• by Wendy Davis  @wendyndavis, December 23, 2024

The Israeli company NSO Group violated federal and California anti-hacking laws, and also violated Meta's terms of service, by installing Pegasus spyware on WhatsApp users' devices, a federal judge ruled late last week.

The ruling, issued by U.S. District Court Judge Phyllis Hamilton in the Northern District of California, comes in a legal battle dating to October 2019, when Meta sued NSO over the spyware. Pegasus allegedly accessed WhatsApp messages after they were decrypted by the recipients.

Meta filed suit soon after reports emerged that NSO had installed Pegasus malware on the phones of approximately 1,400 WhatsApp users – including human rights leaders, journalists, government officials, and diplomats.

NSO, which denied wrongdoing, initially said it couldn't be sued in the U.S. because it was acting at the direction of its foreign government customers. The company specifically claimed it was protected from suit by the Foreign Sovereign Immunity Act, which generally shields foreign governments from lawsuits in the U.S., except for some lawsuits related to terrorism.

Hamilton rejected that argument, as did the 9th Circuit Court of Appeals. NSO Group asked the Supreme Court to intervene, but that court refused to hear NSO's appeal.

On Friday, Hamilton awarded Meta summary judgment on claims that NSO Group violated hacking laws that prohibit anyone from exceeding their authorized access to computer servers. She also awarded Meta summary judgment on its claim that NSO Group broke its contract with Meta by violating WhatsApp's terms of service –including prohibitions on sending “harmful code” through WhatsApp, and from accessing information on the messaging service without authorization.

NSO claimed there was no proof that it ever agreed to Meta's terms of service, but Hamilton rejected that argument.

“Defendants cannot meaningfully dispute that agreeing to the terms of service was necessary to create a WhatsApp account,” she wrote.

Hamilton plans to hold a trial to determine the amount of damages NSO will have to pay to Meta.