One year ago, the Pegasus project revealed the unlawful targeting of activists and human rights defenders by governments using controversial surveillance software sold by NSO Group. The scale of the investigation – carried out by more than 80 journalists from 17 media organisations, including the Guardian, in 10 countries and coordinated by Forbidden Stories, with the technical support of Amnesty International – was shocking. The friends and family of murdered journalist Jamal Khashoggi were victims. Loujain al-Hathloul, a prominent Saudi women’s rights activist, had been targeted. Even renowned heads of state – such as Emmanuel Macron, Imran Khan and Cyril Ramaphosa – were identified as targets. Concerns were raised multiple times by Amnesty International and other organisations, but finally, with the leaked phone numbers and groundbreaking forensic research, we had the proof that civil society had been desperately searching for. The global reach of NSO Group’s Pegasus spyware was uncovered, and its lack of business ethics exposed for all to see. Surely, now, everything would change? In the 12 months since the Pegasus project launched, there have been some positive steps. We have seen politicians and parliamentarians around the world take notice and demand the lifting of the curtain of secrecy that sheltered unlawful targeted surveillance. We saw multiple complaints filed, civil litigation started, and big tech companies such as Apple hitting back with lawsuits against NSO Group. We’ve also seen high-level EU officials open official investigations into Pegasus. But the main issue remains: governments around the world still have access to Pegasus. They can still abuse it, completely unregulated and with no adequate judicial safeguards or oversight. NSO Group and its financiers are still profiting from facilitating targeted surveillance-related human rights violations. Activists around the world – including those working on vital issues such as exposing war crimes, fighting for access to land, clean drinking water, sexual and reproductive rights, education and so much more – are all still living in fear that their private communications are being unlawfully accessed. Understandably, they are still living in fear that the consequences of these breaches of their privacy go beyond the digital world and threaten their lives. More must now be done to highlight the existing regulatory and legal systems that are simply not fit for purpose, and continue to remind governments around the world that there is still work to do. There has to be a global moratorium on the sale, transfer and use of surveillance technologies. For example, despite years of exposure of Pegasus being used against human rights defenders and prominent journalists in Mexico – including Carmen Aristegui, whose child was also targeted because of their mother’s work – there are no indications that Mexico no longer uses Pegasus, or that NSO Group or the Israeli ministry of defence has limited export of the surveillance software to the country. Quite simply, self-regulation doesn’t work; a global moratorium is now needed. All those affected deserve for this to end; they deserve truth and justice to prevail. In another year’s time, hopefully we will have moved out of the shadow of Pegasus and changed the world after all. Danna Ingleton is deputy director of Amnesty Tech