Supreme Court clears way for WhatsApp case against NSO Group, opening spyware firm to more lawsuits

The Biden administration previously weighed in on the case between Meta and the spyware maker to recommend the court dismiss the appeal.

The Supreme Court on Monday denied a petition from NSO Group, the Israeli spyware maker, to dismiss a lawsuit alleging the firm exploited the WhatsApp platform in 2019 to spy on 1,400 users.

The decision upholds a previous California federal court ruling that rejected NSO Group’s arguments that it qualified for foreign sovereign immunity because it had been acting on behalf of a foreign government to investigate terrorist activity at the time it deployed the software.

NSO Group filed its petition with the Supreme Court in April after a federal judge in California rejected an appeal in the case brought by Meta, WhatsApp’s parent company.

“Meta has repeatedly impeded law enforcement’s ability to lawfully investigate criminals use of WhatsApp to commit serious crimes and acts of terror,” an NSO spokesperson told CyberScoop in an email. “We are confident that the court will determine that the use of Pegasus by its customers was legal.”

The Supreme Court previously called on the Biden administration to weigh in on the case and in November the Justice Department filed an amicus brief asking the court to deny the petition. The administration in 2021 added NSO Group and fellow Israeli spyware company Candiru to its entity list of companies that pose a national security risk.

The high court’s ruling comes amid growing concern from Washington about reining in the spyware industry. President Biden is expected to sign an executive order curtailing the use of spyware by federal agencies sometime this year and members of Congress have also proposed legislative solutions.

“We’re grateful to see the Supreme Court rejected NSO’s baseless petition,” Carl Woog, a spokesperson for WhatsApp, wrote in a statement to CyberScoop. “NSO’s spyware has enabled cyberattacks targeting human rights activists, journalists, and government officials. We firmly believe that their operations violate U.S. law and they must be held to account for their unlawful operations.” 

The court’s decision could help bolster the standing of other lawsuits against the surveillance firm. The Knight Institute filed a lawsuit in U.S. federal court against NSO Group in December on behalf of members of the Salvadoran news outlet El Faro. The lawsuit alleges that the NSO Group violated U.S. hacking laws by deploying spyware against the journalists.

“We’re pleased that the Supreme Court rejected NSO Group’s petition. Today’s decision clears the path for lawsuits brought by the tech companies, as well as for suits brought by journalists and human rights advocates who have been victims of spyware attacks,” Carrie DeCell, senior staff attorney at the Knight First Amendment Institute at Columbia University, wrote in a statement. “The use of spyware to surveil and intimidate journalists poses one of the most urgent threats to press freedom and democracy today.”

Apple is also suing NSO Group in an effort to permanently ban the company from using any of its products, services or software.

Meta accuses NSO Group of defying spyware injunction, files contempt of court complaint

The company said it spotted a spearphishing campaign linked to the Israeli spyware maker targeting WhatsApp users, despite a court order prohibiting it.

One House Democrat is pressing Commerce on the government’s spyware use

WhatsApp releases account feature that looks to combat spyware

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems