Litigation Details for WhatsApp Inc. v. NSO Group Technologies Limited (N.D. Cal. 2019)

WhatsApp Inc. v. NSO Group Technologies Limited (N.D. Cal. 2019)

Docket		Date Filed	2019-10-29
Court	District Court, N.D. California	Date Terminated
Cause	28:1331 Fed. Question	Assigned To	Phyllis Jean Hamilton
Jury Demand	Plaintiff	Referred To
Patents	6,147,103; 6,166,213; 6,191,148; 6,369,085; 6,428,810; 7,411,070
Link to Docket	External link to docket

Details for WhatsApp Inc. v. NSO Group Technologies Limited (N.D. Cal. 2019)

Date Filed	Document No.	Description	Snippet	Link To Document
2019-10-29	29	Exhibit 3 to Declaration of Joseph D. Mornin	quot;the `070 atent") U.S. Patent No. 6,147,103 October• 9, 2018 (&…960 patent, the `424 patent, the `103 patent, the `213 patent, the `148 patent, or the `810 patent -- …230 patent, Che `960 patent, the `424 patent, the `103 patent, the `213 patent, the `1~8 patent, the `810…872 patent; the `810 patent; the `085 patent; and U.S. Patent No. 5,948,789("the `789 patent"…the `960 patent, the `424 patent, the `103 patent, the `213 patent, and the `148 patent. Thus, these	External link to document

WhatsApp Inc. v. NSO Group Technologies: Litigation Summary, Claims, Damages, and Case Status

Last updated: September 5, 2026

WhatsApp Inc. v. NSO Group Technologies Limited, No. 4:19-cv-07123-PJH, is a federal cyber-privacy case in which WhatsApp accused NSO Group of using Pegasus spyware infrastructure to target approximately 1,400 WhatsApp users, including journalists, human-rights advocates, diplomats and government officials. The case is significant because it tests whether a spyware developer can be held directly liable in the United States for exploiting a communications platform and deploying malware through its servers.

On December 20, 2024, the U.S. District Court for the Northern District of California ruled in WhatsApp’s favor on liability issues, holding NSO responsible for violating WhatsApp’s terms of service and federal and California computer-access laws. The court left damages for later determination. The decision substantially narrowed the case to monetary relief and related remedial issues. [1][2]

What is WhatsApp v. NSO Group about?

WhatsApp alleges that NSO Group exploited vulnerabilities in WhatsApp’s communications infrastructure to deliver Pegasus spyware to targeted devices. According to the complaint, NSO’s operators used WhatsApp servers and accounts to send malicious installation requests without requiring the target to answer a call or click a link.

Pegasus is a surveillance product developed and licensed by NSO Group to government customers. Once installed, the spyware can provide access to messages, photographs, location data, microphones, cameras and other information on a target device.

WhatsApp filed the action on October 29, 2019. The complaint alleged that NSO:

• Accessed WhatsApp’s servers without authorization.
• Violated WhatsApp’s Terms of Service.
• Used WhatsApp’s platform to identify and compromise targeted devices.
• Damaged or interfered with WhatsApp’s computer systems.
• Conducted a coordinated cyberattack affecting approximately 1,400 users over a roughly two-week period in April and May 2019.

The case was assigned to Judge Phyllis J. Hamilton in the Northern District of California. [3]

What claims did WhatsApp assert against NSO Group?

WhatsApp’s claims centered on unauthorized computer access, contractual violations and interference with computer systems.

Federal Computer Fraud and Abuse Act claim

WhatsApp asserted a claim under the Computer Fraud and Abuse Act, 18 U.S.C. § 1030. The statute prohibits various forms of unauthorized access, damage, impairment and fraud involving protected computers.

The case raised two recurring CFAA issues:

1. Whether NSO accessed WhatsApp’s systems without authorization.
2. Whether WhatsApp could recover for damage and impairment caused by spyware-related activity.

The court’s liability ruling treated NSO’s conduct as unauthorized access and rejected the central defense that NSO itself should not be liable because government customers allegedly operated the spyware.

California Comprehensive Computer Data Access and Fraud Act claim

WhatsApp also relied on California’s computer-access statute, California Penal Code § 502. The statute creates civil liability for unauthorized access, use, copying, disruption or interference involving computer systems and data.

