On 16 October 2026, Judge Phyllis Hamilton of the Northern District of California declined to hold NSO Group in contempt of the 2025 injunction that bars it from targeting WhatsApp and its users. According to The Record, WhatsApp's motion rested on the declaration of one Meta threat-intelligence investigator, Andrew Blaich. He said he had found 23 new WhatsApp accounts carrying "technical and behavioral signatures" that Meta has previously tied to NSO testing. The judge found this was not "clear and convincing evidence." She wrote that WhatsApp "took a calculated risk in choosing to limit the level of detail in their supporting evidence."
The ruling is narrow. It does not say NSO is innocent, and it does not disturb the underlying judgment. It does show how hard it is to enforce a spyware injunction when the proof lives inside the victim's own security systems.
The case for the judge
The strongest argument for Hamilton's decision is about process, not spyware. Contempt is a coercive power, and the clear-and-convincing standard exists because a court should not sanction a party on the word of an interested adversary. The only witness was an employee of the plaintiff. His conclusion was that accounts "looked like" NSO's because of patterns Meta had not explained to the court. NSO could not test that claim, and neither could the judge. A defendant facing contempt is entitled to a record it can contest, even when the defendant is a notorious one.
The case for WhatsApp
WhatsApp's reason for holding back is also serious. Per The Record, it argued that disclosing how it found the accounts would make it harder to fight spyware vendors later. Natalia Krapiva of Access Now said that requiring such disclosure would "lead to complete impunity for the spyware industry." Publishing detection logic hands a roadmap to NSO, to rival vendors and to criminals. The pattern has precedent: Apple dropped its own suit against NSO in September 2024, saying that continuing risked exposing "vital security information." Two of the largest platforms in the world have now faced the same dilemma in court and ended up with the same bad choices.
What the injunction actually covers
The underlying win was real but limited. After a jury awarded $167.3 million in punitive damages in May 2025, Hamilton cut the award to about $4 million, a 97% reduction, CyberScoop reported. She applied a 9-to-1 ratio ceiling and said other courts might justify a higher ratio for "particularly egregious" conduct. The permanent injunction covers WhatsApp only. It does not reach other Meta products or NSO's government customers, who can keep using its technology. It was also narrower than what WhatsApp asked for.
So the legal deterrent is a single-platform order backed by a modest fine. A platform that cannot prove a violation without exposing its defences has an injunction that is hard to enforce. Pegasus was used against about 1,400 WhatsApp users in 2019, and the case that began then is still being litigated in 2026.
Courts are the wrong sole enforcer
This site's position is that spyware controls should be proportionate and aimed at conduct, not at the open internet. Encryption, vulnerability research and legitimate lawful-intercept tools are not the problem. The problem is a commercial market that sells intrusion capability to governments that use it on journalists and dissidents. A free press and free expression depend on private communications that cannot be silently compromised.
US policy already treats the vendors as a national-security matter. The Commerce Department's Bureau of Industry and Security added NSO Group to the Entity List in November 2021. Executive Order 14093 of 27 March 2023 bars federal agencies from operational use of commercial spyware that poses significant counterintelligence or security risks. Those tools act on the demand side and on market access. Neither helps WhatsApp prove that 23 accounts belong to a sanctioned vendor.
A narrow fix, not a new regime
The gap is procedural, and a proportionate answer targets it directly. Three changes would help without chilling security research or hardening platforms into surveillance gatekeepers.
- Courts should make routine use of protective orders and in camera review. A judge can examine detection methods under seal, with cleared counsel, without publishing them. Hamilton's opinion implies WhatsApp could have offered this and chose not to. Platforms should offer it.
- Independent technical corroboration should be standard. A second analyst, such as a respected outside lab, would turn one employee's declaration into evidence a court can weigh. Platforms already work with such groups.
- Agencies should use the tools they have. The Entity List and procurement rules do not depend on proving a specific violation on a private record. Enforcement against the vendor should not rely on one company's litigation budget.
The approach to avoid is a mandate that forces platforms to publish how they detect abuse. That would make the arms race easier for attackers. It would also be at odds with the interest in secure, open communications that the litigation is meant to protect.
What to watch
The order does not say whether either side will appeal, and neither party responded to The Record's requests for comment. WhatsApp can refile with a fuller record, and that would be the cleaner test. Whether it will take that risk depends on how much it is willing to show a court. If it will not, the lesson for future plaintiffs is that private litigation can punish past abuse but cannot reliably police present abuse. That job needs public enforcement, and a way to make sealed technical evidence count.