Meta Platforms-owned WhatsApp has scored a major legal victory in its battle with Israeli commercial spyware vendor NSO Group after a federal judge in the US state of California ruled in favor of the messaging giant for exploiting a security vulnerability to deliver Pegasus.
“The limited evidence presented at trial indicates that Defendants’ Pegasus code was sent through Plaintiffs’ California servers 43 times during the relevant time period in May 2019,” U.S. District Judge Phyllis J. Hamilton said.
The order again criticized NSO Group, saying it had “repeatedly failed to make appropriate disclosures and failed to comply with court orders regarding such disclosures,” referring to the company’s failure to produce Pegasus source code and for restricting access to Israeli citizens while in Israel.
This information, according to WhatsApp, included code related only to an Amazon Web Services (AWS) server, not the entire codebase that would reveal the full scope of its functionality.
“NSO’s failure to comply with discovery orders raises serious concerns about their transparency and willingness to cooperate with the legal process,” Judge Hamilton said.
The court also held NSO Group liable for breach of contract, concluding that the company violated WhatsApp’s terms of service, which forbid using the messaging platform for malicious purposes or reverse engineering or decompiling the software.
“This ruling is a huge win for privacy,” said Will Cathcart, head of WhatsApp at Meta. said in a statement at X. “We have spent five years making our case because we firmly believe that spyware companies cannot hide behind immunity or avoid accountability for their illegal actions.”
The case is now expected to be heard only on the issue of damages, Hamilton added.
WhatsApp initially filed a complaint against NSO Group in late 2019, accusing it of accessing its servers without permission to install the Pegasus tool on 1,400 devices in May of that year. The attacks used a zero-day vulnerability in the app’s voice calling feature (CVE-2019-3568CVSS score: 9.8) to trigger the deployment of the spyware.
Then last month, court documents show revealed the lawsuit found that NSO Group continued to use WhatsApp to distribute spyware until May 2020.
NSO Group has repeatedly stated that its offerings are intended solely for use by governments and law enforcement agencies to combat serious crimes such as terrorism, child pornography and money laundering, as well as to rescue abducted children and assist in emergency search and rescue operations.
“The world’s most dangerous criminals communicate using technology designed to protect their communications, while government intelligence and law enforcement agencies struggle to gather evidence and intelligence about their activities,” the company said in a statement. says on its website, emphasizing that its mission is “to create a better and safer world”.
However, evidence to the contrary showed that they were several specimens abuse of Pegasus by authoritarian regimes and other governments around the world to attack activists, politicians and journalists.
Apple, which filed a similar lawsuit against NSO Group in November 2021, has since sought to dismiss at will on the grounds that the market for commercial spyware has since exploded and that various countermeasures are being added to deter and better identify such attacks.
It belongs to them Lock mode and threat notifications The iPhone maker has begun sending alerts to victims it suspects have been targeted by state-sponsored entities, the latest of which was welcomed John Scott-Railton of Citizen Lab as “a rule changer for spyware accountability research.”
