WhatsApp wins legal victory against NSO Group in Pegasus hacking case

Unlock Editor's Digest for free

Roula Khalaf, editor-in-chief of the FT, selects her favorite stories in this weekly newsletter.

WhatsApp has won its case against Israeli spyware maker NSO Group in a US lawsuit over NSO's misuse of the messaging app to enable infiltration of the phones of journalists, activists and dissidents with its Pegasus hack tool.

A Northern District of California judge ruled Friday that NSO violated hacking laws and the terms of its service agreement with WhatsApp by using the messaging platform to inject its Pegasus spyware into more than 1,000 devices.

The decision in the civil case does not address the rights of individuals whose phones were hacked, but it gives a victory to tech groups seeking to prevent their platforms from being abused by groups targeting their users.

It's also a victory for Apple, Amazon and other tech giants who have supported WhatsApp's case.

“The court finds no basis for the arguments raised” by NSO Group, ruled Judge Phyllis Hamilton. The summary judgment means that a future trial will focus solely on the question of damages, rather than whether NSO can be held responsible for its actions.

“After five years of litigation, we are grateful for today’s decision,” WhatsApp said. “NSO can no longer shirk responsibility for its illegal attacks against WhatsApp, journalists, human rights activists and civil society. »

NSO Group did not immediately respond to a request for comment.

Pegasus can read encrypted messages stored on a phone, turn on its camera and microphone remotely, and track its location. Its use is linked to human rights violations and the US Department of Commerce has placed the Israeli company on a blacklist.

The legal case was launched after a 2019 Financial Times report. report this coincided with WhatsApp's discovery that its services had been hacked by NSO and Pegasus.

The ruling says NSO Group does not dispute that it “had to reverse engineer and/or decompile the WhatsApp software” in order to hack phones, but raised the possibility that it did so before 'accept the WhatsApp terms of service.

However, the judge concluded that “common sense dictates that [NSO] must have first had access” to the WhatsApp software and NSO offered “no plausible explanation” for how it could have done so without agreeing to the terms of service. He ruled in favor of WhatsApp's claim that NSO violated federal and state hacking laws.

The judge also found that NSO had “repeatedly failed to produce relevant findings,” particularly regarding the Pegasus source code.

“This sets a precedent that will be cited for years to come,” said John Scott-Railton, a researcher at the University of Toronto's Citizen Lab who has studied the use of Pegasus.

“This is the most closely watched case in mercenary spyware and everyone will take notice. I predict this will have a chilling effect on the efforts of other shady spyware companies to enter the US market, and on investors' interest in supporting their hacking,” he said.