JUDGE BARS NSO FROM TARGETING WHATSAPP USERS, DAMAGES REDUCED IN LANDMARK SPYWARE RULING

In a decision that could reshape the future of commercial surveillance technology, a U.S. federal judge has issued a permanent injunction barring NSO Group — the Israeli maker of the notorious Pegasus spyware — from ever targeting Meta’s WhatsApp platform again. The ruling also dramatically reduced financial penalties against NSO, cutting damages from $168 million to $4 million, but upheld the broader finding that the company’s conduct caused “irreparable injury” to WhatsApp’s systems and user trust.

The case stems from NSO’s 2019 infiltration of WhatsApp, where its zero-click Pegasus exploit was used to hack the phones of 1,400 users across multiple continents. Victims included journalists, political activists, attorneys, and human rights defenders. Pegasus operated by silently exploiting vulnerabilities in messaging and telephony applications — in this instance, WhatsApp’s call function — requiring no interaction from the victim. Once installed, it granted full access to calls, messages, photos, and even microphones in real time.

Judge Phyllis Hamilton of the U.S. District Court for the Northern District of California ruled that NSO’s actions constituted unlawful interference with Meta’s platform integrity, ordering the company to cease any form of targeting or reverse engineering of WhatsApp’s encryption or network architecture. While the reduced damages may appear to favor NSO, the injunction itself is far more consequential — it formally establishes that a private spyware vendor cannot claim sovereign immunity or operate with impunity inside U.S. digital infrastructure.

For NSO, the implications are severe. The company’s Pegasus framework relies on vulnerabilities in widely used apps — including WhatsApp, iMessage, and Signal — to deliver its payloads. With this injunction in place, any future exploit targeting Meta’s systems would place NSO in direct violation of a federal court order. In prior filings, NSO’s attorneys warned that such a restriction could “put the company’s entire enterprise at risk” and effectively “force NSO out of business.”

Yet in a statement following the ruling, an NSO spokesperson sought to downplay the decision, asserting that the injunction “does not apply to NSO’s customers, who will continue using the company’s technology to help protect public safety.” The ambiguity of that claim drew immediate criticism from legal experts and digital rights advocates.

Natalia Krapiva, senior tech counsel at Access Now, described the statement as “perplexing,” noting that the injunction’s wording is clear: NSO is barred from offering, using, or marketing any technology that enables unlawful access to WhatsApp messages or undermines its encryption. “The court recognized that by circumventing WhatsApp’s end-to-end encryption, NSO’s Pegasus spyware was causing irreparable harm to both users and Meta’s platform integrity,” Krapiva said. “This ruling reaffirms that violating digital sovereignty through surveillance tools is not protected speech — it’s an actionable offense.”

The decision was quickly hailed as a landmark victory by Will Cathcart, Head of WhatsApp, who posted:

“This judgment bans spyware maker NSO from ever targeting WhatsApp and our global users again. It’s a clear message that unlawful surveillance has consequences.”

Cathcart did not address the judge’s decision to reduce monetary damages, a move many legal analysts interpreted as a strategic balance — punishing the act without setting a precedent that could collapse future restitution frameworks in similar cases.

Behind the scenes, the ruling sends tremors across the commercial surveillance sector. Pegasus, which NSO insists is sold only to government clients for “lawful investigations of serious crime and terrorism,” has repeatedly been found on the phones of journalists, opposition figures, diplomats, and attorneys in more than 45 countries. Leaked databases and forensic analyses from Citizen Lab and Amnesty International’s Security Lab have tied Pegasus infections to authoritarian crackdowns in Mexico, Hungary, Saudi Arabia, India, and Morocco.

The case also places renewed scrutiny on U.S. investors backing such technologies. In early October, TechCrunch revealed that NSO had been quietly acquired by a group of investors led by Hollywood producer Robert Simonds, best known for producing Adam Sandler comedies. The acquisition — executed through a complex holding structure — effectively put an American at the helm of a company sanctioned by the U.S. Commerce Department in 2021 for “acting contrary to U.S. foreign policy and national security interests.”

That revelation adds another layer of irony to the court’s decision. While the injunction targets NSO’s operational behavior, its new ownership could complicate enforcement, particularly if the company shifts key infrastructure or intellectual property through shell entities outside of direct U.S. jurisdiction.

Legal experts describe the case as a watershed moment for digital rights jurisprudence. For the first time, a federal court recognized the act of penetrating encrypted communications as a civil rights and property harm, not merely a technical breach. The decision sets precedent for American companies like Meta, Apple, and Microsoft to pursue similar injunctions against exploit vendors — and could pave the way for a global norm restricting the trade of private surveillanceware.

In Europe, the ruling is expected to embolden lawmakers pushing for the EU Anti-Spyware Directive, a legislative framework designed to ban commercial spyware from being sold to non-state actors and to restrict its deployment even by state agencies without judicial oversight.

The broader consequence is existential: the case strips NSO of the shield it long claimed — that its tools are neutral and its clients are responsible for misuse. With this judgment, the legal system has finally declared what victims have argued for years — that building tools designed to exploit trust is itself an act of harm.

NSO is expected to appeal, but few believe it can reverse the injunction. The company’s previous arguments, invoking “foreign sovereign immunity” by claiming it acted as an agent for governments, have already been rejected by the Supreme Court in 2022. With the precedent now firmly embedded in California’s Northern District, future spyware litigation will have a blueprint to follow.

Whether NSO survives the legal fallout remains uncertain. What is clear is that the days of invisible immunity for surveillance companies are ending. Pegasus — once the unseen weapon of the digital age — has become a global cautionary tale.

Sponsored • TRJ Ads
Inquiries: contact@therealistjuggernaut.com

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE

AVAILABLE