A district court in the United States on Friday held Israeli cyber intelligence company NSO Group liable for unauthorised surveillance of 1,400 users of the messaging application WhatsApp using its spyware Pegasus in 2019, reported Reuters.

WhatsApp, owned by United States-based technology company Meta, has been locked in a legal battle with the Israeli firm since 2019. The messaging platform has alleged that the NSO Group’s spyware had been used against 1,400 users of the application over a two-week period in April and May 2019.

In the judgement on Friday, Judge Phyllis Hamilton of the US District Court for the Northern District of California said that NSO Group violated sections of the Computer Fraud and Abuse Act and the California Computer Data Access and Fraud Act.

The Computer Fraud and Abuse Act is a federal legislation that criminalises unauthorised access to computers, networks and other digital information. The California Computer Data Access and Fraud Act is the state equivalent of the same law.

Hamilton also said that the Israeli firm violated WhatsApp’s terms of service.

Earlier this year, Hamilton ordered the Israeli firm to hand over the code of Pegasus and its other spyware products to WhatsApp as part of the legal proceeding.

On Friday, the judge said that NSO Group dragged its feet throughout the litigation and noted that it repeatedly failed to comply with the court’s orders, The Guardian reported.

The Israeli firm made its code for its spyware available to view only in Israel by an Israeli citizen even though the lawsuit was filed in California, Hamilton said in her ruling, adding that this was “simply impracticable”.

NSO Group will now face another trial in March 2025 to determine the damages it owes WhatsApp, The Guardian reported.

Will Cathcart, the head of WhatsApp, called the verdict on Friday a “huge win” for privacy.

“We spent five years presenting our case because we firmly believe that spyware companies could not hide behind immunity or avoid accountability for their unlawful actions,” Cathcart said on social media. “Surveillance companies should be on notice that illegal spying will not be tolerated.”

He added: “WhatsApp will never stop working to protect people’s private communication.”

When added to an electronic device, the Pegasus software can generally gain access to phone calls, emails, location information, encrypted messages and photographs without the user’s knowledge.

In July 2021, an investigation by a group of 17 media organisations and human rights group Amnesty International showed that Pegasus spyware was being used for the unauthorised surveillance of journalists, activists and politicians across the world, including in India.

The spyware is licensed to governments around the world by the NSO Group. The cyber intelligence company says it sells the Pegasus software only to “vetted governments” with good human rights records and that it is intended to target criminals.

In India, Congress leader Rahul Gandhi, former Election Commissioner Ashok Lavasa, Union ministers Ashwini Vaishnaw and Prahlad Singh Patel, industrialist Anil Ambani and former Central Bureau of Investigation Director Alok Verma were among the potential targets, The Wire had reported.

The Indian government had denied these allegations. Vaishnaw, the Union information technology minister, told Parliament in July 2021 that illegal surveillance was not possible in India.

Following the reports, the Supreme Court appointed an expert committee to look into the allegations. In August 2022, the court said that some malware was found on five of the 29 phones that the panel examined. However, it was not clear whether the malware was Pegasus.

The judges also took note of a finding by the panel that the Centre did not cooperate with the inquiry.

The United States government blacklisted the NSO Group in November 2021 after it determined that the company had acted “contrary to the foreign policy and national security interests of the US”.