A federal judge in Northern California has ruled that Israeli tech company NSO Group is legally responsible for hacking WhatsApp users through its Pegasus surveillance software, marking a landmark decision against the controversial surveillance software maker.
Judge Phyllis Hamilton found that NSO Group violated both US federal and California state hacking laws, as well as WhatsApp's terms of service, when it infected approximately 1,400 phones over a two-week period in May 2019.
The ruling comes after a five-year legal battle initiated by Meta's WhatsApp messaging platform. The victims included journalists, human rights activists, diplomats, and senior government officials who had their devices compromised through the company's Pegasus surveillance software.
The court determined that NSO Group maintained direct control over the hacking operations, contrary to the company's previous claims that government clients were responsible for any surveillance activities. Evidence revealed that NSO Group handled both the installation of the spyware and the extraction of information from targeted devices.
The judge criticized NSO Group's conduct during the litigation, noting their repeated failure to comply with orders to provide access to their source code. The company only offered to make the code viewable in Israel by Israeli citizens, which the judge deemed "impracticable."
WhatsApp welcomed the verdict, stating that "NSO can no longer avoid accountability for their unlawful attacks." The messaging platform emphasized that the ruling sends a clear message to spyware companies about the consequences of illegal surveillance activities.
The case revealed that NSO Group used a specialized server to send malicious code through WhatsApp's systems, enabling the installation of Pegasus on target devices and the subsequent extraction of private information including pictures, emails, and text messages.
A separate jury trial scheduled for March 2025 will determine the damages NSO Group must pay to WhatsApp. The company, which was blacklisted by US government in 2021, did not immediately respond to requests for comment on the ruling.
This decision represents the first time a court has held NSO Group liable for abuses related to its spyware, despite numerous previous reports linking Pegasus to surveillance of civil society members worldwide.