In a court ruling, WhatsApp obtains access to the Pegasus source code

A US district court has ruled that NSO Group must provide WhatsApp access to the source code of its infamous Pegasus spyware. NSO Group, a US-based law firm, has been suing WhatsApp, claiming that the Israeli company’s Pegasus spyware was used to spy on more than 1,400 users in just two weeks. WhatsApp’s request for information about the “full functionality” of Pegasus has been granted by US District Court Judge Phyllis Hamilton, despite the Israeli Defense Ministry’s view that the source code is a state secret.

The infamous spyware program Pegasus is used by governments and security services to infiltrate iPhones and other devices in order to spy on people of interest. Apple has taken steps to combat the impact of the spyware, including alerting users in Armenia and Russian media about possible infestations.

The main contention in WhatsApp’s lawsuit is that Pegasus spyware collects data from a variety of messaging apps, including WhatsApp, iMessage, Skype, Telegram, WeChat, Facebook Messenger, and others. The service, which is owned by Meta, claimed that in order to validate the claim, it required access to Pegasus’s “complete functionality.”

The judge turned down an earlier offer by NSO Group to divulge details solely regarding the “installation layer” of the program, deeming it inadequate. She did decline WhatApp’s additional request that NSO Group provide details on its server architecture and a list of NSO Group clients.

The lawsuit was started by WhatsApp back in 2019, but it has taken this long for some of the components to get resolved. Judge Hamilton mandated that WhatsApp receive “all relevant spyware” for the two weeks leading up to the purported Pegasus assault, which is to say, from late April 2018 to mid-May 2020.

The decision “is an important milestone in our long-running goal of protecting WhatsApp users against unlawful attacks,” a WhatsApp representative said. “Malicious actors, including spyware businesses, must realize that they can be apprehended and that they cannot continue to flout the law.“

In 2021, the US government placed NSO Group software on a blacklist for usage by all governments, citing the Israeli company’s “aggressive actions against US foreign policy and national security interests.” NSO Group argues that since it exclusively sells its software to legitimate governments worldwide, it shouldn’t be held criminally responsible for creating malware.