US Court Holds Israel’s NSO Group Liable for WhatsApp Pegasus Attacks

In a landmark ruling, a US district court has found Israel's NSO Group, the maker of the infamous Pegasus spyware, liable in a lawsuit filed by WhatsApp. The court ruled that NSO's illegal surveillance tactics breached both US hacking laws and WhatsApp’s terms of service. The lawsuit, which dates back to 2019, accuses NSO of infecting 1,400 devices using Pegasus spyware, targeting journalists, human rights activists, and political dissidents worldwide.

Judge Phyllis Hamilton condemned NSO's actions as violations of the US Computer Fraud and Abuse Act (CFAA), as well as the California Comprehensive Computer Data Access and Fraud Act (CDAFA). The ruling is seen as a monumental victory for privacy and sets a precedent that surveillance companies will no longer be allowed to operate with impunity.

WhatsApp’s Head, Will Cathcart, hailed the decision as a "huge win for privacy," stressing that spyware companies can no longer hide behind immunity. He emphasized WhatsApp's commitment to safeguarding users' private communications, asserting that illegal surveillance will not be tolerated.

The case centers on Pegasus, a sophisticated spyware capable of infecting WhatsApp and iPhones, used to extract sensitive data, including messages, emails, and images. NSO Group claimed that its spyware was sold only to "vetted governments" for legitimate law enforcement purposes. However, the court rejected this defense, finding that NSO, not its clients, was responsible for the intrusion and data extraction.

This ruling comes amid broader concerns about the misuse of surveillance technologies. In 2021, a major leak exposed the widespread use of Pegasus to spy on opposition leaders, journalists, and activists, particularly in authoritarian regimes, including India. The Indian government has been accused of using Pegasus to monitor its citizens, a claim it has neither confirmed nor denied, despite an inquiry by the Supreme Court.

The judge also criticized NSO Group for obstructing the discovery process, noting that the company had failed to comply with court orders, including providing WhatsApp with access to the spyware's source code.

The ruling sets the stage for a separate trial in March 2025 to determine the damages NSO Group must pay to WhatsApp. This legal victory comes as a warning to spyware manufacturers worldwide that unlawful surveillance, especially targeting journalists and activists, will face severe legal consequences.

The Pegasus scandal highlights the growing battle for privacy in an increasingly connected world, where technology is often weaponized to violate human rights. As governments and companies continue to exploit these tools, this ruling serves as a reminder that accountability is crucial in the fight against invasive surveillance.