A U.S. court has dealt a significant blow to the Israeli spyware firm NSO Group, permanently barring it from targeting the WhatsApp messaging service, a ruling the company itself admits could force it out of business. The decision caps a six-year legal battle initiated by Meta, WhatsApp's parent company, and is seen by human rights organizations as a landmark victory against the unchecked abuse of surveillance technology.
The permanent injunction against accessing WhatsApp represents an existential threat to NSO Group. The company had previously warned in court filings that such a ban "would put NSO’s entire enterprise at risk" and could "force NSO out of business" . This ruling comes at a precarious time for the spyware maker, which was recently acquired by a group of American investors led by Hollywood producer Robert Simonds .
While NSO sought to downplay the ruling by stating it only applies to the company itself and not its government clients, the technical inability to target one of the world's most popular messaging apps, with over two billion users, significantly undermines the utility and value of its flagship product, Pegasus.
Evidence presented during the six-year lawsuit revealed the highly invasive capabilities of NSO's Pegasus spyware. The court found that NSO reverse-engineered WhatsApp's code to stealthily install its malware on users' phones . Pegasus is designed to take control of a device, allowing operators to extract personal data, location information, photos, and contacts . It can also remotely activate the phone's microphone and camera, effectively turning it into a pocket spy .
The attacks were designed to be undetectable, using methods like missed calls and "zero-click" exploits that require no interaction from the phone's owner to succeed . Meta's lawsuit alleged that this technology was used to target approximately 1,400 devices, including those of journalists, human rights activists, and diplomats .
Human rights groups have celebrated the court's injunction as a watershed moment for accountability. For years, organizations like Amnesty International have documented how Pegasus spyware has been used by nation states, including those with poor human rights records, to target critics and silence dissent .
Amnesty International called the initial liability finding a "momentous win in the fight against spyware abuse," highlighting that the surveillance industry has long enabled severe human rights violations with impunity . Access Now, another digital rights group, stated this ruling signals that "the period of impunity is winding down" for spyware companies .
Despite the decisive injunction, the ruling was not a complete victory for Meta. Judge Phyllis Hamilton determined that the initial $168 million damages award was excessive . She stated that there have not been enough similar cases in the smartphone era to conclude that NSO's conduct was "particularly egregious," and therefore drastically reduced the punitive damages to a ratio of 9-to-1, leaving a final sum of just $4 million . This reduction highlights the ongoing challenge of quantifying the harm caused by sophisticated cyber-espionage.