A US court has ordered NSO Group, the maker of the Pegasus spyware, to hand over its code and other WhatsApp spyware.
Judge Phyllis Hamilton’s decision is an important legal victory for WhatsApp, owned by Meta, which has been suing NSO since 2019, claiming that the Israeli company’s spyware was used against 1,400 WhatsApp users over a two-week period.
NSO’s Pegasus code, as well as the codes of other surveillance products it sells, are considered state secrets that are closely guarded and highly sought after. NSO’s activities are closely regulated by the Israeli Ministry of Defense, which must review and approve the sale of all licenses to foreign governments, reports Guardian.
In reaching her decision, Hamilton took into account NSO’s request that she be released from all disclosure obligations in this case due to «various US and Israeli restrictions».
Ultimately, however, she sided with WhatsApp, ordering NSO to provide «all relevant spyware» for a period of one year before and after the two weeks during which WhatsApp users were allegedly attacked: from April 29, 2018 to May 10, 2020. The NSO must also provide WhatsApp with information «regarding the full functionality of the relevant spyware».
Hamilton, however, ruled in favor of NSO on another issue: the company will not be forced to disclose the names of its customers or information about its server architecture at this time.
The court proceedings are ongoing. NSO’s Pegasus software can provide unlimited access to phone calls, emails, photos, location information, and encrypted messages without the user’s knowledge. In 2021, the Biden administration blacklisted NSO after recognizing that the Israeli spyware maker was acting «against the interests of US foreign policy and national security».
NSO sells its spyware to government customers around the world and says that the agencies that deploy it are responsible for how it is used. Although NSO does not disclose the names of its customers, research and media reports over the years have pointed to Poland, Saudi Arabia, Rwanda, India, Hungary, and the United Arab Emirates as countries that have previously used the technology to spy on dissidents, journalists, human rights defenders, and other members of civil society.
The NSO claims that Pegasus helps law enforcement and intelligence agencies fight crime and protect national security, and that its technology is designed to help catch terrorists, child abusers, and hardened criminals.