A federal judge in California agreed with WhatsApp that NSO Group, the Israeli cybersurveillance firm behind the Pegasus spyware, hacked its systems by sending malware through its servers to thousands of its users’ phones. . WhatsApp and its parent company, Meta, sued the NSO Group in 2019 and it was accused of spreading malware to 1,400 mobile devices in 20 countries with surveillance as its purpose. They previously disclosed that some of the target phones were owned by journalists, human rights activists, prominent female leaders and political dissidents. The Washington Post reports that District Judge Phyllis Hamilton granted WhatsApp’s motion for summary judgment against NSO and ruled that it violated the US Computer Fraud and Abuse Act (CFAA).

NSO Group disputed the allegations in the “strongest possible terms” when the lawsuit was filed. It denied it had a hand in the attacks and told Engadget previously that its sole purpose was to “provide technology to licensed government intelligence and law enforcement agencies to help them fight terrorism and seriously that crime.” The company argued that it should not be held liable, as its services were only sold to government agencies, which determined their targets. In 2020, the Meta its lawsuit has increased and accused the company of using US-based servers to conduct Pegasus spyware attacks.

Judge Hamilton ruled that the NSO Group violated the CFAA, because the company appeared to fully recognize that the modified WhatsApp program used by its clients to target users would send messages through legitimate WhatsApp servers. The messages then allow the Pegasus spyware to be installed on users’ devices – the targets don’t have to do anything, like pick up the phone to make a call or click on a link, to be infected. The court also found that the plaintiff’s motion for sanctions should be granted because NSO Group “repeatedly (failed) to make relevant discovery,” the most significant of which was the Pegasus source code.

WhatsApp spokesperson Carl Woog said The Post which the company believes is the first court decision agreeing that a major spyware vendor has violated US hacking laws. “We are grateful for today’s decision,” Woog told the publication. “The NSO can no longer avoid responsibility for their unlawful attacks on WhatsApp, journalists, human rights activists and civil society. With this decision, spyware companies must notice that their illegal actions will not be tolerated.” In his decision, Judge Hamilton wrote that his order resolves all issues regarding the responsibility of the NSO Group and that a trial will continue only to determine how much the company should pay in damages.