WhatsApp sues NSO Group after investigating an attack from last year that sent malware to 1,400 devices and targeted 100+ human rights defenders and journalists

Will Cathcart is head of WhatsApp, which is owned by Facebook. — In May, WhatsApp announced that we had detected and blocked …

Washington Post 2019-10-30 Will Cathcart

Context & Ripple Effects

WhatsApp's lawsuit against NSO Group is the opening move in what became a five-year legal campaign: within days of filing, WhatsApp disclosed that 121 users in India were targeted, including activists and civil rights lawyers, and later alleged in court filings that NSO routed the malware through US-based servers.

The suit matters because it put a private messaging platform in the position of litigating state-adjacent spyware on behalf of its users — a fight that eventually produced a US judge finding NSO liable for exploiting the WhatsApp bug to spy on 1,400 people.

First-order effects

NSO Group now faces a civil lawsuit from one of the world's largest messaging platforms, forcing it to defend its Pegasus operations in open court rather than through undisclosed government contracts.
The 100+ human rights defenders and journalists targeted learn they were victims only because WhatsApp investigated and disclosed the attack — disclosure becomes part of the platform's security response.

Second-order effects

NSO's other government clients face exposure as litigation forces discovery of targeting data; later court documents showed Pegasus was used against 1,223 WhatsApp users across 51 countries, with Mexico and India leading.
Other spyware vendors must reckon with the precedent that platform owners can sue them directly, raising the legal cost of exploiting consumer apps for surveillance.

Third-order effects

If the pattern holds — investigation, public disclosure, litigation, liability — commercial spyware firms lose the deniability that made their business model viable, pushing surveillance toward more opaque channels or tighter state control.
Messaging platforms are positioned as de facto privacy enforcers, with their security teams and courtrooms doing work that export-control regimes and regulators have not.

The trend: Commercial spyware is being dragged from covert operation into public accountability by the platforms it exploits, with litigation replacing regulation as the enforcement mechanism.

Discussion

@wcathcart Will Cathcart on x
Today @WhatsApp is taking a stand against the dangerous use of spyware. NSO Group claims they responsibly serve governments, but we found more than 100 human rights defenders and journalists targeted in an attack last May. This abuse must be stopped. https://www.washingtonpost.co…
@alexstamos Alex Stamos on x
This is huge. I am really glad to see a tech company put their massive litigation team on the field on behalf of users. https://twitter.com/...
@thegrugq Thaddeus E. Grugq on x
Global surveillance giant threatens small surveillance company. Decries use of surveillance enabling servers for surveillance. https://www.washingtonpost.com/ ...
@citizenlab @citizenlab on x
We have identified over 100 cases of abusive targeting in at least 20 countries that took place after Novalpina Capital acquired NSO Group and began an ongoing public relations campaign to promote the narrative that the new ownership would curb abuses. https://citizenlab.ca/...
@zeynep Zeynep Tufekci on x
Good for @WhatsApp! They're suing NSO (the Israeli paid-to-hire hacking company for targeting human rights defenders as per @citizenlab research). Looking at you @Apple! I don't know this will work but targeting dissidents/minorities requires more than tepid PR statements. https:…
@bing_chris Chris Bing on x
Another thing that's important to focus on: WhatsApp says explicitly they think NSO runs ops. This obviously goes against the company line that they are only a tool provider. https://twitter.com/...
@internetfreedom @internetfreedom on x
What does this have to do with India? A lot. While we await further disclosure and more investigative reports specific to India, a post by @citizenlab in Sept. 2018 inferred NSO Spyware activity in India through an operator termed as, “Ganges”. 3/n https://citizenlab.ca/... pic.…
@ericgeller Eric Geller on x
WhatsApp sues spyware maker NSO Group, accusing it of not merely enabling but actually supervising a “highly sophisticated” attack on 1,400 targets, incl. journalists & civil-society activists. .@wcathcart announcement: https://www.washingtonpost.com/ ... Complaint: https://www.c…
@scottmstedman Scott Stedman on x
NSO Group is a menace to democracy. https://twitter.com/...
@marietjeschaake Marietje Schaake on x
Fascinating! WhatsApp/Facebook attributes attacks of human rights defenders to NSO Group's surveillance tech, and sues. Great work by @citizenlab that helped expose threats to vulnerable communities. Hope European politicians will move on leading with laws to stop these products …
@davidakaye David Kaye on x
thanks to @wcathcart for making this point https://twitter.com/... https://twitter.com/...
@privacyproject @privacyproject on x
From the @nytimes newsroom: WhatsApp “is seeking a permanent injunction banning NSO from its service, and called on lawmakers to ban the use of cyberweapons like those sold by NSO Group to governments all over the world,” writes @nicoleperlroth https://www.nytimes.com/...
@nicoleperlroth Nicole Perlroth on x
NSO Group was leasing Amazon servers to deploy their malware, which puts the ball somewhat in Amazon's court here. Among the victims targeted were journalists, prominent women who've been harassed online, as well as some who've been the targets of repeated assassination attempts.…
@johnjcook John Cook on x
In September, @jsrailton told @beckpeterson that any potential lawsuits against NSO Group over its hacking are “more likely ...going to come from companies than victims in the future.” Today Facebook and WhatsApp sued NSO Group https://www.washingtonpost.com/ ...
@tomgara Tom Gara on x
The Washington Post Opinion Page is really giving both sides a voice on this issue https://www.washingtonpost.com/ ... https://www.vice.com/... https://twitter.com/...
@billmarczak Bill Marczak on x
WhatsApp “sent a special WhatsApp message to approximately 1,400 users” to notify them that they were targeted by NSO Group's “missed call” phone hack: https://faq.whatsapp.com/...
@davidakaye David Kaye on x
this is very big. #WhatsApp sues NSO Group 👇👇👇 https://twitter.com/...

Chronicles