WhatsApp wins major legal case against Pegasus spyware maker NSO

WhatsApp wins a major legal case against NSO Group over Pegasus spyware, marking a key step in holding spyware companies accountable for unlawful surveillance of activists, journalists, and officials

WhatsApp secured a major legal victory against NSO Group Technologies, the Israeli company behind the controversial Pegasus spyware, late on Friday (December 20). The ruling marks a critical milestone in a high-profile lawsuit filed by Meta’s messaging app in the US in 2019.

 

The lawsuit accused NSO Group of using Pegasus to infect and surveil the phones of 1,400 individuals, including journalists, human rights activists, and government officials, during a two-week period in May 2019. The spyware, notorious for its invasive capabilities, was deployed to extract sensitive data from targets via WhatsApp.

 

Judge rules in favour of WhatsApp

 

US District Judge Phyllis Hamilton handed down a summary judgment in favour of WhatsApp, finding that NSO Group had violated both state and federal hacking laws, as well as WhatsApp’s terms of service. The court also determined that NSO Group had breached the US Computer Fraud and Abuse Act, a significant blow to the spyware maker.

 

 

In her ruling, Hamilton noted that NSO Group had obstructed the legal process by failing to provide WhatsApp with the spyware’s source code, despite being ordered to do so by early 2024. Instead, the company made the code accessible only in Israel and limited its review to Israeli citizens, a condition the judge called “simply impracticable.”

 

NSO Group will now face a jury trial in March 2025 to determine the damages it owes to WhatsApp, which remains the world’s most widely used messaging platform.

 

'Spyware companies should be on notice'

 

Following the decision, WhatsApp issued a powerful statement, saying, “After five years of litigation, we’re grateful for today’s decision. NSO can no longer avoid accountability for their unlawful attacks on WhatsApp, journalists, human rights activists, and civil society. With this ruling, spyware companies should be on notice that their illegal actions will not be tolerated.”

 

Pegasus and NSO Group under scrutiny

 

NSO Group has long claimed that its spyware is used solely by government clients for national security purposes. However, filings in the case revealed otherwise. The court found evidence that NSO Group directly operated Pegasus, installing the spyware and extracting data, which included photos, emails, and texts from both WhatsApp and iPhones.

 

The spyware has been linked to cyberattacks by authoritarian regimes worldwide. Victims of the 2019 breach included senior government officials, political dissidents, diplomats, and journalists. The Biden administration blacklisted NSO Group in 2021, barring US agencies from purchasing its products.

 

Pegasus scandal in India

 

In 2021, the Pegasus scandal set off a political storm in India as well. It was speculated that the Centre used Pegasus spyware to track 300 numbers used by Indian citizens, including a constitutional authority, several journalists, business persons, civil society leaders, and Opposition leaders.

 

However, the Supreme Court in 2022 said that its technical expert committee, after months of forensic scrutiny, could not find Pegasus spyware in the 29 mobile phones of complainants, but detected malware in five of them. “Based on detailed examination and analysis, it is concluded that five out of 29 phones may have had some infection due to a malware or poor cyber hygiene and the data available is limited to conclude that such anomaly is due to Pegasus, despite efforts for months using scientific methods,” the bench read out from the report submitted to it in a sealed cover.