Spyware Maker NSO Group Liable for WhatsApp User Hacks

A controversial Israeli spyware maker has been found liable for the compromise of hundreds of WhatsApp users, in a historic US court ruling.

Judge Phyllis Hamilton said on Friday that NSO Group broke state and federal laws and WhatsApp’s terms of service, by using zero-day exploits in the popular messaging tool to deploy its Pegasus spyware on at least 1400 devices.

Meta-owned WhatsApp took the Israeli firm to court five years ago, arguing at the time that “attackers used servers and internet-hosting services that were previously associated with NSO.”

It added that the attacks were not used for legitimate policing efforts, which NSO Group often claims of its services, but that they targeted journalists, human rights activists, political dissidents and senior government officials.

Read more on NSO Group: UK Government Under Fire Over NSO Group Links

Handing out her ruling, the federal judge in Northern California claimed that NSO Group failed to comply with a court order requiring the firm provide access to its Pegasus source code or turn over important emails.

WhatsApp boss, Will Cathcart, described the ruling as “a huge win for privacy” in a post on Threads.

“We spent five years presenting our case because we firmly believe that spyware companies could not hide behind immunity or avoid accountability for their unlawful actions,” he added. “Surveillance companies should be on notice that illegal spying will not be tolerated. WhatsApp will never stop working to protect people’s private communication.”

NSO Group’s zero-click attacks are a common feature of commercial spyware makers, who operate in a legal grey area, despite efforts from the Biden administration to clamp down on their practices.

NSO Group was placed on a US export blacklist in 2021, while similar firms such as Intellexa were sanctioned in recent years. An executive order last year banned US government use of any commercial spyware previously misused by foreign states to spy on citizens, dissidents, activists and others.

Not all tech companies have been as successful as WhatsApp in pursuing commercial spyware makers. In September, Apple dropped its suit against NSO Group, citing risks to its threat intelligence program.

Image credit: Sergei Elagin / Shutterstock.com