The California claim was important because it provides a state-law cause of action tailored to computer misuse and does not depend entirely on the narrower damage and loss concepts that often drive CFAA disputes.

Breach of contract

WhatsApp alleged that NSO breached WhatsApp’s Terms of Service by:

• Accessing WhatsApp’s services without authorization.
• Using automated means to interact with the platform.
• Reverse engineering or modifying WhatsApp software.
• Creating accounts or infrastructure for unlawful purposes.
• Interfering with WhatsApp’s operations and users.

The contract claim gave WhatsApp a direct theory of liability independent of whether every spyware-related action satisfied the technical elements of the CFAA.

Trespass and related claims

WhatsApp also asserted claims involving trespass to chattels and interference with its computer systems. These theories focused on NSO’s alleged use of WhatsApp resources, servers and software to conduct surveillance operations.

The court’s final liability ruling reduced the importance of peripheral claims by establishing liability under the principal contract and computer-access theories.

When was the key court ruling issued?

The principal liability ruling was issued on December 20, 2024, after the court considered cross-motions for summary judgment. The court ruled for WhatsApp on major liability questions and rejected NSO’s attempt to avoid responsibility by attributing the conduct to its government customers. [1][2]

The ruling did not immediately establish the final amount payable by NSO. Damages, fees and any remaining remedial issues required further proceedings.

Date	Event
April-May 2019	Pegasus-related activity allegedly targeted approximately 1,400 WhatsApp users
October 29, 2019	WhatsApp filed suit in the Northern District of California
2019-2023	Pleading, jurisdiction, discovery and motion practice
2023-2024	Disputes continued over technical evidence, source code and NSO’s role in the operation
December 20, 2024	Court ruled for WhatsApp on principal liability issues
After December 20, 2024	Damages and related relief remained for determination

What did the court decide about NSO Group’s liability?

The ruling established that NSO could be held liable for conduct carried out through the Pegasus deployment infrastructure. The court did not accept a complete separation between NSO’s software and the alleged WhatsApp intrusions.

The decision has three practical consequences.

First, a spyware vendor cannot necessarily avoid platform liability by arguing that only the customer government used the tool. The vendor’s own role in developing, operating or directing the attack infrastructure may be sufficient to create liability.

Second, a platform’s terms of service can provide an independent basis for liability when the defendant uses the platform to carry out cyber operations. This is relevant to other cases involving malware-as-a-service, botnets, credential theft and commercial surveillance tools.

Third, the decision reduces the relevance of jurisdictional and immunity defenses. NSO had argued that the case implicated foreign sovereign interests because its customers included governments. The court did not treat that relationship as a complete bar to WhatsApp’s claims against NSO.

Did the court find NSO Group liable for Pegasus spyware attacks?

Yes. The December 2024 ruling found NSO liable on the central legal theories advanced by WhatsApp, including breach of WhatsApp’s terms and unauthorized computer access under federal and California law. [1][2]

The ruling concerned NSO’s conduct in accessing and using WhatsApp’s platform and infrastructure. It did not constitute a criminal finding against NSO, and it did not determine liability for every government customer or every Pegasus deployment worldwide.

The decision also did not resolve all questions concerning the conduct of individual government operators. Its focus was NSO’s participation in the technical operation and delivery of the surveillance system.

What damages could WhatsApp recover from NSO Group?

The record supports several potential categories of damages:

• Compensation for investigation, remediation and response costs.
• Losses associated with the impairment or disruption of WhatsApp systems.
• Contract damages.
• Statutory damages under applicable computer-access law.
• Potential punitive damages under qualifying California law theories.
• Attorneys’ fees and litigation costs where authorized by statute or contract.
• Injunctive relief restricting future access to WhatsApp systems.

The ultimate award depends on the court’s findings concerning causation, proof of loss, statutory remedies and the scope of any injunction. Public reporting concerning the liability ruling did not establish a final damages amount. [1][2]

WhatsApp’s financial exposure was not the primary commercial issue. WhatsApp is owned by Meta Platforms, whose 2023 annual report reported total revenue of approximately $134.9 billion. [4] The case’s larger value lies in platform protection, precedent for commercial spyware litigation and the ability to restrict NSO’s future access to WhatsApp infrastructure.

