A US judge orders the NSO Group to hand over its code for Pegasus and other spyware products to Meta, as part of Meta's ongoing litigation to protect WhatsApp
Israeli company NSO Group is accused in lawsuit by Meta's messaging app of spying on 1,400 users over a two-week period
Context & Ripple Effects
The discovery order advances a WhatsApp case that the Supreme Court had already allowed to proceed over allegations that NSO exploited a platform vulnerability to surveil users. That decision to let the case continue made NSO's technical methods central to the litigation.
It matters because access to product code can move the dispute from allegations about an attack to examination of how the spyware operated and which products may be relevant.
First-order effects
- NSO must provide Meta with code for Pegasus and other spyware products covered by the order, increasing its litigation exposure and the burden of protecting proprietary material during discovery.
- Meta gains a basis to have the alleged WhatsApp intrusion assessed against the products’ technical implementation, rather than relying solely on external evidence.
Second-order effects
- The order raises the stakes for NSO’s defenses: technical discovery can shape later findings on the alleged exploit, as reflected in the subsequent liability finding over the WhatsApp attack.
- Other commercial spyware vendors facing claims of platform abuse may have to account for the possibility that civil litigation can reach into source code, not just customer-facing conduct.
Third-order effects
- If courts continue to permit this depth of discovery, major communications platforms can use private litigation as a more consequential tool against spyware operations that target their infrastructure.
- The longer-term boundary will depend on how courts balance platform security claims against spyware firms’ claims over sensitive proprietary code; later damages and injunction proceedings show the dispute can extend beyond initial discovery, including a jury damages award against NSO.
The trend: Messaging platforms are increasingly using control of the access layer—technical infrastructure, user protections, and litigation—to contest commercial surveillance tools.