Judge grants ruling in favor of WhatsApp against spyware firm NSO Group

The ruling is arguably the most important to date against the Israeli maker of the Pegasus spyware.

A federal judge has dealt the first major legal blow against spyware maker NSO Group, ruling in favor of WhatsApp in a five-year-old lawsuit against the Israeli firm over allegations that it hacked the chat service.

Northern California District Court Judge Phyllis Hamilton made her ruling on Friday as a summary judgment, thus not requiring a full trial. She determined that NSO Group violated U.S. and California anti-hacking laws and had failed to obey court orders to produce evidence, especially the Pegasus spyware source code.

It’s the biggest turn in a case that at one point compelled the Supreme Court to weigh in and that has produced a bevy of revelations, and is perhaps the biggest ruling to date against a spyware maker in what is a difficult forum for victims.

“This is a historic judgment and a first major court victory against NSO Group in the world, finding them liable for compromising the digital security infrastructure that millions of people rely on,” said Natalia Krapiva, senior tech-legal counsel at the Access Now digital rights group. “While the trial will continue on how much damages NSO should pay, the partial summary judgment is a major win for WhatsApp, civil society, and Pegasus victims around the world.”

Officials at Meta, the parent company at WhatsApp, also celebrated the ruling.

“This ruling is a huge win for privacy,” Will Cathcart, head of WhatsApp, said on Threads. “We spent five years presenting our case because we firmly believe that spyware companies could not hide behind immunity or avoid accountability for their unlawful actions. Surveillance companies should be on notice that illegal spying will not be tolerated.”

Added Meta CEO Mark Zuckerberg: “Proud that we fought for this and that WhatsApp continues to lead on privacy and encryption 💪”

A spokesperson for NSO Group said the company had no comment at this time.

WhatsApp accused NSO Group of sending malware to infect around 1,400 mobile phones and devices. NSO Group contended, in part, that the court lacked personal jurisdiction, citing other cases that had been dismissed.

“The key distinction in all of those cases appears to be the citizenship/residency of the plaintiffs,” Hamilton wrote. “In this case, defendants do not dispute that plaintiffs are citizens of the United States and residents of this district, making the cited cases inapposite.”

Krapiva said the ruling should force other spyware companies to “take notice. The wheels of justice are slow, but the period of impunity for spyware purveyors and abusers is winding down.”

Correction, Dec. 31, 2024: An earlier version of this story misattributed the claim of lack of personal jurisdiction for the suit to the plaintiff. NSO contended it was the court that lacked such jurisdiction.

Meta accuses NSO Group of defying spyware injunction, files contempt of court complaint

The company said it spotted a spearphishing campaign linked to the Israeli spyware maker targeting WhatsApp users, despite a court order prohibiting it.

WhatsApp releases account feature that looks to combat spyware

NSO Group argues WhatsApp injunction threatens existence, future U.S. government work

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems