Messaging service WhatsApp has won a ruling against NSO Group, the organisation behind the Pegasus spyware.

The US District Court for the Northern District of California found the Israeli technology company liable for exploiting a vulnerability in WhatsApp to install its spyware on the devices of around 1,400 WhatsApp users in 2019.

Meta-owned WhatsApp filed the suit that same year and investigations have found that Pegasus has been used to hack phones belonging to activists, journalists and government officials.

Pegasus can read encrypted messages stored on a phone, turn on its camera and microphone remotely and track its location.

In 2021, reports surfaced of Pegasus being used on some Indian mobile numbers, including Opposition leader Rahul Gandhi, several journalists, activists and a couple of BJP politicians who were Union ministers.

The Guardian newspaper reported that the selection of Indian numbers largely commenced around the time of Prime Minister Narendra Modi’s 2017 trip to Israel.

Following media reports, IT minister Ashwini Vaishnaw back then said the “highly sensational story” that made several “over the top allegations” had “no substance behind them”. He said India’s surveillance laws ensure that “unauthorised surveillance cannot occur”.

Friday’s ruling in America found NSO Group had violated state and federal US hacking laws besides WhatsApp’s terms of service. The company will face a separate jury trial in March to determine the damages it owes WhatsApp. District judge Phyllis Hamilton ruled that with the legal issues settled, the case should proceed to trial only to determine how much NSO should pay in civil damages.

The ruling has been among the strongest yet against an industry at the heart of global disputes over governmental surveillance powers and individual freedoms.

NSO Group has said on several occasions that its government clients control the use of Pegasus and are responsible for hacking carried out with it.

The ruling in the civil case does not directly address the rights of the individuals whose phones were hacked, but technology groups that are trying to prevent their platforms from being abused by groups targeting their users have achieved victory.

Apple had a similar case against NSO but the tech giant dropped it in September, arguing that it might not be able to get the most critical files about Pegasus and that its own disclosures could aid NSO and its rivals.

“This ruling is a huge win for privacy,” Will Cathcart, the head of WhatsApp, said in a Threads post. “We spent five years presenting our case because we firmly believe that spyware companies could not hide behind immunity or avoid accountability for their unlawful actions. Surveillance companies should be on notice that illegal spying will not be tolerated.”