Legal experts analyze WhatsApp's options in its case against NSO Group, over sending malware to WhatsApp users, which they say will be an uphill battle
Andy Greenberg / Wired :
Context & Ripple Effects
WhatsApp opened a new front against the spyware trade by suing NSO Group, after its own investigation traced malware sent to roughly 1,400 devices, including journalists and human rights defenders. The suit is notable because it targets not just the exploit but the vendor behind it — a private company attacking another private company's core business through US courts.
The legal terrain is contested: court filings later alleged NSO routed the operation through US-based servers, giving American law jurisdictional hooks, while NSO has leaned on claims of acting for foreign government clients. Legal experts cited by Wired frame the path ahead as difficult precisely because attribution and immunity questions sit at the center.
First-order effects
- NSO Group now faces direct litigation exposure in US courts rather than reputational reporting alone, forcing it to defend both its conduct and its foreign-official-immunity theory.
- WhatsApp must fund an expensive cross-border legal fight to protect its user base, setting its security team's forensic findings up as courtroom evidence.
Second-order effects
- If WhatsApp gains traction, rival messaging platforms gain a template for suing spyware vendors, raising the cost structure of an industry that has operated largely between legal regimes.
- NSO's government clients become a liability question inside the case — any ruling touching immunity clarifies how much cover state customers provide their contractors.
Third-order effects
- A sustained pattern of platform-versus-vendor lawsuits would push commercial surveillance firms toward formal regulatory treatment, replacing ad-hoc exposure reports with judicially defined rules of engagement.
- The outcome interacts with WhatsApp's parallel encryption fights, including its support for Apple's challenge to the UK Home Office backdoor demand — together they position the company as a recurring litigant defining where platform obligations end.
The trend: Consumer messaging platforms are shifting from patching spyware attacks to litigating against their vendors, with US court rulings becoming the arena where the commercial surveillance industry's accountability gets tested.