A U.S. judge has ruled that Israeli spyware maker NSO Group breached hacking laws by using WhatsApp to infect devices with its Pegasus spyware.
In a historic ruling on Friday, a Northern California federal judge held NSO Group liable for targeting the devices of 1,400 WhatsApp users, violating state and federal hacking laws as well as WhatsApp's terms of service, which prohibit the use of the messaging platform for malicious purposes.
The ruling comes five years after Meta-owned WhatsApp sued NSO Group, alleging the spyware outfit had exploited an audio-calling vulnerability in the messaging platform to install its Pegasus spyware on unsuspecting users' devices. WhatsApp said that more than 100 human rights defenders, journalists and "other members of civil society" were targeted by the malware, along with government officials and diplomats.
In her ruling, Judge Phyllis Hamilton said NSO did not dispute that it "must have reverse-engineered and/or decompiled the WhatsApp software" to install its Pegasus spyware on devices, but raised questions about whether it had done so before agreeing to WhatsApp's terms of service.
However, the judge said "common sense dictates that [NSO] must have first gained access" to WhatsApp, pointing out that NSO had offered "no plausible explanation" for how it could have done so without agreeing to the terms of service.
Hamilton noted NSO had repeatedly failed to produce relevant discovery, including the Pegasus source code, despite a court order requiring that it be turned over. She said NSO also refused to produce internal communications, including communications about WhatsApp vulnerabilities.
"NSO's lack of compliance with discovery orders raises serious concerns about their transparency and willingness to cooperate with the judicial process," the judge said.
In a statement given to TechCrunch, Meta spokesperson Emily Westcott said WhatsApp welcomes Friday's ruling.
"NSO can no longer avoid accountability for their unlawful attacks on WhatsApp, journalists, human rights activists, and civil society," she said. "With this ruling ...