Janice R. Andrews
A U.S. federal court has held Israeli spyware firm NSO Group accountable for hacking WhatsApp systems to deploy its Pegasus spyware. The decision marks a significant legal victory for WhatsApp and its parent company, Meta, which filed a lawsuit against the company in 2019.
Meta accused NSO Group of exploiting WhatsApp servers to infect 1,400 devices across 20 countries. The targets included journalists, human rights defenders, and political dissidents. U.S. District Judge Phyllis Hamilton ruled that NSO’s actions violated the Computer Fraud and Abuse Act (CFAA).
How Pegasus Exploited WhatsApp
NSO Group allegedly sent malware through WhatsApp servers to install Pegasus spyware on users’ devices. The attack did not require victims to take any action, such as answering a call or clicking a link. Once installed, the spyware enabled unauthorized surveillance of targeted devices.
Judge Hamilton stated that NSO’s admission of using WhatsApp servers to deliver spyware confirmed the CFAA violation. The court also imposed sanctions on NSO for repeatedly failing to provide key evidence, including the Pegasus source code.
NSO’s Defense Rejected
NSO Group denied involvement, claiming it merely provides surveillance tools to government agencies combating terrorism and crime. However, Judge Hamilton rejected this defense, ruling that the company’s activities directly facilitated illegal hacking.
In 2020, Meta strengthened its case by accusing NSO of using U.S.-based servers to execute the attacks.
Landmark Legal Victory
WhatsApp spokesperson Carl Woog welcomed the ruling, calling it a groundbreaking decision. “This is the first court decision agreeing that a major spyware vendor violated U.S. hacking laws,” Woog said. “With this ruling, spyware companies are on notice that their unlawful actions will not be tolerated.”
Judge Hamilton’s decision resolves NSO Group’s liability, leaving only the determination of damages to be addressed in a trial.
Broader Implications
The ruling has far-reaching consequences for the spyware industry, signaling that companies facilitating illegal surveillance will face legal accountability. It underscores the growing demand for stronger oversight of surveillance technologies and their use against civilians.
This case sets a powerful precedent, reinforcing the principle that violating digital privacy and human rights will carry severe penalties.
