WhatsApp Wins Case Against Pegasus-Maker NSO Group: Story in 5 Points

WhatsApp vs NSO Group: Meta Platforms-owned messaging platform, WhatsApp, today won a major lawsuit against the NSO Group, the company behind the spyware, Pegasus, that has been used for surveilling several high-profile targets in the past.

US District Judge Phyllis Hamilton in Oakland, California, found the NSO Group liable for hacking into WhatsApp's servers, and violating the company's terms of service as well as the state and federal laws in the US.

The decision is a major milestone as it makes the companies operating in the surveillance industry liable for actions of their customers. The decision also marks the first instance wherein the NSO Group is being held responsible for the spyware that it sells.

In addition to bringing accountability, the move will also help in setting a precedence in another case against the NSO Group filed by Apple in November 2021. For the unversed, Apple has filed a case against the Pegasus-maker for 'surveillance and targeting of Apple users'.

As a part of the case, Apple has sought to ban the NSO Group from 'further harming individuals by using Apple’s products and services'. The company has also sought to 'redress for NSO Group’s flagrant violations of US federal and state law, arising out of its efforts to target and attack Apple and its users'.

Here is the WhatsApp vs NGO Group case explained in five points:

WhatsApp vs NSO Group: Story in 5 Points

1. Critical vulnerability determined in WhatsApp

Back in May 2019, it was reported that a vulnerability in Meta's messaging app, WhatsApp, had allowed hackers to inject a spyware by the NSO Group on the targeted Android phones and iPhones. The code could be transmitted if the users did not answer their calls. Soon after the vulnerability was reported, WhatsApp's engineers raced to fix the bug.

2. WhatsApp sues NSO Group

Later in the year, that is, 2019, Meta Platforms' WhatsApp filed a lawsuit against the NSO Group saying the company was actively involved in targeting WhatsApp users. "On October 29, 2019, WhatsApp filed this lawsuit, alleging that defendants sent malware, using WhatsApp’s system, to approximately 1,400 mobile phones and devices designed to infect those devices for the purpose of surveilling the users of those phones and devices," the company wrote in the lawsuit.

"NSO Group’s relevant software products, collectively referred to as “Pegasus,” allow defendants’ clients to use a modified version of the Whatsapp application – referred to as the “Whatsapp Installation Server,” or “WIS. The WIS, among other things, allows defendants’ clients to send “cipher” files with “installation vectors” that ultimately allow the clients to surveil target users," the company added in the lawsuit.

Around the same time, WhatsApp boss, Will Cathcart, published an opinion piece in the Washington Post wherein he said that Meta had filed the lawsuit in order to hold the company accountable for the hack.

3. What did the judge say in the ruling?

While hearing the case today, judge Hamilton held the NSO Group accountable for hacking into users' devices without authorisation and defrauding them.

"The limited evidentiary record before the court does show that defendants’ Pegasus code was sent through plaintiffs’ California-based servers 43 times during the relevant time period in May 2019...The evidence before the court is consistent with the court’s earlier conclusion, at the pleading stage, that defendants “caused a digital transmission to enter California, which then effectuated a breaking and entering of a server in California,” the judge wrote in the judgement.

4. What is WhatsApp saying?

WhatsApp boss, Will Cathcart, reacted to the development saying that the judgement was a huge win for privacy. "This ruling is a huge win for privacy...Surveillance companies should be on notice that illegal spying will not be tolerated," he added in a post on X (formerly Twitter).

5. What happens next?

The judge also ruled that the court case will now focus only on the damages that the NSO Group has to pay to WhatsApp. "Because this order resolves all issues regarding liability, a trial will proceed only on the issue of damages," the judge wrote.