WhatsApp Wins Ruling Against NSO Group as US Court Finds It Liable for Pegasus Spyware Hack

WhatsApp claimed a legal win over the NSO Group, the makers of the Pegasus spyware, on Friday. A US District Court judge ruled in favour of the Meta-owned platform and found that the Israeli company is liable for hacking 1,400 individuals' devices and infecting them with spyware via the instant messaging platform's servers. The judge also found the company in violation of the federal US hacking laws as well as those of the State of California. Additionally, NSO Group was also held liable for breaching WhatsApp's terms of service.

WhatsApp Wins Lawsuit Against NSO Group

The US District Court Judge Phyllis Hamilton, in the ruling, granted WhatsApp's motion for summary judgment against NSGO group and found that the Israeli company violated the federal Computer Fraud and Abuse Act (CFAA) and the State of California's Comprehensive Computer Data Access and Fraud Act (CDAFA).

A separate trial will be held in March 2025 to ascertain the damages NSO Group owes WhatsApp. Hamilton also asked both parties to notify the court by January 17, 2025, if any expert-related motions need to be resolved before the trial on damages.

Will Cathcart, the Head of WhatsApp, called the ruling “a huge win for privacy” in a post on Threads. “We spent five years presenting our case because we firmly believe that spyware companies could not hide behind immunity or avoid accountability for their unlawful actions. Surveillance companies should be on notice that illegal spying will not be tolerated,” he added.

The ruling on the Meta-filed lawsuit comes nearly two years after the US Supreme Court permitted WhatsApp to pursue the lawsuit accusing the NSO group of exploiting a bug in the messaging app to install the Pegasus spyware. The company had claimed that the spyware was installed in an unauthorised manner and was used for the surveillance of 1,400 people including journalists, politicians, and human rights activists.

During the Friday ruling, Hamilton highlighted that the NSO Group repeatedly failed to provide WhatsApp with the source code of its spyware. This was one of the main reasons behind granting the messaging platform's request for sanctions. Notably, the Israeli firm only showed the source code of the Pegasus spyware to one Israeli citizen within the country. The Judge called the move “simply impracticable”.

WhatsApp first filed a lawsuit against the Israeli company in 2019 seeking an injunction and damages. At the time, NSO Group had argued that the intended usage of Pegasus was to help catch terrorists and hardened criminals and it was aimed at helping law enforcement and intelligence agencies fight crime and protect national security.