A federal judge has ordered spyware maker NSO to stop using its Pegasus app to focus on or infect users of WhatsApp.
The ruling, issued Friday by Phyllis J. Hamilton of the US District Court of the District of Northern California, grants a everlasting injunction sought by WhatsApp owner Meta in a case it brought against NSO in 2019. The lawsuit alleged that Meta caught NSO attempting to surreptitiously infect about 1,400 mobile phones—many belonging to attorneys, journalists, human-rights activists, political dissidents, diplomats, and senior foreign government officials—with Pegasus. As a part of the campaign, NSO created fake WhatsApp accounts and targeted Meta infrastructure. The suit sought monetary awards and an injunction against the practice.
Setting a precedent
Friday’s ruling ordered NSO to permanently stop targeting WhatsApp users, attempting to contaminate their devices, or intercepting WhatsApp messages, that are end-to-end encrypted using the open source Signal Protocol. Hamilton also ruled that NSO must delete any data it obtained when targeting the WhatsApp users.
NSO had argued that such a ruling would “force NSO out of business,” as Pegasus is its “flagship product.” Hamilton ruled that the harm Pegasus posed to Meta outweighed any such considerations.
“Within the court’s view, any business that deals with users’ personal information, and that invests resources into ways to encrypt that non-public information, is harmed by the unauthorized access of that non-public information—and it’s greater than only a reputational harm, it’s a business harm,” Hamilton wrote. “Essentially, a part of what corporations reminiscent of Whatsapp are ‘selling’ is informational privacy, and any unauthorized access is an interference with that sale. Defendants’ conduct serves to defeat one in every of the needs of the service being offered by plaintiffs, which constitutes direct harm.”
The judge went on to disclaim Meta’s request that the injunction bar foreign governments which will use WhatsApp. She said that sovereign governments weren’t parties to the lawsuit. Friday’s ruling also denied Meta’s request that the injunction bar NSO from targeting users of other Meta properties reminiscent of Facebook and Instagram on the grounds there was no evidence presented concerning targeting of them.