WhatsApp has secured a landmark legal victory, with the U.S. District Court ruling on December 20, 2024, holding Israel's NSO Group liable for infecting approximately 1,400 devices with its controversial Pegasus spyware. The case marks a significant development for digital privacy advocacy and sets important legal precedents for the burgeoning market of commercial spyware.
Headed by Judge Phyllis Hamilton, the ruling came five years after Facebook-owned WhatsApp filed the lawsuit, accusing NSO Group of exploiting vulnerabilities within their messaging platform to deploy the invasive surveillance technology. This case shines light on how the notorious spyware has been employed to target activists, journalists, and government officials across the globe.
NSO Group, which has claimed its software is intended for law enforcement and national security purposes, now faces legal consequences following the court's findings. The judge ruled NSO Group violated both the federal Computer Fraud and Abuse Act (CFAA) and California’s Comprehensive Computer Data Access and Fraud Act (CDAFA), alongside breaching WhatsApp's terms of service.
"The ruling is a huge win for privacy. We spent five years presenting our case because we firmly believe spyware companies could not hide behind immunity or avoid accountability for their unlawful actions," said Will Cathcart, Head of WhatsApp, stressing the importance of holding such companies accountable.
This pivotal ruling emphasized the operational role of NSO Group over the Pegasus spyware deployment. Contrary to NSO's assertions about client control, the court found substantial evidence indicating NSO Group managed the entire process, from installation to extracting sensitive data from victims’ devices. Notably, WhatsApp’s court filings illustrated how the installation was straightforward for NSO clients: they merely needed to input the target’s contact number for the spyware to infiltrate their device remotely.
"NSO’s customers’ role is minimal, as NSO controls every aspect of the data retrieval and delivery process through its design of Pegasus," it was stated within WhatsApp’s legal arguments.
This ruling is particularly significant because it is the first time NSO Group has been held liable for its actions, setting the stage for potential damages to be assessed against the company—a trial on this issue is scheduled for March 2025. Digital rights advocates heralded the ruling as a beacon of hope, with Natalia Krapiva of Access Now noting, "This is the first successful case against NSO Group where NSO was found liable for compromising the digital security infrastructure..." She emphasized the ruling as not just a victory for WhatsApp, but for the civil rights and privacy of countless individuals affected by surveillance tactics globally.
Notably, Judge Hamilton condemned NSO Group for what she described as obstruction during the legal process, particularly its failure to produce the complete source code of Pegasus as previously ordered. The judge pointed out the impracticality of NSO's only allowing the code to be viewed by Israeli citizens within Israel, deeming it unacceptable.
John Scott-Railton from Citizen Lab remarked on the broader ramifications of the ruling, illustrating its potential to reshape the spyware industry. “This is the most-watched case about mercenary spyware and everyone is going to take note,” he said, adding the ruling could have lasting effects on similar enterprises considering operations within the U.S.
The outcome of the case brings considerable weight to the argument about who bears responsibility when powerful spyware tools are used unlawfully. NSO Group and similar companies have long argued their technologies pose no threat if used responsibly by clients. The court's decision, nonetheless, points to shared responsibility and accountability.
Facebook's legal battle highlights how the global community of privacy advocates is increasingly demanding greater oversight and ethical practices from technology companies, particularly around tools for national security and law enforcement. The ruling sends a clear message to the spyware industry: illegal actions will not be accepted. This legal win is not only a significant milestone for WhatsApp but also promises to strengthen the smart and proper use of digital communication tools going forward.
With the legal proceedings set to continue, particularly the damages assessment, the world watches closely. The phone numbers hacked, lives intruded, and rights violated could mark the start of new discussions on privacy, accountability, and legislation around surveillance technologies.
