Spyware vendor NSO Group has appealed the ruling of a United States federal judge that it must cease targeting WhatsApp users with zero click Pegasus spyware claiming it will sustain potentially existential injuries if a permanent injunction is not stayed. The manufacturer of the sophisticated surveillance tool said in a court filing it will suffer catastrophic business harms that cannot easily be undone if it wins on appeal. The public interest and the threat of being driven out of business therefore favour staying the injunction pending an appeal to the United States Court of Appeals for the Ninth Circuit.

1. Introduction

On November 19, 2025, spyware broker NSO Group filed a notice of appeal in the United States District Court for the Northern District of California, at Oakland, California, from an order issued by Judge Phyllis J. Hamilton granting a motion by WhatsApp for summary judgment that I discussed in a previous post to On The Wire. (here) On December 20, 2024, in the reasons for granting a permanent injunction, Judge Hamilton held that NSO had improperly leveraged WhatsApp’s infrastructure to target 1,400 users of the Meta-owned messaging platform with its Pegasus spyware. It was the first time the company was held liable for surveillance abuses despite Pegasus being found on hundreds of devices belonging to journalists, lawyers, human rights activists and other members of civil society. The appeal and a concurrent motion to stay the permanent injunction present an opportunity to review the written submissions filed by NSO. (here and here)

2. Background

The legal test for granting a stay requires the court to consider “whether the applicant has made a strong showing of likelihood of success on the merits, whether the applicant will be irreparably injured without a stay, whether a stay will substantially injure the other parties, and where the public interest lies.” (here) An applicant, in this case NSO Group, does not have to demonstrate that it is more likely than not it will win on the merits, but only “a reasonable probability” or a “fair prospect” of success. (here) The standard is a “sliding scale” under which “the elements of the test are balanced, so that a stronger showing of one element may offset a weaker showing of another.” The mere fact that the court granted a permanent injunction “does not preclude a granting of a stay of that injunction pending appeal as both issues require different analyses.” (here) I will focus my following comments on NSO’s submissions on irreparable harm and the public interest.

3. Motion to Stay Permanent Injunction

NSO asserts in the Defendants’ Motion To Stay Permanent Injunction Pending Appeal that its appeal raises “novel and complicated legal questions” and, in the absence of a stay, it would suffer “irreparable harm” that would make ineffective an ultimately successful appeal of the court’s rulings on those novel questions. “A stay is therefore necessary to avoid mooting NSO’s appeal,” the motion states. Here are the two key submissions on irreparable harm:

• First, the permanent injunction “require[s]” NSO “to delete and destroy any and all computer code or technologies that use, access, or depend on the WhatsApp Platform.” The deletion and destruction of computer code and technologies cannot be undone or remedied by money damages – once these are gone, they are gone. The harm of being forced to comply with this provision is therefore irreparable. (at p. 13)
• Second, the permanent injunction’s prohibitions will put NSO’s entire enterprise at risk before NSO’s appeal can be resolved. Those prohibitions jeopardize NSO’s principal product, Pegasus, which represented 100 percent of NSO’s sales in 2025. And the injunction prohibits NSO from engaging in entirely lawful conduct to develop, license, and sell products used in authorized government investigations – a prohibition that would devastate RSO’s business and could well force it out of business entirely. […] It is well established that this “threat of being driven out of business” constitutes irreparable harm. (at p. 14)

On the issue of the public interest, NSO contends that even the plaintiffs concede that courts “recognize a public interest in stopping crime or terrorism.” In this case, enjoining the use of Pegasus “would deprive the public of its benefits in preventing, investigating, and prosecuting serious crimes and terrorism.” Here are NSO’s two submissions that the public interest favours a stay:

• First, the undisputed evidence showed that the FBI purchased a license for Pegasus in December 2018. NSO also presented evidence that other U.S. government agencies assisted foreign governments in obtaining Pegasus licenses. Because the Court refused to carve U.S. law-enforcement operations out of the permanent injunction, that injunction would prevent the FBI (or any other U.S. or state law-enforcement or intelligence agency) from entering into another such license for any existing version of Pegasus. Regardless of whether the FBI or any other U.S. government agency has made direct, operational use of the system in the past, allowing the injunction to go into effect would thus deprive U.S. law enforcement of the ability to use of the system in the future. NSO’s placement on the Department of Commerce’s BIS Entity List, which Plaintiffs continually tout, does not prohibit the FBI (or any other domestic law enforcement agency) from evaluating, licensing, or using NSO’s technology. It merely prevents U.S. individuals and entities from exporting various items to NSO without first obtaining a BIS license […]. (at pp. 16-17)
• Second, the U.S. public would also be harmed by depriving foreign governments of access to Pegasus. NSO’s opposition to the permanent injunction included evidence from Col. Ty Shepard […] that the U.S. benefits even when foreign governments collect evidence and intelligence using Pegasus, because many of those countries share intelligence with U.S. agencies […]. Plaintiffs’ interest in thwarting denial-of-service attacks, or blocking ill-intentioned actors from their platforms, does not outweigh the important law-enforcement, counterterrorism, and national security interests described above. To the contrary, the undisputed evidence in this case shows that NSO is not an “ill-intentioned actor.” (at pp. 17-18)

If the motion for a stay of the permanent injunction is denied, NSO requested that an existing administrative stay be temporarily continued so it can seek a stay from the U.S. Court of Appeals (9th Cir.) or, if necessary, the Supreme Court of the United States.

4. Conclusion

The difficult hurdle facing NSO Group will be to persuade Judge Hamilton of the the merits of the appeal regarding liability. The undisputed evidence established that NSO went beyond authorized use of WhatsApp by reverse engineering the application to design a spyware vector that allowed NSO’s clients to surveil WhatApp’s users. When WhatsApp attempted to fix the vulnerability, NSO designed around the fix to continue surreptitious access. Although NSO does not have to meet a standard that it is likely to win on the merits, it will nevertheless carry the burden here on the standard of “reasonable probability” in the face of undisputed evidence. The argument that it will sustain existential harm in the absence of a stay may be attractive at first blush but the Ninth Circuit has held that “harm caused by illegal conduct does not merit significant equitable protection.” (here) And the public interest may weigh in favour of WhatsApp. The Ninth Circuit has held that the public has a “substantial interest in thwarting denial-of-service attacks and blocking abusive users, identity thieves, and other ill-intentioned actors.” (here) It will be uphill for NSO on this motion.