A US judge finds NSO Group liable for exploiting a bug in WhatsApp to spy on 1,400 users and that WhatsApp is entitled to sanctions against NSO
Israel-based maker of Pegasus program loses five-year-old landmark case. — Messaging giant WhatsApp won a landmark ruling Friday …
Washington PostJoseph Menn
Context & Ripple Effects
WhatsApp's case had already survived NSO Group's bid to claim foreign official immunity, allowing the dispute to proceed in U.S. court. Discovery later required NSO to provide Pegasus and other spyware code to Meta, raising the evidentiary stakes of the case.
The liability finding turns a long-running allegation over the compromise of WhatsApp users into a court-established violation and sets up the remedies phase. Later coverage shows that the dispute continued through a jury damages award and a subsequent ruling restricting NSO's targeting of WhatsApp users.
First-order effects
NSO Group is liable for exploiting the WhatsApp vulnerability against 1,400 users, and WhatsApp can seek court sanctions against it.
WhatsApp and Meta gain a judicial finding that strengthens their position in determining remedies and enforcing the judgment against NSO.
Second-order effects
The ruling makes the case a more consequential litigation risk for commercial spyware providers whose tools depend on exploiting third-party platforms.
The finding and sanctions process create a clearer path for platforms to use civil claims, discovery, and damages remedies against vendors tied to intrusions on their services.
Third-order effects
If similar claims succeed, platform operators may become a more durable legal check on the spyware market, alongside technical defenses, by treating unauthorized access as a direct business and legal threat.
The later injunction and reduced damages award illustrates that this check may rest less on a single large payout than on courts' willingness to restrict targeting and sustain enforceable liability.
The trend: This is one data point in the growing use of platform-led civil litigation to impose accountability on commercial spyware vendors.
major victory for WhatsApp in this finding of NSO Grp liability. really is a landmark. — spyware like Pegasus is like a silent virus, aiming to leave no fingerprints. thanks not only to WhatsApp for bringing this action but orgs like @citizenlab.ca for exposing NSO in the first…
This is a big deal. It means a modicum of accountability for NSO Group, the world's most notorious monger of malicious spyware. And it's a warning to the many other outfits that are making money by helping terrible regimes persecute journalists, human rights activists, and poli…
This is a huge win, and kudos to the WhatsApp legal team. I remember talking to them in 2019 when this all started, and this day seemed so far away. #Spyware [embedded post]
This ruling is a huge win for privacy. We spent five years presenting our case because we firmly believe that spyware companies could not hide behind immunity or avoid accountability for their unlawful actions. Surveillance companies should be on notice that illegal spying will…
3/ Today, the court decided that enough was enough with NSO's gambits & efforts to hide source code. Judge Hamilton granted @WhatsApp's motion for summary judgement against the #Pegasus spyware maker. The judge finds NSO's hacking violated the federal Computer Fraud & Abuse Act […
7/ The victims in the 2019 hack had been targeted with a simple missed video call exploit. No action required, and once-infected, the call log would typically be deleted. We @citizenlab volunteered help investigate the target list and try find journalists, dissidents, and human […
5/ For years, governments seemed content to let the mercenary spyware industry live in the shadows... NSO's valuation & client list ballooned. Meanwhile, NSO constantly misled reporters, nurtured disinformation about researchers & blamed spyware victims.. And then they got [image…
12/ Let's close by hearing from some of NSO Group's #Pegasus victims in this case. These testimonies were gathered by @accessnow which led an amicus brief in the case. https://www.accessnow.org/... [image]
BREAKING: NSO Group liable for #Pegasus hacking of @WhatsApp users. Big win for spyware victims. Big loss for NSO. Bad time to be a spyware company. Landmark case. Huge implications. 1/ 🧵 [image]
6/ So will the Pegasus victims get the damages from NSO? Well, this lawsuit was only between WhastApp and NSO. But it promises to have a big impact on other cases brought against spyware companies. And it validates so many victims' experiences...
The court just handed @WhatsApp a major win in the case against NSO Group ⚖️🎉 NSO was found liable under federal #CFAA & state law for #Pegasus hacking through WhatsApp's servers. As a lawyer working on surveillance, let me break down the ruling🧵 1/ [image]
5/ Since the court found NSO liable, all that remains to be decided at trial is how much should NSO pay to WhatsApp - the damages. The WhatsApp v NSO Jury Trial is scheduled to begin on March 3, 2025 at 8:30am in Oakland, CA. This will be a case to watch! [image]
6/ In the years after @WhatsApp sued NSO, much happened. More court cases were filed against the #Pegasus spyware maker. And in November 2021 NSO got hit with US sanctions. But thankfully, WhatsApp stuck to the case for five years even as NSO seems to have tried
2/ First, Court rules that NSO violated the Computer Fraud & Abuse Act by sending messages through WhatsApp servers to hack users w/ Pegasus. NSO argued that because they had WhatsApp accounts, they were authorized to use them as they wanted (incl. hacking). Court did not buy it …
It took just over 5 years, but WhatsApp is now victorious in its lawsuit against Israeli intelligence firm NSO Group, maker of the notorious Pegasus spying software used by governments around the world. https://news.bloomberglaw.com/ ...
@WhatsApp 4/@WhatsApp suing NSO Group was a huge deal at the time. We at @citizenlab & our peers in civil society had been investigating & surfacing a pile of #Pegasus abuses since 2016. Journalists, dissidents, truth-tellers, scientists, lawyers.. But nobody was taking action & …
4/ Third, Court ruled that NSO breached the contract w/ WhatsApp by violating Terms of Service. WhatsApp's ToS prohibit, among other things, sending harmful code, collecting users' info & using the app for illegal purposes. Which is exactly what NSO did through Pegasus hacking [i…
2/ In 2019, 1,400 @WhatsApp users were targeted with #Pegasus. WhatsApp did the right thing & sued NSO Group. NSO has spent 5 years trying to claim that they are above the law. And engaged in all sorts of maneuvering. With this order, the music stopped and NSO is now without …
3/ Second, Court found that NSO violated CDAFA. It is similar to CFAA but requires that defendant specifically targets CA servers. As NSO failed to provide Pegasus source code relevant to establishing this claim, the court ruled in favor of WhatsApp as an evidentiary sanction. [i…