A U.S. federal court has permanently barred Israeli cyber-intelligence firm NSO Group from exploiting vulnerabilities in WhatsApp, one of the world’s most widely used messaging platforms.
The ruling, issued Friday by U.S. District Judge Phyllis Hamilton, concludes a six-year legal battle between NSO and WhatsApp's parent company, Meta Platforms. The 25-page decision not only enforces a permanent injunction on NSO’s ability to access or target WhatsApp, but also marks a significant, if partial, victory for advocates of digital privacy and civil liberties.
The ruling is seen as a major setback for NSO Group, which has faced widespread scrutiny for its Pegasus spyware, a powerful surveillance tool allegedly used by governments worldwide to target journalists, activists, and political dissidents.
According to the court filing, NSO had previously warned that a ban on accessing WhatsApp could effectively cripple its operations, threatening the very viability of its business. Despite this, the court moved forward with the injunction, emphasizing the need to protect millions of users from unlawful surveillance.
While the ruling delivered a strong legal blow to NSO, it also included a significant reduction in financial penalties. The court slashed punitive damages from an initial estimate of $167 million to just $4 million, a 97% reduction.
Meta expressed satisfaction with the outcome nonetheless. Will Cathcart, head of WhatsApp, posted on X (formerly Twitter): “Today’s ruling permanently bans spyware maker NSO from targeting WhatsApp and its global users again. We welcome this outcome after six years of litigation to hold NSO accountable for attacking members of civil society.”
The lawsuit stemmed from a 2019 incident where Meta accused NSO of exploiting a vulnerability in WhatsApp to surveil approximately 1,400 users, including lawyers, journalists, and human rights defenders.
In response to the ruling, NSO welcomed the dramatic reduction in damages but maintained that its clients, primarily government agencies, are not bound by the injunction.
“The ruling does not affect our customers, who continue to use our technology for legitimate public safety purposes,” the company said in a statement, adding that it will review the judgment to determine its next legal steps.
The decision adds to mounting legal and political pressure on NSO and similar firms operating in the lucrative but controversial spyware industry. NSO’s Pegasus tool has been blacklisted by the U.S. Commerce Department since 2021 over allegations of facilitating human rights abuses.
Earlier this year, WhatsApp also thwarted a separate surveillance operation allegedly conducted by another Israeli spyware firm, Paragon, targeting at least 90 individuals globally.