FOLLOW US

A California federal judge has ruled that Israeli spyware maker NSO Group is liable for hacking into 1,400 WhatsApp users’ devices, granting WhatsApp’s request for a partial summary judgment on Friday. U.S. District Judge Phyllis J. Hamilton’s decision resolves liability issues and leaves only damages to be addressed at trial, marking a crucial win for privacy advocates.

Judge Hamilton granted summary judgment on all three of WhatsApp's claims against NSO, including allegations that the spyware company violated federal law by unlawfully accessing WhatsApp's servers.

"Defendants appear to fully acknowledge that the [WhatsApp Installation Server, or WIS,] sent messages through WhatsApp servers that caused Pegasus" — NSO’s spyware product — "to be installed on target users' devices, and that the WIS was then able to obtain protected information by having it sent from the target users, through the WhatsApp servers, and back to the WIS," Judge Hamilton stated in her order.

The court also ruled in favor of WhatsApp's breach of contract claim, which accused NSO of violating terms of service prohibiting reverse engineering, sending malicious code, collecting user data, unauthorized access, and illegal use of the app. NSO had claimed it might have reverse-engineered WhatsApp’s software before agreeing to the terms of service, but Judge Hamilton dismissed this argument, noting that the company failed to provide evidence supporting such a claim.

"Common sense dictates that defendants must have first gained access to the WhatsApp software before reverse-engineering and/or decompiling it," Judge Hamilton wrote. "Defendants offer no plausible explanation for how they could have gained access without agreeing to the terms of service."

A History of Allegations Against NSO

WhatsApp, owned by Meta Platforms Inc., filed the lawsuit in 2019, alleging that NSO used its Pegasus spyware to hack 1,400 users’ devices. The targets reportedly included journalists, human rights activists, political dissidents, and diplomats, with attacks taking place in the spring of 2019. Governments such as Bahrain, the UAE, and Mexico allegedly used Pegasus to surveil individuals by bypassing WhatsApp’s end-to-end encryption, even in cases where users did not answer phone calls.

The lawsuit accused NSO of violating the Computer Fraud and Abuse Act and the California Comprehensive Computer Data Access and Fraud Act, in addition to breach of contract and trespass to chattels. While the court dismissed the trespass claim, WhatsApp persisted in its efforts to hold NSO accountable, taking the case to the U.S. Supreme Court before it was ultimately remanded back to the California federal court.

Both parties filed motions for partial summary judgment in late September, with WhatsApp asserting that undisputed evidence established NSO’s liability. WhatsApp further alleged that NSO’s refusal to comply with discovery obligations, including failing to produce the Pegasus code in a usable manner, justified sanctions.

Court Orders Sanctions Against NSO

Judge Hamilton also granted WhatsApp’s request for sanctions, finding that NSO’s production of the Pegasus code in Israel — rather than in a manner accessible to the court — was inadequate. While she stopped short of issuing default judgment as a terminating sanction, she imposed evidentiary sanctions that will treat NSO’s use of WhatsApp’s servers as a purposeful act.

During a previous hearing, Judge Hamilton criticized NSO’s compliance with discovery orders, stating that producing code in Israel did not meet the court’s requirements. "When I ordered it be produced for litigation, I meant it had to be something I can see," she noted.

Reactions to the Ruling

Will Cathcart, head of WhatsApp, celebrated the ruling as a "huge win for privacy" in a post on Meta’s Threads platform. "We spent five years presenting our case because we firmly believe that spyware companies could not hide behind immunity or avoid accountability for their unlawful actions," Cathcart wrote. "Surveillance companies should be on notice that illegal spying will not be tolerated."

Meta CEO Mark Zuckerberg echoed these sentiments, commending WhatsApp’s efforts to lead on privacy and encryption.

Legal Representation

WhatsApp is represented by Greg D. Andres, Antonio J. Perez-Marques, Craig T. Cagney, Luca Marzorati, and Micah G. Block of Davis Polk & Wardwell LLP. NSO is represented by Joseph N. Akrotirianakis and Aaron S. Craig of King & Spalding LLP.

The case, WhatsApp Inc. et al. v. NSO Group Technologies Limited et al., is being heard in the U.S. District Court for the Northern District of California under case number 4:19-cv-07123.