A U.S. federal judge ruled that the Israeli spyware firm NSO Group violated hacking laws by using WhatsApp to hack devices with its Pegasus spyware. A Northern California judge made a landmark decision. It held NSO Group accountable for targeting 1,400 WhatsApp users, including human rights defenders, journalists, and diplomats. The court found that NSO breached state and federal hacking laws.
It also broke WhatsApp’s terms of service, which forbid malicious use of the platform.The case originated five years ago when WhatsApp, owned by Meta, filed a lawsuit against NSO Group. The suit alleged that NSO exploited a WhatsApp audio-calling flaw to deliver its spyware without users’ knowledge. Judge Phyllis Hamilton’s ruling highlighted that NSO must have reverse-engineered or decompiled WhatsApp’s software to carry out the attack.
She noted that there was no plausible explanation for how NSO could have accessed the platform without agreeing to its terms of service. The judge criticized NSO for not complying with discovery orders. NSO refused to provide the Pegasus source code and emails about WhatsApp vulnerabilities. The court had serious concerns about NSO. It was not transparent and unwilling to cooperate with the judiciary.
The decision is a big win for WhatsApp. It shows the world is scrutinizing spyware makers more. Meta spokesperson Emily Westcott supported Friday’s ruling against NSO Group. She said it is a win for privacy and accountability. Westcott stressed that NSO must be accountable for its actions. They targeted WhatsApp, journalists, human rights advocates, and civil society.
She affirmed WhatsApp’s commitment to private communications. She thanked the organizations that supported the case. Will Cathcart, head of WhatsApp, called the ruling a win for privacy in a post on X. NSO spokesperson Gil Lainer declined to comment. The company has defended its Pegasus spyware. It helps law enforcement and intelligence agencies fight crime and protect national security.
The case will now advance to a jury trial in March 2025, where the damages NSO Group must pay to WhatsApp will be determined.
