple statements that it requires its government clients to use its powerful spying tools only for legitimate investigations into terrorism or crime. The German chancellor, Angela Merkel, added her voice to the escalating controversy on Thursday, telling reporters in Berlin that spyware such as NSO’s should be denied to countries where there was no judicial oversight, after it emerged 14 heads of state were on the list. Asked whether she regretted that technology sold by NSO Group had helped to undermine freedom of expression in countries governed by autocratic regimes, Merkel said: “I believe it is important that software developed for certain situations does not fall into the wrong hands. There have to be restrictive conditions and such software should not be sold to countries where judicial oversight over such attacks cannot be guaranteed.” The growing fallout from the revelations of the Pegasus project, a collaboration of 17 media organisations including the Guardian, which launched on Sunday with a series of claims about misuse of the software, has continued to resonate. In Israel the prospect of tighter controls on the export of spyware such as Pegasus was raised by Ram Ben-Barak, the head of parliament’s foreign affairs and defence committee – and a former deputy head of the Mossad spy agency – on Army Radio as he disclosed that Israel’s “defence establishment [has] appointed a review commission made up of a number of groups”. “We certainly have to look anew at this whole subject of licenses granted by DECA [Israel’s Defence Exports Control Agency],” he said. “When they finish their review, we’ll demand to see the results and assess whether we need to make corrections.” DECA is within Israel’s defence ministry and oversees NSO exports. The ministry and the company have said Pegasus is meant to be used to track terrorists and criminals only, and that all foreign clients are vetted governments. At the heart of the project is a leaked database of about 50,000 mobile phone numbers. The Guardian and other media partners that had access to the data believe the list indicates persons of interest selected by government clients of NSO. It includes some people whose phones showed traces of NSO’s Pegasus spyware, according to forensic analysis of their devices. The appearance of a number on the leaked list, however, does not mean it was subject to an attempted or successful hack. NSO says the database has “no relevance” to the company, and has rejected the reporting by the Pegasus project as “full of wrong assumptions and uncorroborated theories”. It denied that the leaked database represented those targeted for surveillance by the Pegasus software. The alleged misuse has stirred questions within Naftali Bennett’s cross-partisan coalition, one of whose members, the liberal party Meretz, questioned the defence minister, Benny Gantz, about NSO exports in a meeting on Thursday. Gantz “emphasised the importance of upholding human rights within the framework of weapons sales”, a joint statement said.