In a groundbreaking decision, a US court has ruled that the Israeli spyware maker NSO Group is responsible for the hacking of hundreds of WhatsApp users using its Pegasus spyware. The ruling, handed down by Judge Phyllis Hamilton, found that NSO Group violated state and federal laws, as well as WhatsApp’s terms of service, by exploiting zero-day vulnerabilities in the messaging app to target at least 1400 devices.
The lawsuit, filed by Meta-owned WhatsApp five years ago, alleged that NSO Group’s Pegasus spyware was used not for legitimate law enforcement purposes, as the company often claims, but to target journalists, human rights activists, political dissidents, and government officials. The court also found that NSO Group failed to comply with a court order to provide access to its source code and important emails, further implicating the company in the illegal surveillance activities.
WhatsApp CEO Will Cathcart praised the ruling as a “huge win for privacy,” emphasizing the company’s commitment to holding spyware makers accountable for their unlawful actions. Cathcart emphasized that surveillance companies should not be allowed to hide behind immunity and must be held responsible for illegal spying activities. He reiterated WhatsApp’s dedication to protecting users’ private communications from unauthorized surveillance.
The use of zero-click attacks by commercial spyware makers like NSO Group has raised concerns about privacy and security. Despite efforts by the Biden administration to regulate these practices, companies like NSO Group continue to operate in a legal grey area. In 2021, NSO Group was blacklisted by the US government, and other firms like Intellexa have faced sanctions for their activities. An executive order issued last year prohibited the use of commercial spyware by the US government if it had been misused by foreign states to spy on individuals.
While WhatsApp’s legal action against NSO Group has been successful, not all tech companies have been able to hold spyware makers accountable. In September, Apple dropped its lawsuit against NSO Group, citing potential risks to its threat intelligence program. The case highlights the challenges that tech companies face in combating the illegal surveillance activities of commercial spyware makers.
Overall, the ruling against NSO Group represents a significant victory for privacy rights and sets a precedent for holding spyware companies accountable for their actions. It sends a clear message that illegal spying will not be tolerated, and companies like NSO Group will face consequences for their unlawful activities. As the battle against commercial spyware continues, tech companies must remain vigilant in protecting users’ privacy and security from unauthorized surveillance.