WhatsApp and Meta v. NSO Group and Q Cyber Technologies

analysisOn 29 October 2019 WhatsApp Inc. and Facebook, Inc. sued NSO Group Technologies Ltd. and Q Cyber Technologies Ltd. in the US District Court for the Northern District of California, alleging that between about April and May 2019 the defendants used WhatsApp servers in the United States and elsewhere to send malware to approximately 1,400 mobile phones, whose users, according to the complaint, included attorneys, journalists, human rights activists, political dissidents, diplomats and senior foreign government officials. Relying on Israeli register records, the complaint described Q Cyber as NSO's sole active director and majority shareholder and OSY Technologies as Q Cyber's sole shareholder and director. The defendants argued that they were entitled to immunity because they acted for foreign governments, that Pegasus was marketed only to and used only by sovereign governments, and that their role was limited to advice and technical support in setting up, not operating, the technology; the district court and, in November 2021, the Ninth Circuit rejected the immunity defence. The court later granted partial summary judgment on liability, the jury's punitive award of May 2025 was remitted to $4,002,471 in October 2025, a permanent injunction and final judgment followed on 12 November 2025, and the defendants appealed; each step is described below. ^{1 2 3 4 5}

analysisThe early procedure was about service and jurisdiction. The clerk entered default against both companies on 2 March 2020, but on 25 March Judge Phyllis J. Hamilton partly granted their motion to set it aside and denied the plaintiffs' request for alternative service; the defendants' filings in March and April 2020 included declarations of Shalev Hulio. On 2 April 2020 the two companies moved to dismiss under Rules 12(b)(1), (2), (6) and (7), and in May 2020 their certificate of interested entities named NSO Group Technologies Limited and OSY Technologies SARL as corporate parents; the US Department of Justice filed sealed exhibits and a declaration of a DOJ attorney in connection with WhatsApp's motion to disqualify defence counsel. ²

analysisOn 8 November 2021 the Ninth Circuit (No. 20-16408) affirmed the district court's denial of the motion to dismiss on grounds of foreign sovereign immunity. The opinion recorded NSO's own assertion, not a finding, that its customers include the Kingdom of Bahrain, the United Arab Emirates and Mexico and that its product is used only by sovereign governments. NSO Group Technologies and its co-petitioners asked the US Supreme Court to review the decision (No. 21-1338, petition filed 6 April 2022); the Court invited the Solicitor General to express the views of the United States and denied the petition on 9 January 2023. ^{3 6}

analysisAccording to the district court's order of 17 October 2025, the court had granted partial summary judgment for the plaintiffs on liability under the Computer Fraud and Abuse Act, California's Comprehensive Computer Data Access and Fraud Act and for breach of contract; the evidence showed that the defendants reverse-engineered WhatsApp's code to build a modified client application and used it to install their software on target users' devices through WhatsApp's servers. Among the declarations filed for the defendants were those of Yifa Idisis, attached to an opposition of 20 March 2025, and of NSO's chief executive Yaron Shohat, whose testimony the court cited; Q Cyber's annual report to the Israeli Registrar updated to 7 January 2019 names Yifa Idisis as its financial director, and NSO's report of the same date names a financial director called Idisis. During the case the third parties Westbridge Technologies, Josh Shaner and Terrence DiVittorio also filed a motion for clarification, which WhatsApp and Meta opposed; only the docket description of that motion was retained, so its content is not known. ^{1 2 3 4}

analysisOn 6 May 2025 a jury unanimously awarded WhatsApp and Meta the full $444,719 in compensatory damages they sought, found that the defendants acted with malice, oppression or fraud, and awarded $167,254,000 in punitive damages; NSO Group Technologies and Q Cyber Technologies moved for a new trial on 29 May 2025. In its order of 17 October 2025 the court held that the punitive award could not exceed a 9:1 ratio and remitted it to $4,002,471, granting the defendants' motion to that extent, and WhatsApp and Meta accepted the remittitur on 31 October 2025. ^{4 1}

analysisThe same order found that the defendants' conduct caused irreparable harm and that there was no dispute it was ongoing, citing Shohat's August 2024 testimony, and granted a permanent injunction; it directed the plaintiffs to exclude the defendants' sovereign government customers, which were not parties, from its scope, without naming them. The injunction and the final judgment were entered on 12 November 2025. ^{4 1}

analysisIn their response and objection to the plaintiffs' proposed injunction order, filed on 4 November 2025, NSO Group Technologies and Q Cyber Technologies argued that it was reasonably foreseeable that a US law enforcement or intelligence agency would use Pegasus and that an injunction limiting its use could hinder government operations in a crisis; a footnote stated that in 2018 the FBI licensed the use of Pegasus and the CIA helped Djibouti obtain a Pegasus licence, citing a sealed exhibit (Dkt. 616-2). These are statements of the defendants in court papers. ^{5 6 2}

analysisNSO Group Technologies and Q Cyber Technologies appealed to the Ninth Circuit on 19 November 2025 (No. 25-7380) and moved to stay the injunction. Judge Hamilton denied a stay on 19 December 2025 while extending an administrative stay by 45 days, and the Ninth Circuit denied a stay on 28 January 2026. On 30 January 2026 the court granted the plaintiffs' motion for attorney's fees, which the defendants appealed on 11 February 2026 (No. 26-874); the district court case was terminated on 2 February 2026. The retained records do not show the outcome of the appeals. ^{1 2 3}

analysisAfter judgment, Meta Platforms and WhatsApp pursued discovery in aid of enforcement and on 8 June 2026 moved to hold the defendants in contempt; on 16 October 2026 Judge Hamilton denied the contempt motion and issued an order on post-judgment discovery disputes. ¹