A California court has ruled in favor of Meta Platforms, the parent company of WhatsApp, in a landmark lawsuit against Israeli cybersecurity firm NSO Group.
The court found NSO liable for the 2019 spyware breach that exploited WhatsApp’s vulnerabilities to monitor over 1,400 users, including journalists, human rights activists and dissidents.
The case centered on NSO’s Pegasus spyware, which allows remote access to personal data from mobile phones without user interaction. In one high-profile incident, Pegasus was allegedly used by Saudi Arabia to spy on close associates of journalist Jamal Khashoggi before his murder in Istanbul. Following revelations of this case, NSO halted sales to Saudi Arabia.
Judge Phyllis Hamilton of the Northern District of California determined that NSO exploited multiple software vulnerabilities, including those in WhatsApp and Apple’s operating system, to intercept encrypted communications. She ordered NSO to pay damages, with the exact sum to be decided in later proceedings, and upheld WhatsApp’s right to seek sanctions against the Israeli firm for refusing to provide its source code despite prior court orders.
Meta welcomed the decision, calling it a “significant legal victory” against the commercial spyware industry. “With this ruling, spyware companies should be on notice that their illegal actions will not be tolerated,” WhatsApp said in a statement. “NSO can no longer avoid accountability.”
NSO declined to comment but has previously argued that the ruling undermines governments’ ability to combat terrorism and organized crime. The company maintains that its technology is sold exclusively to governments for legitimate security purposes, though critics argue Pegasus has frequently been used for unlawful surveillance.
The U.S. government has taken several steps against NSO and similar firms, placing the company on its trade blacklist in 2021 alongside other entities accused of enabling human rights abuses. This classification restricts American companies from engaging in business with NSO without prior authorization.
In March, President Joe Biden signed an executive order prohibiting federal agencies from using spyware deemed a security threat. Secretary of State Antony Blinken condemned the misuse of spyware in February, warning that it endangers privacy, free expression and human rights worldwide.
Apple dropped a parallel lawsuit against NSO in September, reportedly after Israeli authorities confiscated NSO’s source code, effectively halting its production. According to The Guardian, the Israeli government intervened to prevent disclosure of sensitive national security details. Israeli officials denied obstructing U.S. legal proceedings, with the Justice Ministry asserting that its actions adhered to legal standards.