US judge finds Israel's NSO Group liable for hacking in WhatsApp lawsuit

A U.S. judge ruled on Friday in favor of Meta Platforms' WhatsApp in a lawsuit accusing Israel's NSO Group of exploiting a bug in the messaging app to install spy software for unauthorized surveillance.

U.S. District Judge Phyllis Hamilton in Oakland, California, found NSO liable for hacking and breach of contract. The case will now proceed to trial solely on the issue of damages. NSO Group did not respond to requests for comment.

WhatsApp head Will Cathcart called the ruling a victory for privacy. “We spent five years presenting our case because we firmly believe that spyware companies cannot hide behind immunity or avoid accountability for their unlawful actions,” he said in a social media post. “Surveillance companies should be on notice that illegal spying will not be tolerated.”

A WhatsAp spokesperson expressed gratitude for the decision, stating, “We’re proud to have stood up against NSO and thankful to the many organizations that supported this case. WhatsApp will never stop working to protect people’s private communication.”

Cybersecurity experts welcomed the judgment. John Scott-Railton, a senior researcher at Citizen Lab, described the decision as a landmark ruling with “huge implications for the spyware industry.” He added, “Today’s ruling makes it clear that NSO Group is responsible for breaking numerous laws.”

WhatsApp initially sued NSO in 2019, seeking damages and an injunction, alleging the company accessed its servers without permission to install Pegasus spyware on victims' devices. The lawsuit claimed the intrusion targeted 1,400 individuals, including journalists, human rights activists, and dissidents.

NSO argued that Pegasus was designed to help law enforcement and intelligence agencies combat crime and terrorism. However, the company’s bid to claim “conduct-based immunity” under common law was rejected. The San Francisco-based 9th U.S. Circuit Court of Appeals upheld the rejection in 2021, ruling that NSO’s licensing of Pegasus did not shield it from liability under the Foreign Sovereign Immunities Act. The U.S. Supreme Court declined to hear NSO’s appeal in 2022, allowing the lawsuit to proceed.