If you have friends or relatives in other countries, or if you just hate the perennial “blue bubble-green bubble” problem of Apple products, you probably use the messaging platform WhatsApp. If so, you might be aware that for the past five years, WhatsApp has been suing an Israeli spyware company for hacking into its user data. Now, a leaked gag order from an Israeli court shows that the Israeli government has been doing some shady dealing to keep the lawsuit from playing out successfully for WhatsApp. Let’s break it down.
What’s Up with WhatsApp?
WhatsApp is a free smartphone-based messaging app founded in 2009 and acquired in 2015 by Meta (formerly Facebook). It allows users to send texts, make voice and video calls, and share media with individuals or groups. With over 2 billion active users, it's one of the most widely used messaging platforms globally. In the U.S. alone, it has 100 million users—almost a third of the country. A major draw for WhatsApp over standard SMS texting is that it equalizes across platforms, bypassing the Android vs. iPhone compatibility issues.
Its popularity stems from its ease of use, cross-platform compatibility, and end-to-end encryption, ensuring secure conversations. WhatsApp offers free international calls, group chats, and file sharing, making it an ideal platform for personal and professional communication. Its simplicity, reliability, and feature-rich interface have made WhatsApp an essential tool for people all over the world.
But an equally important draw for users is the platform’s (alleged) security, particularly in modern times when information and data privacy have become increasingly pressing for everyone.
WhatsApp’s Security Features
WhatsApp is generally considered a secure messaging platform for everyday use, employing end-to-end encryption to protect the content of messages, calls, and shared media. It uses Secure Socket Layer (SSL) and Transport Layer Security (TLS) to encrypt data in transit, ensuring that data exchanged between your device and WhatsApp's servers is protected from eavesdropping and tampering. This means that the only people who can access the content are the sender and intended recipient — not even WhatsApp itself can see it. The app also provides end-to-end encryption for chat backups stored in iCloud or Google Drive, which users can enable for added security.
The platform offers additional security features. Users can enable two-factor authentication for an added layer of security. This requires a six-digit PIN when registering your phone number with WhatsApp again. The app provides notifications if a contact's security code has changed, which could indicate that the contact has reinstalled WhatsApp or is using a new device. And new versions of WhatsApp are frequently updated to address potential vulnerabilities.
As a result of these features, WhatsApp is generally considered more secure than standard SMS or texting.
App Still Vulnerable
Although WhatsApp has a number of security features that attract users, it also has its drawbacks. Apart from the metadata that the company intentionally collects and shares, it is also vulnerable to outside attacks that can compromise user data. One source of this is spyware and other surveillance technologies by governments and private companies.
Critics argue that these tools can be misused to violate human rights and undermine democratic processes, highlighting the need for greater oversight and regulation in this rapidly evolving field. And in 2019, such a thing may have happened in the country that’s recently been making headlines for its human rights violations: Israel.
In a case that was the first of its kind, WhatsApp filed a lawsuit in 2019 against NSO Group, an Israeli technology firm. The legal action, initiated in a Northern California federal court, accused NSO Group of exploiting a vulnerability in WhatsApp's video calling system to deploy spyware on users' devices.
NSO’s Attack and Lawsuit
The lawsuit alleges that between April and May 2019, NSO Group used a sophisticated spyware tool it developed (called “Pegasus”) to target approximately 1,400 WhatsApp users across 20 countries. The affected individuals reportedly included journalists, human rights activists, political dissidents, and diplomats. WhatsApp claims that NSO Group's actions violated the Computer Fraud and Abuse Act (CFAA) and other U.S. and California laws. The messaging giant argues that the Israeli firm's activities undermined the security and privacy of its users, compromising their private communications (including messages and calls). Along with damages, WhatsApp asked the court for an injunction to prevent NSO Group from accessing its services and to halt the development and sale of spyware targeting WhatsApp users.
NSO Group, for its part, has denied any wrongdoing. The company maintains that its products are sold exclusively to vetted government intelligence and law enforcement agencies to combat terrorism and crime. However, this claim has been met with skepticism from human rights groups and cybersecurity experts, who have raised concerns about the lack of transparency and accountability in the sale and use of such surveillance technologies. In any case, this lawsuit marked a significant moment in the tech industry, as it represents one of the first instances of a major technology company taking legal action against a spyware manufacturer.
That legal battle has been waging for five years. And now, it’s taken a major turn with some leaked documents that suggest that the Israeli government was actively involved in obstructing the lawsuit's progress.
Leaked Documents Reveal Gag Order
Apparently, in July 2020, after the WhatsApp lawsuit was underway and discovery requests seeking relevant company documents had been sent to NSO, a number of files and computers were removed from NSO’s offices. This allegedly happened after NSO met with Israeli government officials to discuss how to respond to document requests.
This all came to light recently when a group of media organizations obtained a copy of a secret gag order by an Israeli court related to the 2020 removal of NSO files. The involvement of the Israeli government has greatly impeded the discovery process, as NSO was able to hide behind the gag order and the confiscated files and computers instead of properly answering WhatsApp’s requests for information related to the lawsuit. In fact, NSO only ever coughed up a whopping 17 internal documents to share with WhatsApp’s attorneys.
It appears that one of NSO’s lawyers (former Trump Administration attorney Rod Rosenstein) asked a lawyer representing Israel (John Bellinger, former national security lawyer for George W. Bush) whether the Israeli government was prepared to come to NSO’s rescue in the lawsuit. In response, Bellinger apparently said that Israel was “acutely focused on the discovery dangers and is still considering its options.” And just a few days later, Israel obtained a secret gag order that would allow Israeli government officials to search NSO’s office and seize its computers and files. The gag order also prevented NSO from disclosing or transferring any materials to anyone without the authorization of Israeli authorities.
The recent leak reveals a complex web of international legal maneuvering and government intervention in the ongoing battle between WhatsApp and NSO Group. The revelation raises serious questions about the extent of government involvement in private-sector surveillance technologies and the potential implications for user privacy and global cybersecurity. As this case continues to unfold, it will undoubtedly spark further debate on the balance between national security interests and individual privacy rights in the digital age.
Related Resources:
- The International Criminal Court Seeks to Issue Arrest Warrants for Israel and Hamas Leaders (FindLaw's Courtside)
- ACLU Defends Trump Against Judge's Gag Order on Free Speech Grounds (FindLaw's Law and Daily Life)
- Harvard Law Review Nixes Publication of Article Alleging Gaza Genocide at Eleventh Hour (FindLaw's Practice of Law)
