Eleven Civil Society Groups Led By Access Now Just Asked the Ninth Circuit to Keep NSO Group Off WhatsApp Forever—Because the 2025 Permanent Injunction Is the Last Line Between End to End Encryption and the Pegasus Spyware That Already Reached 1,400 Journalists, Activists, and Lawyers Across 20 Countries

The Committee to Protect Journalists filed a 30 page amicus brief at the U.S. Ninth Circuit Court of Appeals on May 20, 2026, alongside Access Now, the Center for Democracy and Technology, and eight other civil society organizations. They are asking three federal judges to keep a permanent injunction in place against NSO Group—the Israeli company behind Pegasus, the commercial spyware that turned 1,400 WhatsApp accounts into surveillance targets in 2019 and has been used to surveil journalists in more than 45 countries since. NSO calls the injunction "catastrophic" and "potentially existential" for its business. CPJ and its allies call it the only thing standing between encrypted messaging and the next generation of state grade zero click exploits.

Key Takeaways

• The Committee to Protect Journalists joined ten other civil society groups in filing an amicus brief at the U.S. Ninth Circuit Court of Appeals on May 20, 2026, in WhatsApp Inc. v. NSO Group Technologies Limited (No. 25-7380).
• The 2025 district court ruling by Judge Phyllis Hamilton issued a permanent injunction barring NSO from developing or deploying technology that interacts with WhatsApp's platform, including Pegasus.
• NSO used WhatsApp servers in May 2019 to deliver Pegasus to more than 1,400 targeted devices across at least 20 countries, including journalists, lawyers, and human rights defenders.
• The original jury award of $167.25 million in punitive damages was later reduced to approximately $4 million by the district court.
• NSO's motion to stay the permanent injunction pending appeal was denied by the Ninth Circuit; NSO's opening brief was filed February 11, 2026, and WhatsApp's answering brief was filed March 13, 2026.

What Did CPJ and Its Allies Tell the Ninth Circuit?

The amicus brief, led by Access Now and joined by the Center for Democracy and Technology, the Electronic Frontier Foundation, Privacy International, the Knight First Amendment Institute, and six other organizations, argues that the permanent injunction is necessary to prevent ongoing human rights violations. The coalition cited CPJ's published research documenting at least 38 journalists across 17 countries who were confirmed targets of Pegasus between 2018 and 2024.

The brief takes direct aim at NSO's commercial reframing of its conduct. NSO's appeal asserts that the injunction will inflict "irreparable, potentially existential injuries" on its business and threatens its future U.S. government contracts. The amici respond that the relevant question is not whether the injunction harms NSO's revenue but whether allowing the company to continue operating against WhatsApp's encryption would harm the global public interest—specifically the journalists, lawyers, dissidents, and human rights workers who rely on end to end encrypted messaging to stay alive.

Who Are the 1,400 People NSO Targeted on WhatsApp?

In May 2019, NSO operators exploited a zero day vulnerability in WhatsApp's voice call feature (CVE-2019-3568) to deliver Pegasus to roughly 1,400 user devices over a two week window. WhatsApp and Meta sued NSO and its parent Q Cyber Technologies in October 2019 in the U.S. District Court for the Northern District of California. Six years of litigation followed, including a failed NSO petition to the U.S. Supreme Court arguing it was entitled to foreign sovereign immunity as a government contractor.

The 1,400 figure is not a marketing number. Citizen Lab, Amnesty International, and Access Now identified specific victims after the breach: dozens of Catalan independence activists and politicians, Rwandan dissidents, Mexican journalists investigating cartel corruption, Indian human rights lawyers, and Moroccan reporters whose phones were forensically confirmed to carry the Pegasus payload. The brief argues that injunctive relief is the proportional remedy for a tort whose harm is structural: NSO does not infect random users, it infects specific people whose work threatens state actors.

What Happens If the Ninth Circuit Vacates the Injunction?

If the appellate court reverses Judge Hamilton's order, NSO regains the legal latitude to develop and deploy spyware that interacts with WhatsApp. That would not immediately mean Pegasus is back on the platform—the specific zero day from 2019 was long since patched—but it would mean WhatsApp's parent company loses a forward looking equitable remedy. Future variants of Pegasus, or any successor spyware NSO ships, would face only damages litigation after the fact, not a prohibition before the fact.

The amici argue that damages alone are insufficient when the underlying harm is the surveillance of journalists who may then be detained, attacked, or killed. CPJ documented 128 journalist deaths in 2025 and additional confirmed killings in 2026, several in jurisdictions where Pegasus or comparable commercial spyware has been used against the press. The brief frames the injunction as a forward looking shield: the only legal mechanism the U.S. system offers to stop a foreseeable harm before it materializes.

Why Does This Matter Beyond One Spyware Vendor?

WhatsApp v. NSO Group is the only successful private litigation in U.S. courts against a commercial spyware vendor. The case has been cited by the European Parliament's PEGA Committee, the U.S. Department of Commerce when it placed NSO on the Entity List in November 2021, and the U.S. State Department in its 2024 Visa Restriction Policy targeting commercial spyware actors. A reversal at the Ninth Circuit would not erase those policy actions, but it would remove the precedential weight that other plaintiffs—Apple's separate suit against NSO, Knight First Amendment Institute's parallel filings, and a Salvadoran journalist's case in Israeli court—are leaning on.

The brief also addresses encryption itself. NSO's defense throughout the litigation has been that Pegasus does not "break" WhatsApp's end to end encryption—it bypasses it by compromising the endpoint before the message is encrypted or after it is decrypted. The amici argue that this is a distinction without a difference for the people whose phones are infected. From the perspective of a journalist whose source list is exfiltrated to a Pegasus operator, the cryptographic integrity of the transport layer is irrelevant. For context on how commercial spyware vendors continue to target the press, see our coverage of the Mexican journalist Maria Teresa Montaño suspected spyware attack and the DHS denial of any relationship with Paragon Solutions.

What Comes Next in the Case?

Oral argument before the Ninth Circuit is expected later in 2026. NSO's opening brief was filed February 11, 2026, and WhatsApp's answering brief was filed March 13, 2026. CPJ's amicus is one of multiple briefs filed in support of WhatsApp, including a separate filing by the Center for Democracy and Technology and a coalition of major U.S. technology companies. NSO's reply brief is due in early summer, and a panel decision could come as early as Q4 2026 or as late as 2027.

In the meantime, the permanent injunction remains in effect. NSO is barred from developing or deploying any technology that interacts with WhatsApp's servers. That includes Pegasus, any successor product, and any tool that operators of Pegasus have used the WhatsApp infrastructure to deliver. The motion to stay that order pending appeal was denied. The 1,400 people who were targets in 2019—and the journalists and activists who are not yet targets in 2026—are watching three Ninth Circuit judges decide whether the rule survives.