A US judge on Friday ruled in favour of WhatsApp in a lawsuit accusing Israeli group NSO Group of exploiting a flaw in the messaging app to install spyware that allowed for unauthorised surveillance.

U.S. District Judge Phyllis Hamilton in Oakland, California, granted a motion from WhatsApp and found NSO liable for the hack and breach of contract.

Hamilton said the case would now go to trial only on the damages issue, while Will Cathcart, WhatsApp's chief executive, said the ruling was a win for privacy.

“We have spent five years making our case because we firmly believe that spyware companies cannot hide behind immunity or avoid accountability for their illegal actions,” Cathcart said in a social media post.

“Surveillance companies should be aware that illegal spying will not be tolerated.”

A WhatsApp spokesperson said they were grateful for the decision, and “we are proud to stand against NSO and thank the many organizations that supported this case. WhatsApp will never stop working to protect people’s private communications.”

Cybersecurity experts welcomed the ruling, with John Scott-Railton, a senior researcher at Canadian internet watchdog Citizen Lab — which first exposed NSO's Pegasus spyware in 2016 — calling it a landmark ruling with "huge implications for the spyware industry."

“The entire industry has hidden behind the claim that whatever their customers do with their hacking tools is not their responsibility,” he said in an immediate message. “Today’s ruling makes clear that NSO Group is in fact responsible for violating multiple laws.”

In 2019, WhatsApp sued NSO, seeking injunctive relief and damages, accusing it of accessing WhatsApp servers without permission six months ago to install Pegasus software on victims’ mobile devices. The lawsuit alleged that the breach allowed for surveillance of 1,400 people, including journalists, human rights activists and dissidents.

NSO has claimed that Pegasus helps law enforcement and intelligence agencies fight crime and protect national security and that its technology is intended to help catch terrorists, child molesters and hardcore criminals.

NSO appealed a trial judge’s 2020 refusal to grant it “conduct-based immunity,” a common law doctrine that protects foreign officials acting in their official capacity.

The San Francisco-based 9th U.S. Circuit Court of Appeals upheld that ruling in 2021, calling it a “simple case” because NSO’s mere licensing of the Pegasus software and provision of technical support did not protect it from liability under a federal law called the Foreign Sovereign Immunities Act, which took precedence over common law.

Last year, the US Supreme Court rejected NSO's appeal of the lower court's decision, allowing the lawsuit to continue.