WhatsApp has achieved a significant legal victory against the NSO Group, the creators of the notorious Pegasus spyware. On Friday, a judge from a US District Court ruled in favor of the Meta-owned messaging service, determining that the Israeli firm is responsible for hacking the devices of 1,400 individuals and infecting them with spyware through WhatsApp’s servers. The court also found NSO Group in violation of federal hacking laws as well as California state laws, and held the company accountable for breaching WhatsApp’s terms of service.
WhatsApp Wins Lawsuit Against NSO Group
Judge Phyllis Hamilton granted WhatsApp’s motion for summary judgment against the NSO Group, stating that the company violated the federal Computer Fraud and Abuse Act (CFAA) and the California Comprehensive Computer Data Access and Fraud Act (CDAFA). A separate trial has been scheduled for March 2025 to determine the financial damages that NSO Group owes to WhatsApp. The judge has requested that both parties inform the court by January 17, 2025, regarding any expert-related motions that need to be addressed before the damages trial.
Will Cathcart, Head of WhatsApp, praised the ruling as “a huge win for privacy” in a recent post on Threads. He emphasized the company’s commitment to holding spyware firms accountable, stating, “We spent five years presenting our case because we firmly believe that spyware companies could not hide behind immunity or avoid accountability for their unlawful actions. Surveillance companies should be on notice that illegal spying will not be tolerated.”
This ruling comes nearly two years after the US Supreme Court allowed WhatsApp to advance its lawsuit against the NSO Group, which had allegedly exploited a vulnerability in the messaging application to deploy Pegasus spyware. WhatsApp argued that the spyware was improperly installed and used for surveillance on a range of individuals, including journalists, politicians, and human rights advocates.
Judge Hamilton noted that NSO Group had consistently failed to provide WhatsApp with the source code of the spyware, which was a key factor in her decision to grant sanctions. Significantly, the Israeli company had only shown the source code of Pegasus to one Israeli citizen, an action the judge described as “simply impracticable.”
WhatsApp initially filed its lawsuit against NSO Group in 2019, seeking both an injunction and damages. At that time, NSO Group contended that the purpose of Pegasus was to aid in the detection of terrorists and hardened criminals, asserting that it was intended to assist law enforcement and intelligence agencies in combating crime and safeguarding national security.
