[case0x00]

Maybe because the initial reporting got so much traffic, Citizenlab pushed far more resources into investigating NSO products? Maybe its political in nature? I can't imagine the reasoning is technical incompetence by NSO (have you read the FORCEDENTRY writeups? its insane). Maybe NSO's clients more haphazardly pursue targets, so there is a higher probability of recovering some forensic evidence?

[sangnoir]

Didn't the NSO also attempt a "sting operation" on Citizenlab? They don't particularly come off as sympathetic and/or competent (politically); especially after targeting American diplomats in Uganda.