Last updated on April 4th, 2024 at 11:50 am

Meta’s messaging app is suing Israeli company NSO Group, accusing it of spying on 1,400 users over a two-week period

NSO Group, known for creating some of the world’s most advanced cyber weapons, has been directed by a US court to provide its code for Pegasus and other spyware products to WhatsApp as part of the ongoing legal battle between the two companies.

The ruling by Judge Phyllis Hamilton represents a significant legal win for WhatsApp, the Meta-owned messaging app that filed a lawsuit against NSO in 2019. The suit alleged that NSO’s spyware was used against 1,400 WhatsApp users over a two-week period.

NSO’s Pegasus code, along with the code for other surveillance products it sells, is considered a closely guarded state secret. NSO is subject to strict regulation by the Israeli Ministry of Defence, which must review and approve all licenses for sale to foreign governments.

In her ruling, Hamilton considered NSO’s request to be relieved of all discovery obligations in the case due to “various US and Israeli restrictions.” Despite this plea, she ultimately ruled in favor of WhatsApp, ordering NSO to provide all relevant spyware from a one-year period surrounding the alleged attacks on WhatsApp users: from April 29, 2018, to May 10, 2020. Additionally, NSO must provide information regarding the full functionality of the relevant spyware.

However, Hamilton did rule in NSO’s favor on another issue: the company will not be compelled at this time to disclose the identities of its clients or details regarding its server architecture.

“The recent court ruling marks a significant milestone in our ongoing efforts to safeguard WhatsApp users from unlawful attacks. Spyware companies and other malicious actors must understand that they can be held accountable and cannot ignore the law,” a WhatsApp spokesperson stated.

NSO declined to comment on the decision, and the litigation is ongoing.

When successfully deployed against a target, NSO’s Pegasus software can hack any mobile phone, gaining unrestricted access to phone calls, emails, photographs, location information, and encrypted messages without the user’s knowledge. NSO was blacklisted by the Biden administration in 2021 after it determined that the Israeli spyware maker had acted “contrary to the foreign policy and national security interests of the US.”

NSO sells its spyware to government clients globally and has stated that the agencies deploying it are accountable for its usage. Although NSO does not reveal its clients’ identities, various research and media reports have indicated that Poland, Saudi Arabia, Rwanda, India, Hungary, and the United Arab Emirates are among the countries that have previously utilized the technology to target dissidents, journalists, human rights activists, and other civil society members.

NSO contends that Pegasus assists law enforcement and intelligence agencies in combating crime and safeguarding national security, emphasizing its role in apprehending terrorists, child abusers, and serious criminals.

The Biden administration has expressed concerns about the spread and misuse of tools like Pegasus, viewing them as potential threats to US national security and counterintelligence operations. A new policy announced in early February will impose worldwide visa restrictions on individuals linked to the inappropriate use of commercial spyware, affecting countries such as those in the EU and Israel.