In a decisive turn of events, a U.S. federal judge has ruled against NSO Group, the Israeli company behind the infamous Pegasus spyware. The group is liable for hacking over 1,400 devices through WhatsApp. This ruling marks a significant milestone in the ongoing battle against commercial spyware and its misuse by repressive regimes​.
Revisiting Pegasus
Pegasus spyware, developed by NSO Group, has long been a tool of concern. It is notorious for its zero-click exploits that infiltrate devices without user interaction. Pegasus has compromised even highly secure iPhones, infecting devices of high-profile targets as well as regular users. iVerify’s investigation revealed that about 2.5 in every 1,000 phones may have been infected by their spyware.
The recent ruling adds another layer to this saga, as WhatsApp’s five-year legal battle finally bore fruit. The lawsuit alleged that NSO Group exploited a vulnerability in WhatsApp’s voice-calling feature in 2019 to deploy Pegasus spyware. It targeted journalists, human rights defenders, and diplomats worldwide​.
The Court’s Findings
Judge Phyllis Hamilton ruled that NSO Group breached U.S. federal and California state hacking laws and violated WhatsApp’s terms of service by reverse-engineering the messaging platform to install spyware. Notably, NSO repeatedly failed to comply with discovery orders, including producing the Pegasus source code, further undermining its defence​.
WhatsApp’s head, Will Cathcart, described the ruling as a “huge win for privacy,” while emphasising that surveillance companies should not be allowed to evade accountability. John Scott-Railton of Citizen Lab shared this sentiment, calling the decision a landmark case with far-reaching implications for the spyware industry​.
The misuse of this spyware has been documented extensively. Pegasus has been linked to the surveillance of Mexican human rights advocates and U.S. diplomats in Uganda. The spyware also found its way to the phone of journalist Jamal Khashoggi’s wife before his tragic murder. These incidents highlight how commercial spyware ends up in the hands of oppressive regimes​.
The Broader Implications
This ruling could signal a shift in the legal landscape for spyware companies. While NSO claims its tools are designed to combat crime and terrorism, the evidence overwhelmingly points to widespread misuse. This case heading to trial sets a precedent for holding spyware companies accountable for their actions​.
Meanwhile, Apple had its own legal battle with NSO. But they have dropped the case, citing challenges in accessing critical evidence. This makes WhatsApp’s victory even more important in the fight for privacy​.
What’s Next?
The WhatsApp-NSO case will be trialled in March 2025 to determine the damages owed. Outside the courtroom, this ruling sends a clear message that spyware companies can no longer operate with impunity. As the commercial spyware market continues to grow, this victory reminds us that the fight for digital privacy is far from over​.