I wonder what the selection criteria was. For example mexico is also not on the list

Mexico also abused Pegasus, right? I wonder if any national governments that are affiliated with NSO are restricted.

Mexico used their government licensed NSO tools to target the children of activists working to pass a sugar sweetened beverage tax.

https://deibert.citizenlab.ca/2017/02/mexico-nso-group-and-t...

If you look at the list at https://en.wikipedia.org/wiki/Pegasus_Project_(investigation... it seems like most of the countries that used pegasus are still on the allowed list, many of them much more extensively users than mexico was.

I really dont think nso group client is the pattern.

You're right. Main political opposition in India was affected with Pegasus and it is part of this program. I think this has more to do with the level of Apple's presence in a country/jurisdiction and their ability to retrieve the device back in case of misuse.

they made their own

This isn't really about skill. I imagine they want to only include countries that aren't big on cyber warfare.

Well they left USA on the list.

The laws around US citizens hacking the computers of US companies are straightforward and easily applied.

Right, but we aren't talking about private citizens but nation state actors with an interest in cyberwar capabilities. USA is probably near the top of that list.

It's kind of a lost cause when the government could just directly compromise Apple itself though? Maybe they are also fine with helping their own country's cyberwar abilities.