Supreme Court clears way for WhatsApp case against NSO Group, opening spyware firm to more lawsuits

The Supreme Court on Monday denied a petition from NSO Group, the Israeli spyware maker, to dismiss a lawsuit alleging the firm exploited the WhatsApp platform in 2019 to spy on 1,400 users.

The decision upholds a previous California federal court ruling that rejected NSO Group’s arguments that it qualified for foreign sovereign immunity because it had been acting on behalf of a foreign government to investigate terrorist activity at the time it deployed the software.

NSO Group filed its petition with the Supreme Court in April after a federal judge in California rejected an appeal in the case brought by Meta, WhatsApp’s parent company.

“Meta has repeatedly impeded law enforcement’s ability to lawfully investigate criminals use of WhatsApp to commit serious crimes and acts of terror,” an NSO spokesperson told CyberScoop in an email. “We are confident that the court will determine that the use of Pegasus by its customers was legal.”

The Supreme Court previously called on the Biden administration to weigh in on the case and in November the Justice Department filed an amicus brief asking the court to deny the petition. The administration in 2021 added NSO Group and fellow Israeli spyware company Candiru to its entity list of companies that pose a national security risk.

The high court’s ruling comes amid growing concern from Washington about reining in the spyware industry. President Biden is expected to sign an executive order curtailing the use of spyware by federal agencies sometime this year and members of Congress have also proposed legislative solutions.

“We’re grateful to see the Supreme Court rejected NSO’s baseless petition,” Carl Woog, a spokesperson for WhatsApp, wrote in a statement to CyberScoop. “NSO’s spyware has enabled cyberattacks targeting human rights activists, journalists, and government officials. We firmly believe that their operations violate U.S. law and they must be held to account for their unlawful operations.” 

The court’s decision could help bolster the standing of other lawsuits against the surveillance firm. The Knight Institute filed a lawsuit in U.S. federal court against NSO Group in December on behalf of members of the Salvadoran news outlet El Faro. The lawsuit alleges that the NSO Group violated U.S. hacking laws by deploying spyware against the journalists.

“We’re pleased that the Supreme Court rejected NSO Group’s petition. Today’s decision clears the path for lawsuits brought by the tech companies, as well as for suits brought by journalists and human rights advocates who have been victims of spyware attacks,” Carrie DeCell, senior staff attorney at the Knight First Amendment Institute at Columbia University, wrote in a statement. “The use of spyware to surveil and intimidate journalists poses one of the most urgent threats to press freedom and democracy today.”

Apple is also suing NSO Group in an effort to permanently ban the company from using any of its products, services or software.