Canadian activist sues NSO Group, claims its spyware empowered Saudi officials to access WhatsApp messages with Jamal Khashoggi, possibly leading to his killing
London (CNN)In his public writings, Jamal Khashoggi's criticism of Saudi Arabia and its Crown Prince Mohammed bin Salman was measured.
Context & Ripple Effects
This lawsuit lands six weeks after Khashoggi's killing and days after reporting that Saudis groomed a Twitter employee to spy on dissident accounts — together painting a picture of surveillance that ran through both platforms and insiders. The claim is specific: NSO Group's Pegasus tool allegedly gave Saudi officials access to Khashoggi's WhatsApp messages, making the spyware vendor itself a defendant rather than just its state customers.
The case also opens a litigation thread that runs for years afterward: analysis later tied a message from Crown Prince Mohammed bin Salman's WhatsApp account to the likely hacking of Jeff Bezos' phone, Citizen Lab's finding of Pegasus on Loujain al-Hathloul's iPhone helped trigger scrutiny of NSO, and Khashoggi's widow filed her own Virginia lawsuit against NSO in 2023.
First-order effects
- NSO Group now faces direct legal liability from a private plaintiff alleging its product enabled access to a murdered journalist's messages — shifting risk from its government clients onto the vendor.
- WhatsApp is pulled into the case as the exploited channel, forcing it to defend both its users and its infrastructure against a named attack vector.
Second-order effects
- Other targeted dissidents follow the courtroom route: a UK court later allows Yahya Assiri to sue Saudi Arabia directly over Pegasus targeting (the London ruling), showing plaintiffs learning to reach past the vendor to the state.
- Messaging platforms respond by hardening encryption and detection around zero-click exploits, raising the cost curve for spyware operators who depend on unpatched entry points.
Third-order effects
- If the pattern holds, commercial spyware firms face a structural reckoning: civil litigation by victims and their families becomes an accountability mechanism where export controls are weak, threatening the viability of the private surveillance market.
- The Khashoggi case establishes journalists and activists as a protected class whose communications platforms carry de facto duty-of-care pressure, pushing end-to-end encrypted services toward continuous anti-spyware defense.
The trend: Commercial spyware is being dragged into public accountability through a widening wave of victim-led lawsuits across US and UK courts, with NSO Group as the recurring defendant.