“Common sense dictates that defendants must have first gained access to the WhatsApp software before reverse-engineering and/or decompiling it,” Judge Hamilton wrote. “Defendants offer no plausible explanation for how they could have gained access without agreeing to the terms of service.”
A History of Allegations Against NSO
WhatsApp, owned by Meta Platforms Inc., filed the lawsuit in 2019, alleging that NSO used its Pegasus spyware to hack 1,400 users’ devices. The targets reportedly included journalists, human rights activists, political dissidents, and diplomats, with attacks taking place in the spring of 2019. Governments such as Bahrain, the UAE, and Mexico allegedly used Pegasus to surveil individuals by bypassing WhatsApp’s end-to-end encryption, even in cases where users did not answer phone calls.
The lawsuit accused NSO of violating the Computer Fraud and Abuse Act and the California Comprehensive Computer Data Access and Fraud Act, in addition to breach of contract and trespass to chattels. While the court dismissed the trespass claim, WhatsApp persisted in its efforts to hold NSO accountable, taking the case to the U.S. Supreme Court before it was ultimately remanded back to the California federal court.
