In a landmark ruling, a US federal judge has found Israeli spyware maker NSO Group liable for breaching hacking laws by using WhatsApp to infect devices with its Pegasus spyware. The decision marks a significant milestone in the long-standing legal battle between NSO Group and WhatsApp, which was acquired by Meta in 2014.

The ruling, handed down by Northern California federal judge Phyllis Hamilton on Friday, stems from a lawsuit filed by WhatsApp in 2019. The messaging platform alleged that NSO Group had exploited an audio-calling vulnerability in WhatsApp to install its Pegasus spyware on unsuspecting users' devices. The malware, which can extract sensitive information from infected devices, was reportedly used to target over 100 human rights defenders, journalists, and government officials.

Judge Hamilton's ruling holds NSO Group accountable for violating state and federal hacking laws, as well as WhatsApp's terms of service, which prohibit the use of the messaging platform for malicious purposes. The judge noted that NSO Group did not dispute that it had reverse-engineered and/or decompiled WhatsApp's software to install its spyware, but raised questions about whether it had done so before agreeing to WhatsApp's terms of service.

However, the judge ultimately concluded that NSO Group must have first gained access to WhatsApp, citing the lack of a plausible explanation for how the spyware company could have done so without agreeing to the terms of service. The ruling also highlights NSO Group's repeated failure to produce relevant discovery, including the Pegasus source code, despite a court order requiring its disclosure.

In a statement, Meta spokesperson Emily Westcott welcomed the ruling, saying that NSO Group can no longer avoid accountability for its unlawful attacks on WhatsApp users. "With this ruling, spyware companies should be on notice that their illegal actions will not be tolerated," Westcott added. WhatsApp head Will Cathcart described the ruling as a "huge win for privacy" in a post on X.

The case will now proceed to a trial in March 2025, where a jury will decide on the damages NSO Group should pay WhatsApp. The ruling is expected to have significant implications for the cybersecurity industry, as it sets a precedent for holding spyware companies accountable for their actions.

NSO Group has previously argued that its Pegasus spyware helps law enforcement and intelligence agencies fight crime and protect national security. However, the ruling raises questions about the ethics and legality of using such tools to target individuals, including human rights defenders and journalists.

The decision is a major victory for WhatsApp and its parent company Meta, which has been at the forefront of efforts to protect user privacy and security. The ruling also underscores the need for greater transparency and accountability in the cybersecurity industry, particularly when it comes to the development and use of spyware and other surveillance tools.