SAN FRANCISCO — A US judge told the world’s most notorious spyware company to stop hacking WhatsApp. According to Meta, it did not. The company has accused NSO Group, the blacklisted Israeli firm behind the Pegasus spyware, of continuing to attack WhatsApp users months after a federal court ordered it to stop, and is asking a judge to hold it in contempt. WhatsApp said it detected fresh attempts to compromise its users through deceptive links and social-engineering messages, traced to the same firm a court barred last year from targeting the platform at all.
The motion, filed this week, reopens one of the most consequential fights between a Silicon Valley giant and the global surveillance-for-hire industry. WhatsApp first sued NSO in 2019 after the spyware was used to deliver Pegasus to some 1,400 of its users in a single campaign. It won, and last autumn a judge issued a permanent injunction. That NSO would allegedly breach a standing US court order, while already sitting on a US government blacklist, is a measure of how little the company fears consequences.
Pegasus is not an ordinary hacking tool. Once installed, often with no action required from the victim at all, it can turn a smartphone into what researchers have described as a round-the-clock surveillance device, reading messages, switching on the microphone and camera, and tracking a target’s every move. NSO insists it sells only to vetted governments to fight crime and terrorism. The evidence assembled over years tells a different story.
Investigations have repeatedly found Pegasus on the phones of journalists, opposition politicians, lawyers and human rights defenders, among them Palestinian rights workers and reporters at outlets from Al Jazeera to the world’s largest wire services. Governments from Mexico to Morocco to the Gulf monarchies have been linked to its use against their critics. The spyware that NSO frames as a shield against terrorists has, in practice, been a favourite instrument for hunting the people who hold power to account.
NSO did not emerge from nowhere. It is one node in Israel’s web of military-linked surveillance firms, an industry staffed largely by veterans of the country’s signals-intelligence units and marketed worldwide as battle-tested. Israeli spyware has become one of the state’s most effective diplomatic exports, opening doors with governments hungry for tools to monitor dissent. The technology refined in the surveillance of Palestinians under occupation is then sold to autocrats abroad.
For Meta, the case is also about the credibility of its own promises. WhatsApp’s encryption is the foundation of the privacy it markets to billions, and a spyware firm that can repeatedly breach it, court order or not, is an existential embarrassment. The company has leaned into the fight, publicising each detected campaign, in part because the alternative is conceding that the lock on the world’s most popular messaging app can be picked by anyone NSO chooses to sell to.
What makes the contempt motion striking is what it implies about accountability. NSO has been sued, sanctioned, blacklisted and now, allegedly, caught violating a direct court order, and still it operates. The episode is one more marker in the wider struggle over who controls digital surveillance, a contest in which the firms and states doing the watching have consistently stayed a step ahead of the courts and regulators meant to restrain them.
NSO has not detailed any response to the latest accusation, and in past disputes it has argued that it cannot control how sovereign clients deploy its products once sold, and that it cuts off abusers when they are identified. Critics call that a convenient fiction for a company that builds, maintains and updates the spyware its customers then point at whomever they wish. A contempt finding, if it comes, would test whether a US court can impose a cost that years of scandal have not.
The deeper question has little to do with one company. It is whether the most powerful surveillance tools ever built can be governed at all once they are loose in the world, sold by a state that treats them as strategic assets to buyers who treat dissent as a threat. WhatsApp can patch a vulnerability and return to court. The journalist or activist whose phone has already been opened cannot unsee what was taken from it.
What the filing cannot resolve is the asymmetry at the heart of the spyware trade. A messaging company can win an injunction, win a contempt ruling, win again, and the industry it is fighting will simply regroup under a new name or a new shell. Until the governments that buy Pegasus, and the one that incubates it, face a cost of their own, the court orders will keep being written, and the phones will keep being opened.
