US Court Orders NSO Group to Hand Over Pegasus Spyware Source Code to WhatsApp

US district court has ordered NSO Group to provide WhatsApp with the source code of its controversial Pegasus spyware, following a legal battle in the United States. WhatsApp has accused NSO Group of spying on over 1,400 of its users in two weeks using the Pegasus malware. Despite the Israeli defence ministry considering the source code a state secret, US District Court Judge Phyllis Hamilton has granted WhatsApp’s request for information regarding the “full functionality” of Pegasus.

Pegasus is a spyware tool infamous for its use by governments and security agencies to conduct surveillance on individuals by exploiting vulnerabilities in devices like the iPhone. Apple has taken steps to mitigate the impact of the spyware, including warning journalists in Russia and users in Armenia about potential infections.

US Court Orders NSO Group to Hand Over Pegasus Spyware Source Code to WhatsApp

WhatsApp’s lawsuit is based on the claim that Pegasus intercepts information from various messaging apps, including WhatsApp, iMessage, Skype, Telegram, WeChat, and Facebook Messenger. To prove this allegation, WhatsApp argued that it needed access to the “full functionality” of Pegasus.

NSO Group had previously offered to share information only about the “installation layer” of the program. However, the judge rejected it as inadequate. However, the judge did reject WhatsApp’s request for information about NSO Group’s server architecture and a list of names of NSO Group clients.

WhatsApp initiated the lawsuit in 2019, but it has taken several years for different aspects of the case to progress. Judge Hamilton has ordered NSO Group to provide WhatsApp with all relevant spyware information covering a period from one year before to one year after the two weeks of the alleged Pegasus attack, spanning from late April 2018 to mid-May 2020.

A spokesperson for WhatsApp stated that the ruling “is an important milestone in our long-running goal of protecting WhatsApp users against unlawful attacks. Spyware companies and other malicious actors need to understand that authorities can catch them, and they will not be able to ignore the law”

In 2021, the US government blacklisted the use of NSO Group software by any government, citing actions contrary to US foreign policy and national security interests. NSO Group maintains that it should not be prosecuted for producing malware, arguing that it only sells its software to official governments worldwide.