On October 17, 2025, a US court finally stopped the "phone hacking program." A court ruling permanently banned Israeli firm NSO Group — which had hacked messenger app WhatsApp to surveil smartphone users worldwide — from all WhatsApp-related technology use. Six years of battle over digital privacy and encryption technology finally reached a legal conclusion.
In 2019, WhatsApp sued NSO Group. The company's spyware "Pegasus" could infiltrate smartphones without user clicks and remotely control messages, calls, location data, camera, and microphone. WhatsApp claimed NSO reverse-engineered its servers, created a modified app, and installed Pegasus on over 1,400 users' phones. The court found this violated the Computer Fraud and Abuse Act (CFAA) and California Data Access Act (CDAFA).
The court awarded WhatsApp $440,000 in damages and $167 million in punitive damages, additionally issuing a Permanent Injunction against NSO — prohibiting any connection to WhatsApp's platform or development, sale, or testing of related technologies. NSO argued in court that "Pegasus is legitimate surveillance technology for tracking criminals and terrorists," but the court rejected this for three reasons: Pegasus has never been used in US law enforcement; the US Commerce Department still has NSO on its Entity List; and Pegasus was actually misused to surveil journalists, human rights activists, and politicians. The ruling clearly established that "encryption is an individual right" and cannot become a government tool.
This ruling is evaluated as "the first real sanction against the private surveillance industry" and "the event where law protected human dignity before technology." Experts forecast this ruling will serve as direct precedent for regulating AI surveillance and facial recognition technology. Even as Pegasus disappears, AI-based spyware combining voice synthesis, video manipulation, and conversational AI will continue evolving — making this ruling just the beginning of a second round between law and technology in the fight for encryption, personal information, and artificial intelligence.
