A California federal judge ruled Friday that Israeli spyware developer NSO Group is liable for hacking into 1,400 WhatsApp users’ devices using its Pegasus spyware, granting WhatsApp a significant win in its long-standing legal battle. The decision resolves liability issues, leaving damages as the sole matter to be addressed at trial.

WhatsApp Claims Victory in Hacking Case

U.S. District Judge Phyllis J. Hamilton granted summary judgment in favor of WhatsApp, a Meta Platforms Inc. subsidiary, on claims that NSO violated federal law by accessing WhatsApp servers without authorization. Judge Hamilton found NSO’s actions violated the Computer Fraud and Abuse Act and WhatsApp’s terms of service, which prohibit harmful conduct such as reverse engineering and unauthorized access.

“Defendants appear to fully acknowledge that the [WhatsApp Installation Server] sent messages through WhatsApp servers that caused Pegasus to be installed on target users' devices,” Judge Hamilton wrote. “The WIS was then able to obtain protected information by having it sent from the target users, through the WhatsApp servers, and back to the WIS.”

Breach of Contract and Discovery Violations

The court also ruled that NSO breached WhatsApp’s terms of service by reverse-engineering its software to deploy Pegasus. Judge Hamilton dismissed NSO’s claims that it could have accessed the platform without agreeing to the terms, describing this argument as lacking plausibility.

Additionally, NSO faced sanctions for failing to comply with discovery obligations. The company did not produce Pegasus code in a usable format for litigation, leading Judge Hamilton to impose evidentiary sanctions. However, the court stopped short of granting terminating sanctions that would have immediately resolved the case in WhatsApp’s favor.

The Pegasus Spyware Controversy

WhatsApp filed its lawsuit in 2019, accusing NSO of using Pegasus to hack phones of at least 1,400 users, including journalists, human rights activists, and diplomats. The spyware allowed unauthorized access to user messages and other data, even if targets did not answer malicious calls.

WhatsApp alleged the attacks violated state and federal anti-hacking laws and bypassed the app’s end-to-end encryption. The U.S. Supreme Court previously declined to review whether NSO could claim immunity as a government contractor, returning the case to the California federal court.

Industry Repercussions

WhatsApp’s head, Will Cathcart, hailed the decision as a major victory for privacy. “Spyware companies should be on notice that illegal spying will not be tolerated,” Cathcart wrote on Meta’s Threads app.

Meta CEO Mark Zuckerberg echoed the sentiment, expressing pride in WhatsApp’s leadership on privacy and encryption.

This ruling could have far-reaching implications for surveillance firms, signaling that claims of immunity or deflecting accountability for hacking will face serious judicial scrutiny.