Today, a jury delivered a verdict in favor of WhatsApp in its case against NSO Group, marking a significant moment for privacy and security. The decision requires NSO, known for its spyware activities, to pay damages, setting a precedent against the illegal use of spyware that threatens individual privacy.
Six years ago, WhatsApp engineers identified and halted an attack by NSO using its Pegasus spyware tool. This tool targeted over a thousand users, including human rights activists and journalists. WhatsApp collaborated with Citizen Lab to investigate further and alert those potentially affected.
The trial provided insight into the operations of NSO's surveillance system. Pegasus can secretly compromise phones to access information from apps like financial data, emails, and messages. It can also activate microphones and cameras without user consent.
WhatsApp was not the only target of NSO. Although WhatsApp blocked an attack exploiting its calling system in 2019, Pegasus continues to find new ways to install spyware on devices through various methods. NSO admitted to spending millions annually on developing such malware techniques.
Given the sensitive information accessed via devices today, including encrypted apps like WhatsApp and Signal, efforts will continue against vendors targeting individuals globally. Today's ruling sends a message that illegal actions against American technologies are unacceptable.
WhatsApp acknowledges the challenge ahead in collecting damages from NSO but plans to donate these funds to digital rights organizations worldwide. The next step is securing a court order preventing future targeting by NSO.
Security researchers are encouraged to report bugs through WhatsApp's Bug Bounty program for quick resolution and user protection.
Unofficial transcripts of deposition videos shown in court are being published for researchers and journalists studying these threats. Official transcripts will be added once available.