A U.S. federal judge has ruled that the Israeli spyware firm NSO Group is liable for violating anti-hacking laws by exploiting WhatsApp to install its Pegasus malware on user devices. This landmark decision marks a significant turning point in a five-year legal battle between Meta-owned WhatsApp and the controversial surveillance software provider.
Court Finds NSO Group Liable for Pegasus Exploits
In a historic ruling delivered on Friday, Northern California District Judge Phyllis Hamilton held NSO Group accountable for targeting approximately 1,400 WhatsApp accounts. The court determined that the company breached both state and federal hacking statutes, as well as WhatsApp’s terms of service, which explicitly forbid the use of the platform for malicious activities.
The litigation traces back to 2019, when WhatsApp alleged that NSO Group exploited an audio-calling vulnerability to bypass security protocols. Targets of this surveillance included journalists, human rights defenders, diplomats, and various government officials.
The Technical and Legal Breakdown
Judge Hamilton dismissed NSO’s attempts to distance itself from the breach. While the company argued that it may not have violated terms of service if it reverse-engineered the software before agreeing to them, the judge rejected this logic. She noted that “common sense dictates” that NSO must have gained access to the platform, and the company failed to provide any plausible explanation for how it could have accessed the system without violating the agreement.
Furthermore, the court highlighted NSO’s repeated obstruction of the judicial process. Despite specific court orders, the company failed to produce critical discovery materials, including the Pegasus source code and internal communications regarding WhatsApp vulnerabilities.
“NSO’s lack of compliance with discovery orders raises serious concerns about their transparency and willingness to cooperate with the judicial process,” stated Judge Hamilton.
Accountability for Spyware Makers
Meta spokesperson Emily Westcott celebrated the ruling, emphasizing that the decision serves as a warning to the broader spyware industry. “NSO can no longer avoid accountability for their unlawful attacks on WhatsApp, journalists, human rights activists, and civil society,” Westcott stated. “With this ruling, spyware companies should be on notice that their illegal actions will not be tolerated.”
Will Cathcart, the head of WhatsApp, echoed these sentiments, labeling the outcome a “huge win for privacy” in a post on X.
Next Steps: The Road to Trial
While NSO Group has historically defended its Pegasus software as a necessary tool for law enforcement and national security, the firm declined to comment on the latest ruling. The case is now set to proceed to a jury trial in March 2025, where the court will determine the specific damages NSO Group must pay for its role in the unauthorized infiltration of the messaging service.