Big win for WhatsApp: US judge finds Pegasus maker guilty in spyware case

A US judge on Friday ruled in favor of Meta Platforms’ WhatsApp in its ongoing lawsuit against Israel's NSO Group, which accuses the spyware company of exploiting a vulnerability in the messaging app to secretly install surveillance software on users' devices. The ruling by US District Judge Phyllis Hamilton marks a significant victory for WhatsApp, privacy advocates, and cybersecurity experts, as it holds NSO accountable for its actions.

The judge granted WhatsApp's motion for summary judgment, finding that NSO Group was liable for hacking and breach of contract. Hamilton's decision means the case will now proceed to trial, but only on the issue of damages. The court did not immediately set a trial date. NSO Group has not yet commented on the ruling.

In a statement following the decision, Will Cathcart, head of WhatsApp, celebrated the victory as an important step for privacy rights.

“We spent five years presenting our case because we firmly believe that spyware companies could not hide behind immunity or avoid accountability for their unlawful actions,” Cathcart wrote on social media. “Surveillance companies should be on notice that illegal spying will not be tolerated.”

What is the case?

The case stems from WhatsApp’s 2019 lawsuit, which accused NSO of exploiting a vulnerability in the app to install its notorious Pegasus spyware on the phones of over 1,400 individuals, including journalists, human rights activists, and political dissidents. The spyware, which was secretly installed without users' knowledge, allowed NSO’s clients—government agencies and law enforcement—to monitor the targets' communications, track their locations, and intercept private messages. WhatsApp claimed the hack violated both US and international laws.

NSO Group has long maintained that its software, Pegasus, is used exclusively by government agencies to combat terrorism and criminal activity, including tracking pedophiles and stopping organized crime. The company argues that its tools are vital for national security and law enforcement efforts.

However, this defense has been repeatedly rejected by US courts. In 2020, a trial judge denied NSO’s request for "conduct-based immunity," a legal doctrine that shields foreign officials from liability for actions taken in an official capacity. The decision was upheld by the 9th US Circuit Court of Appeals in 2021, which ruled that NSO’s licensing of Pegasus did not provide immunity under US law.

The company’s final appeal was rejected by the US Supreme Court in 2023, paving the way for Friday’s ruling.

Cybersecurity experts and privacy advocates hailed the court's decision as a landmark moment in the fight against digital surveillance and spyware companies. John Scott-Railton, a senior researcher at Citizen Lab, the Canadian research institute that exposed the Pegasus spyware in 2016, called the judgment "huge" for the broader spyware industry.

“Today's ruling makes it clear that NSO Group is responsible for breaking numerous laws,” Scott-Railton said in a statement. “The entire spyware industry has long tried to argue that they’re not responsible for how their tools are used, but this decision sets a powerful precedent that will hold companies accountable for their actions.”

Repercussions of the ruling

WhatsApp's lawsuit not only seeks damages but also an injunction to prevent NSO from using its software to spy on individuals in the future. While the case now heads to trial on the issue of damages, legal experts suggest the ruling could have far-reaching consequences for the industry, especially if it sets a new standard for holding spyware manufacturers liable for their products’ use.

The judgment comes amid growing concerns over digital privacy and government surveillance, as well as heightened scrutiny of companies that sell hacking tools to governments. Critics argue that such tools often end up in the hands of oppressive regimes that use them to target journalists, political opponents, and other critics.

For now, the case against NSO Group remains ongoing, but Friday's ruling is seen as a clear win for WhatsApp and the broader fight for digital privacy rights.