NSO Group, the controversial Israeli spyware developer, has found itself at the center of a landmark legal battle after being found liable for hacking the devices of more than 1,400 WhatsApp users. The ruling is considered significant for privacy advocates and marks one of the few instances where a technology company has successfully held another accountable for using its platform for malicious purposes.
On December 21, 2024, U.S. District Judge Phyllis Hamilton ruled against NSO Group, confirming allegations made five years prior when WhatsApp, owned by the parent company Meta, filed suit. This federal court decision highlighted the misuse of WhatsApp's services to deploy Pegasus spyware—a tool infamous for its stealthy and invasive nature, often employed by authoritarian regimes to surveil and suppress high-risk individuals, including journalists and human rights activists.
The saga started on October 29, 2019, when WhatsApp accused NSO Group, also known as Q Cyber Technologies, of exploiting key vulnerabilities within its platform. The court established NSO's actions constituted serious breaches of both federal and California state laws by unlawfully accessing WhatsApp’s servers and deploying its Pegasus spyware. The legal victory enables WhatsApp to proceed to trial to ascertain the damages to be paid by NSO Group, which has continually contended it operates independently of its clients’ use of the spyware technology.
WhatsApp's leaders hailed the ruling as not just a win for them but for privacy as well. Will Cathcart, the head of WhatsApp, expressed the sentiment via social media, asserting, "This ruling is a huge win for privacy. We spent five years presenting our case because we firmly believe spyware companies could not hide behind immunity or avoid accountability for their unlawful actions." This reflects broader hopes among privacy advocates for increased scrutiny and regulation of spyware technologies.
The court’s ruling was particularly notable for establishing NSO Group’s liability for its actions. Judge Hamilton stated unequivocally, "The defendants appear to fully acknowledge...the [WhatsApp Installation Server] sent messages through WhatsApp servers, causing Pegasus to be installed on target users’ devices," confirming the violation of WhatsApp's terms of service which explicitly prohibiting such exploitations.
That NSO Group failed to present evidence, such as the requested source code for its Pegasus software, raised additional flags about the company’s commitment to transparency. With Judge Hamilton noting the absence of sufficient explanations from NSO about how it accessed WhatsApp without violating terms of service, the court’s findings stand as both damning and clarifying against the backdrop of the spyware industry.
Human rights defenders have welcomed this verdict as it emphasizes the urgent need to regulate such technologies, particularly as NSO Group has faced consistent accusations of facilitating surveillance against dissidents and journalists worldwide. The court underscored the real-world consequences of technology misuse, especially as Pegasus spyware has been connected to several high-profile breaches involving U.S. diplomats and notorious cases like the murder of journalist Jamal Khashoggi.
John Scott-Railton, senior researcher at Citizen Lab, commented on the ruling’s wider implication, stating, "Big loss for NSO. Bad time to be a spyware company. Landmark case. Huge implications." His statements capture the shifting narrative around surveillance firms, which now operate under greater scrutiny than ever before.
Despite maintaining its stance of relative separation from its clients, NSO Group's defenses have repeatedly proven ineffective, as evidenced by both the court’s ruling and growing international backlash against the invasive qualities of tools like Pegasus. The upcoming trial scheduled for March 2025 is set to address the financial reparations owed to WhatsApp, which could set new precedents for future accountability within the surveillance industry.
Meta’s spokesperson, Emily Westcott discussed WhatsApp's commitment to protecting user communications, emphasizing the importance of the ruling for the industry at large. "With this ruling, spyware companies should be on notice...that their illegal actions will not be tolerated," she stated, reinforcing the idea of increased vigilance against threats to personal privacy.
The ramifications of this case highlight the tension between technological innovation and ethical responsibility, calling attention to the urgent need for regulatory frameworks to govern the use of surveillance technologies worldwide. With constant advancements, the legal apparatus must catch up to define boundaries and enforce consequences for those who operate outside lawful ethics.
With the court’s decision opening the door to accountability, the ruling also sends the message to the industry: unlawful practices will no longer be largely ignored or swept under the rug. The Pegasus spyware saga will continue as stakeholders watch closely how this will shape the future of privacy, surveillance, and technology industry oversight.
