We secured a decision holding NSO Group liable for its 2019 spyware attack targeting WhatsApp and its users

Davis Polk served as lead counsel for Meta Platforms, Inc. and WhatsApp LLC in litigation against NSO Group Technologies Ltd., the Israeli spyware company that developed and licenses Pegasus spyware. On December 20, 2024, Judge Phyllis J. Hamilton in the U.S. District Court for the Northern District of California issued a decision granting summary judgment on all claims in favor of Meta and WhatsApp, finding NSO Group liable for violating the Computer Fraud and Abuse Act (CFAA) and the California Comprehensive Computer Data Access and Fraud Act (CDAFA) and for breaching WhatsApp’s terms of service. In so ruling, Judge Hamilton also granted in part Meta and WhatsApp’s motion for discovery sanctions, based on NSO Group’s failure, among other things, to produce the source code for Pegasus as ordered by the court. Judge Hamilton scheduled a trial solely on damages for March 2025.

The case marks the first time that a commercial spyware company has been held liable in U.S. court. It is also the first U.S. court decision of liability against NSO Group, which was added to the Department of Commerce Entity List for activities contrary to the national security or foreign policy interests of the United States in November 2021. NSO Group and its spyware activities have been the subject of extensive media attention, including a segment on 60 Minutes and a recent HBO documentary by Ronan Farrow, Surveilled.

In a complaint filed in October 2019, Meta and WhatsApp alleged that between April and May 2019, NSO Group accessed WhatsApp’s servers without authorization in order to install Pegasus spyware on the mobile devices of more than 1,400 WhatsApp users. Meta and WhatsApp identified NSO Group as the source of the attack, and determined that NSO‘s victims included journalists, human rights activists, political dissidents and others.

The District Court in 2020 denied a motion by NSO Group to dismiss the case on the basis of foreign sovereign immunity, a defense relying on NSO Group’s claim that its customers consist solely of sovereign governments. The Ninth Circuit affirmed the dismissal, and the Supreme Court denied certiorari after requesting a Solicitor General brief.

In November 2023, the court denied NSO Group’s motion for a protective order in which NSO Group sought to be excused from the bulk of its discovery obligations on the basis of claimed restrictions under Israeli law. Applying the Ninth Circuit’s Richmark decision, Judge Hamilton ruled that the purported foreign-law restrictions did not excuse NSO Group’s U.S. discovery obligations as to materials that were sufficiently specific and important. In subsequent orders, the court clarified that NSO Group was obligated, among other things, to produce the source code for the Pegasus spyware at issue.

In its December 20, 2024, order granting summary judgment, the court concluded that NSO Group was subject to personal jurisdiction in California, that NSO Group exceeded its authorization to access the WhatsApp servers in violation of the CFAA and CDAFA, and that NSO Group violated the WhatsApp terms of service in developing Pegasus. The court also found that NSO Group should face sanctions for failing to produce discovery and disobeying court orders. The next phase of the case will resolve the amount of damages to which WhatsApp and Meta are entitled.

The Davis Polk team included partners Greg D. Andres, Antonio J. Perez-Marques and Micah G. Block, counsel Gina Cora, Craig T. Cagney and Andrew Yaphe and associates Esther C. Townes, Luca Marzorati, James C. Butler, Muhammad Sardar, Olivia Constance Bethea, Gersham Johnson, Quentin J. Ullrich, Amelia Birnie, Kaitlin Campanini and Meenu Mathews. Members of the Davis Polk team are based in the New York and Northern California offices.

Copy link to share post