US Court Holds NSO Group Liable for WhatsApp Pegasus Spyware Attack

What’s in today’s article?

• Why in News?
• Pegasus Spyware
• Pegasus in India
• Background of the Case
• Key highlights of the ruling
• Significance of the Ruling

Why in News?

• Meta’s WhatsApp secured a significant legal win as a US federal court found the Israeli firm NSO Group liable under federal and California laws for spyware attacks targeting around 1,400 devices.
• WhatsApp had sued NSO in 2019, accusing it of using Pegasus spyware to hack and surveil the phones of nearly 1,400 individuals during a two-week period in May 2019. The court will now determine the damages.

Pegasus Spyware

• About
  • Pegasus is spyware that can infect phones via exploit links or missed video calls (no user interaction needed).
  • Once installed, it grants complete access to the target’s phone, including passwords, messages, calls, camera, and microphone.
• Capabilities of Pegasus
  • Accesses private data, passwords, contact lists, calendar events, emails, SMS, and browsing history.
  • Activates the phone’s camera and microphone for live surveillance.
  • Works on Android, iOS, BlackBerry, and Symbian devices.
  • Leaves no trace, has a self-destruct feature, and uses minimal resources to avoid detection.

Pegasus in India

• Background
  • At least two dozen Indian academics, lawyers, Dalit activists, and journalists were targeted.
  • NSO claims it only provides Pegasus to licensed government intelligence and law enforcement agencies.
• Pegasus Spyware’s Global and Indian Impact
  • Pegasus spyware has reportedly targeted government officials, journalists, human rights activists, and diplomats worldwide, including in India.
  • In 2021, it was alleged that Pegasus was used to monitor over 300 Indian phone numbers, including those of Union Ministers, opposition leaders, journalists, and civil society members.
  • The NSO Group claims it only sells Pegasus to governments, but documents from the WhatsApp case revealed the company played a significant role in deploying the spyware, contrary to its claims of limited involvement.
• Indian Government’s Denial and Supreme Court Probe
  • The Indian government denied allegations of Pegasus misuse, with IT Minister calling the claims baseless and asserting that Indian surveillance laws prevent unauthorized monitoring.
  • Following public outcry, the Supreme Court of India formed a technical expert committee in 2021 to investigate the allegations.
  • In its 2022 report, the committee found no conclusive evidence of Pegasus use but noted the Central Government’s lack of cooperation.
  • The report remains sealed and unreleased.

Background of the Case

• In October 2019, WhatsApp, owned by Meta, filed a lawsuit against Israeli technology company NSO Group in the US District Court of Northern California.
• The suit alleged that NSO had exploited a bug in WhatsApp to install its Pegasus spyware on the devices of 1,400 users, including activists, journalists, and members of civil society.
• Pegasus was used by NSO’s government clients to extract sensitive data from target devices.

Key highlights of the ruling

• Violation of Cybersecurity Laws
  • The court ruled that NSO Group violated the Computer Fraud and Abuse Act (CFAA), a federal law criminalizing unauthorized digital access, and California’s Computer Data Access and Fraud Act (CDAFA).
  • The ruling stated that NSO had exploited WhatsApp’s servers to install Pegasus spyware and gain unauthorized access to users’ devices.
• Terms of Service Breach
  • The court also concluded that NSO Group violated WhatsApp’s terms of service by reverse-engineering and decompiling its source code.
  • The court reasoned that NSO must have agreed to WhatsApp’s terms to gain access to its software, further solidifying the breach.
• WhatsApp’s Response
  • WhatsApp hailed the ruling as a significant victory for privacy. It emphasized that spyware companies should not evade accountability.

Significance of the Ruling

• This ruling is notable as no prior court had held NSO Group accountable for its spyware.
• It sets a precedent that surveillance companies cannot claim immunity or avoid liability for unlawful actions.

Conclusion

• The court ruling against NSO Group highlights increasing scrutiny of the misuse of spyware like Pegasus. In India, the spyware has stirred political and legal debates, with unresolved allegations of its use against politicians, journalists, and activists. The sealed Supreme Court report and the global ramifications of the Pegasus scandal underline the need for transparency and accountability.

Q.1. What is Pegasus spyware, and how does it operate?

Pegasus is a sophisticated spyware that infiltrates phones through exploit links or missed calls. It grants access to passwords, messages, calls, camera, and microphone, enabling live surveillance. It works stealthily across multiple platforms, including Android and iOS devices.

Q.2. Why is the US court ruling against NSO Group significant?

The ruling is the first to hold NSO Group accountable for Pegasus spyware misuse. It establishes a precedent that spyware companies cannot claim immunity or escape

Source: US court holds Israeli company NSO liable for targeting WhatsApp users

Indian Express

‹ ›

NDTV