For NSO, the financial risk is more material. A damages award could be accompanied by compliance costs, limitations on infrastructure use, customer concerns and increased difficulty obtaining services from cloud, hosting and communications providers.

What was NSO Group’s main defense?

NSO’s principal defenses focused on authorization, causation, jurisdiction and the role of government customers.

NSO argued that it supplied Pegasus to governments and that the relevant operations were conducted by those customers. The company also challenged whether WhatsApp could establish that NSO itself accessed or impaired the relevant computer systems.

The defense raised questions about:

• Whether the CFAA covers the alleged conduct.
• Whether WhatsApp’s Terms of Service created enforceable restrictions against NSO.
• Whether NSO’s conduct caused compensable damage.
• Whether foreign sovereign interests limited the court’s jurisdiction.
• Whether the government customers, rather than NSO, were the proper defendants.

The court’s liability ruling rejected NSO’s effort to use the customer relationship as a complete defense. The result places greater emphasis on the vendor’s own technical control, infrastructure and participation.

What was the role of the technical evidence?

Technical evidence was central to the case. WhatsApp relied on server logs, account activity, infrastructure records and forensic analysis to connect Pegasus deployment activity with WhatsApp’s systems.

The litigation also involved disputes over NSO’s source code, technical documentation and discovery obligations. Evidence concerning how Pegasus operated, how WhatsApp servers were contacted and how the malware was delivered affected both liability and damages.

The technical record matters beyond this case because it supports a vendor-liability theory. A software developer that controls the delivery mechanism, maintains attack infrastructure or provides operational support may face greater exposure than a company that merely sells a conventional software product.

Does this case involve patents or Orange Book-listed products?

No. WhatsApp v. NSO Group is a cybersecurity and platform-access case, not a pharmaceutical patent dispute.

There are:

• No Orange Book listings.
• No Hatch-Waxman litigation.
• No Paragraph IV certification.
• No generic-drug launch issue.
• No biosimilar pathway.
• No FDA exclusivity period.
• No drug formulation or method-of-use patent at issue.

The relevant intellectual-property and technology rights concern WhatsApp software, platform access, confidential technical information and computer-system integrity. Those rights are enforced through contract, computer-access statutes and related civil claims rather than FDA-linked patent litigation.

What patent or technology rights are relevant to the dispute?

Although no patent claim is central to the case, several technology-rights concepts are relevant:

Software and platform terms

WhatsApp’s Terms of Service restrict unauthorized access, reverse engineering, automated use and misuse of the service. The contract theory was one of the strongest routes to liability because it linked NSO’s conduct directly to express platform restrictions.

Trade-secret and confidential-information issues

Technical evidence concerning WhatsApp’s infrastructure and Pegasus deployment methods may implicate confidential information. The reported liability ruling, however, centered on unauthorized access and contract violations rather than a standalone patent-infringement theory.

Cybersecurity controls

The case also concerns the legal significance of security controls, account creation, server authentication and automated communications. These issues can affect future disputes involving spyware, vulnerability exploitation and offensive-security vendors.

How does WhatsApp v. NSO compare with spyware and cyber-platform cases?

The case differs from ordinary malware litigation because WhatsApp did not sue an anonymous hacker or an end user. It sued a commercial developer that allegedly supplied and operated the surveillance technology.

Issue	WhatsApp v. NSO	Conventional malware case
Defendant	Commercial spyware developer	Individual attacker, criminal group or botnet operator
Platform	WhatsApp communications infrastructure	Victim network or endpoint
Tool	Pegasus surveillance software	Ransomware, credential theft or data-exfiltration malware
Main theories	CFAA, California computer-access law, contract	CFAA, state torts, contract or trade secret
Customer relationship	Government customers alleged to deploy tool	Usually no formal customer structure
Strategic issue	Vendor liability for operational spyware support	Attribution and recovery from unknown attackers

The decision therefore has relevance for cyber-intelligence firms, exploit brokers, managed security providers and vendors that supply offensive tools to state or private customers.

What is the current litigation status?

As of the December 20, 2024 liability ruling, WhatsApp had prevailed on the principal liability issues, while the amount and form of relief remained to be resolved. The case was no longer primarily about whether NSO could be held responsible. The remaining commercial questions concerned damages, attorneys’ fees, injunction terms and enforcement.

