WhatsApp has secured a significant legal victory in its battle against Israeli spyware developer NSO Group, with a US court ruling that the company violated hacking laws and the messaging platform’s terms of service. The judgment, issued by Judge Phyllis Hamilton of the Northern District of California, establishes a critical precedent in the fight against cyber surveillance abuses, according to the Financial Times.
The case centered on NSO’s use of its Pegasus hacking tool to exploit WhatsApp and infiltrate over 1,000 devices, including those of journalists, activists, and dissidents. Pegasus is a powerful spyware capable of reading encrypted messages, activating a phone’s camera and microphone remotely, and tracking its location.
The court found that NSO reverse-engineered WhatsApp’s software and injected spyware onto devices, in clear violation of federal and state hacking laws. Judge Hamilton rejected NSO’s argument that it might have accessed WhatsApp’s software without agreeing to its terms of service, stating that such claims lacked credibility.
“This decision affirms that NSO is accountable for its unlawful attacks on WhatsApp and those who rely on our platform,” WhatsApp said following the ruling. “We are grateful for today’s outcome after five years of litigation.”
The ruling did not address the rights of individuals targeted by Pegasus but marks a victory for technology companies like Apple, Amazon, and others that supported WhatsApp’s case. The legal battle, initiated after a Financial Times investigation in 2019 revealed the Pegasus hack, has drawn global attention to the risks posed by spyware to human rights and digital privacy.
John Scott-Railton, a researcher at the Citizen Lab at the University of Toronto, described the decision as a landmark moment. “This sets a precedent that will be cited for years to come,” he said. “It will likely have a chilling effect on shady spyware companies looking to enter the US market and on investors considering backing these tools.”
The US Department of Commerce has already blacklisted NSO Group due to its association with human rights abuses. The court’s summary judgment leaves only the question of damages unresolved in the civil case, signaling that NSO could face significant financial penalties.
