Israeli spyware company NSO Group has said repeatedly that its surveillance tools do not work against smartphones based in the United States, but Americans traveling overseas and using foreign cellphones may not enjoy that protection. A list of more than 50,000 phone numbers that included some for documented surveillance targets also included the overseas phone numbers for about a dozen Americans, including journalists, aid workers, diplomats and others, according to an investigation by The Washington Post and 16 other news organizations. The investigation was unable to determine whether clients of NSO had delivered or attempted to deliver its Pegasus spyware to any of these numbers. But the presence of numbers used by American officials on the list highlighted questions about the national security threat posed by commercially available spyware.