The ruling did not end all possible appellate activity. NSO could seek review of legal issues after entry of an appealable final judgment or qualifying order. Any appeal would likely focus on the scope of the CFAA, the enforceability of the Terms of Service against NSO, causation, damages and the treatment of government-customer conduct.

How strong is WhatsApp’s litigation position?

WhatsApp’s position is strong after the liability ruling because the court accepted the central theory that NSO’s own conduct, rather than only the conduct of its customers, was actionable.

The main remaining risks involve remedy rather than liability:

• WhatsApp must establish the damages legally attributable to NSO.
• Statutory damages may depend on the precise provisions applied.
• The court may distinguish between system impairment and user-targeting harms.
• An injunction must be drafted with sufficient specificity to be enforceable.
• NSO may attempt to narrow the judgment through post-trial motions or appeal.

For the broader market, the decision increases legal risk for spyware companies that operate delivery infrastructure or directly interact with third-party platforms.

What are the commercial implications for NSO Group?

The case increases NSO’s exposure in four areas.

Customer and government contracting

Government buyers may face greater litigation and reputational risk when vendors’ infrastructure is used against individuals outside the customer’s stated authorization.

Cloud and hosting access

An injunction or adverse judgment could support restrictions on NSO’s ability to use third-party hosting, messaging or infrastructure services.

Insurance and financing

A substantial judgment could affect insurance coverage, litigation reserves, financing terms and the ability to support research and development.

Product architecture

The ruling favors a model in which vendors separate customer operations from vendor-controlled infrastructure. Companies that retain operational control over deployment mechanisms may face greater exposure than vendors that license software without access or operational participation.

Key Takeaways

• WhatsApp sued NSO Group in October 2019 over Pegasus spyware activity affecting approximately 1,400 WhatsApp users.
• The case is No. 4:19-cv-07123-PJH in the Northern District of California.
• The principal claims involved the CFAA, California computer-access law and breach of WhatsApp’s Terms of Service.
• On December 20, 2024, the court ruled for WhatsApp on major liability issues.
• NSO’s argument that government customers were solely responsible did not eliminate NSO’s potential liability.
• Damages, attorneys’ fees and final injunctive relief remained for later proceedings.
• The case does not involve pharmaceutical patents, FDA exclusivity, Orange Book listings, Paragraph IV challenges or biosimilars.
• The ruling creates increased legal exposure for commercial spyware vendors that control deployment infrastructure or interact directly with third-party platforms.

FAQs

Can a spyware company be sued by a messaging platform?

Yes. A messaging platform can pursue contract and computer-access claims when a spyware company allegedly uses the platform’s servers, accounts or software without authorization.

Does NSO Group’s government-client model provide immunity?

No. Government customers and foreign-sovereign considerations do not automatically immunize a private technology vendor from liability for its own alleged access to a U.S. company’s computer systems.

Is Pegasus spyware illegal under U.S. law?

The legality depends on the conduct, authorization, target, jurisdiction and applicable statute. The WhatsApp ruling addressed NSO’s alleged unauthorized access and platform misuse, not every possible use of Pegasus by every customer.

Could WhatsApp obtain an injunction against NSO Group?

Yes. Injunctive relief could restrict NSO’s future access to WhatsApp systems or prohibit conduct that violates the court’s judgment. The scope would depend on the final order.

Could this decision affect other commercial surveillance vendors?

Yes. The ruling may increase exposure for vendors that provide spyware, exploit delivery systems or operational support while retaining technical control over infrastructure used to target third-party platforms.

References

1. WhatsApp Inc. v. NSO Group Technologies Ltd., No. 4:19-cv-07123-PJH, Order on cross-motions for summary judgment, U.S. District Court for the Northern District of California (Dec. 20, 2024).

2. Reuters. (2024, December 20). U.S. judge rules NSO Group liable for hacking WhatsApp users. Reuters.

3. WhatsApp Inc. v. NSO Group Technologies Ltd., No. 4:19-cv-07123-PJH, Complaint, U.S. District Court for the Northern District of California (Oct. 29, 2019).

4. Meta Platforms, Inc. (2024). Annual report pursuant to Section 13 or 15(d) of the Securities Exchange Act of 1934 for the fiscal year ended December 31, 2023. U.S. Securities and Exchange Commission.