Litigation Details for WhatsApp Inc. v. NSO Group Technologies Limited (N.D. Cal. 2019)

WhatsApp Inc. v. NSO Group Technologies Limited (N.D. Cal. 2019)

Docket		Date Filed	2019-10-29
Court	District Court, N.D. California	Date Terminated
Cause	28:1331 Fed. Question	Assigned To	Phyllis Jean Hamilton
Jury Demand	Plaintiff	Referred To
Patents	6,147,103; 6,166,213; 6,191,148; 6,369,085; 6,428,810; 7,411,070
Link to Docket	External link to docket

Details for WhatsApp Inc. v. NSO Group Technologies Limited (N.D. Cal. 2019)

Date Filed	Document No.	Description	Snippet	Link To Document
2019-10-29	29	Exhibit 3 to Declaration of Joseph D. Mornin	quot;the `070 atent") U.S. Patent No. 6,147,103 October• 9, 2018 (&…960 patent, the `424 patent, the `103 patent, the `213 patent, the `148 patent, or the `810 patent -- …230 patent, Che `960 patent, the `424 patent, the `103 patent, the `213 patent, the `1~8 patent, the `810…872 patent; the `810 patent; the `085 patent; and U.S. Patent No. 5,948,789("the `789 patent"…the `960 patent, the `424 patent, the `103 patent, the `213 patent, and the `148 patent. Thus, these	External link to document

WhatsApp Inc. v. NSO Group Technologies Limited: A Landmark Litigation Against Spyware Abuse

Introduction

In a significant legal battle, WhatsApp Inc., along with its parent company Facebook (now Meta), has taken on NSO Group Technologies Limited, an Israeli company known for its Pegasus spyware. This litigation, filed in 2019, has marked a crucial milestone in the fight against unauthorized surveillance and the misuse of spyware.

Background of the Case

On October 29, 2019, WhatsApp and Facebook filed a complaint against NSO Group and its majority shareholder, Q Cyber Technologies Ltd., in the United States District Court for the Northern District of California. The complaint alleged that NSO Group had exploited a vulnerability in WhatsApp's system to install Pegasus spyware on approximately 1,400 mobile devices, enabling the surveillance of targeted WhatsApp users[1][3][4].

Causes of Action

The plaintiffs presented four main causes of action:

• Violation of the Computer Fraud and Abuse Act (CFAA): WhatsApp alleged that NSO Group knowingly accessed WhatsApp’s servers without authorization and with the intent to obtain something of value.
• Violation of the California Comprehensive Computer Data Access and Fraud Act (CDAFA): The plaintiffs claimed that NSO Group used WhatsApp’s network to defraud and wrongfully obtain money.
• Breach of Contract: WhatsApp argued that NSO Group breached its Terms of Service, causing injury to the plaintiffs.
• Trespass to Chattels: The final cause of action alleged that NSO Group interfered with WhatsApp’s computer systems intentionally and without authorization[1][4][5].

Court Rulings and Decisions

Motion to Dismiss

The court denied NSO Group's motion to dismiss the complaint in all but one cause of action, concerning trespass to movable personal property. The court held that NSO Group retained some role in the operation of their Pegasus spyware, even if it was at the direction of their customers[1][4].

Summary Judgment

In a landmark decision on December 20, 2024, Judge Phyllis J. Hamilton granted summary judgment in favor of Meta and WhatsApp on all claims. The court found NSO Group liable for violating the CFAA and CDAFA, as well as for breaching WhatsApp’s terms of service. This ruling marked the first time a commercial spyware company has been held liable in a U.S. court[3][5].

Discovery and Sanctions

The court also granted in part Meta and WhatsApp’s motion for discovery sanctions against NSO Group for failing to produce the source code for Pegasus as ordered. This failure to comply with court orders further underscored NSO Group's lack of cooperation and transparency[5].

Key Findings and Implications

• Control Over Spyware: The court found that NSO Group controlled every aspect of the Pegasus spyware’s operation, contradicting their claims that clients were solely responsible for its misuse[3][5].
• Personal Liability: The decision highlighted potential personal liability for senior executives involved in unlawful cyber activities, setting a critical precedent for holding spyware manufacturers accountable under U.S. anti-hacking laws[3].
• Regulatory Scrutiny: The case signals heightened regulatory and judicial scrutiny over spyware companies, emphasizing the need for robust legal counsel and governance practices to manage risk proactively[3].

Impact on Victims and the Industry

The ruling has been hailed as a critical win for victims of spyware attacks, including activists, journalists, and political dissidents who have been targeted worldwide. It serves as a warning to other spyware companies and underscores the importance of ethical and legal standards in the development and deployment of surveillance technology[3].

Future Proceedings

The next phase of the case will focus on determining the amount of damages to which WhatsApp and Meta are entitled. A trial solely on damages is scheduled for March 2025[5].

Key Takeaways

• Liability for Spyware Abuse: NSO Group has been held liable for violating U.S. and California laws related to computer fraud and abuse.
• Control and Accountability: The court established that NSO Group retained significant control over the operation of its Pegasus spyware.
• Personal and Corporate Accountability: Senior executives may face personal liability for their involvement in unlawful cyber activities.
• Regulatory and Judicial Scrutiny: The case highlights the increasing scrutiny over spyware companies and the need for robust legal and governance practices.

FAQs

1. What was the basis of the lawsuit filed by WhatsApp against NSO Group?

   • The lawsuit alleged that NSO Group exploited a vulnerability in WhatsApp’s system to install Pegasus spyware on approximately 1,400 mobile devices, enabling the surveillance of targeted WhatsApp users.

2. Which laws did the court find NSO Group violated?

   • The court found NSO Group liable for violating the Computer Fraud and Abuse Act (CFAA) and the California Comprehensive Computer Data Access and Fraud Act (CDAFA), as well as breaching WhatsApp’s terms of service.

3. What were the implications of the court's decision on NSO Group's operations?

   • The decision marked the first time a commercial spyware company has been held liable in a U.S. court and highlighted potential personal liability for senior executives involved in unlawful cyber activities.

4. How did the court address NSO Group's failure to comply with discovery orders?

   • The court granted in part Meta and WhatsApp’s motion for discovery sanctions against NSO Group for failing to produce the source code for Pegasus as ordered.

5. What is the next step in the litigation process?

   • A trial solely on damages is scheduled for March 2025 to determine the amount of damages to which WhatsApp and Meta are entitled.

Sources

1. Global Freedom of Expression, Columbia University - WhatsApp Inc. v. NSO Group Technologies Limited
2. Casetext - WhatsApp Inc. v. NSO Grp. Techs.
3. Today's General Counsel - NSO Group Held Liable for WhatsApp Spyware Attacks
4. vLex - Whatsapp Inc. v. NSO Grp. Techs. Ltd.
5. Davis Polk - Landmark summary judgment decision for Meta and WhatsApp