Confirming a phone’s infection is only step one, SMEX says.

Journalists and activists must assume every contact is now exposed.

Forensic scans can trace exploitation but resetting or updating the device destroys the evidence needed to attribute it.

Neither the spyware vendors nor their government clients face any duty to notify victims.

Sources: SMEX