Pegasus Spyware Row: Timeline of Revelations and Court Hearings

A US judge bars NSO Group from targeting WhatsApp and cuts the damages award US litigation

In the case WhatsApp (owned by Meta) brought over the May 2019 attacks, Judge Hamilton granted a permanent injunction barring NSO Group from targeting WhatsApp users, saying its conduct “causes irreparable harm”. She found that trial evidence showed NSO reverse-engineered WhatsApp code to install Pegasus and repeatedly redesigned it to escape detection. She also called the jury’s earlier award of about $168 million “excessive” and cut it to about $4 million (Al Jazeera).

This is a US civil case between two companies about US and California computer-crime law. It does not say whether any Indian agency bought or used Pegasus, and it was not an order of any Indian court.

The Supreme Court is due to hear the case again; no outcome has been reported Supreme Court hearing or order

The 29 April order listed the petitions for 30 July 2025 and gave senior advocate Kapil Sibal two weeks to circulate documents, including a US court judgment against NSO (LiveLaw). The Supreme Court Observer’s case page lists the matter as pending, last updated 16 July 2025, with no next-hearing date shown (Supreme Court Observer).

AiTimeline found no published report of what happened on or after 30 July 2025, no judgment on disclosure of the sealed report, and no order closing the case. That is not proof that no hearing took place; the Supreme Court’s own case-status page is the record to check.

A California jury awards WhatsApp about $167 million against NSO Group US litigation

After a damages-only trial, a jury ordered NSO Group to pay $444,719 in compensatory damages and about $167 million in punitive damages for using Pegasus against more than 1,400 WhatsApp users in 2019. NSO said it would examine the verdict and pursue “appropriate legal remedies, including further proceedings and an appeal” (Security Affairs). The judge later cut the punitive award (see 17 October 2025).

The Supreme Court revisits the case: “against whom it is used” Supreme Court hearing or order

Justice Surya Kant said orally that possessing spyware for security is not improper in itself, and that “against whom it is used it is the question”. He asked what remained to be decided after the Court’s detailed 2021 judgment and the Raveendran committee, said national security cannot be compromised, and added that a private citizen’s privacy is protected by the Constitution (LiveLaw).

Senior advocate Kapil Sibal asked that the committee’s report be released to the affected individuals with sensitive portions redacted; Shyam Divan argued for full disclosure under the open-court principle; Solicitor General Tushar Mehta said portions touching national security could not be disclosed. Justice Kant said the report remained sealed and he had not seen it. The Court said it would not allow disclosure of national-security details but that portions relating to individuals could be disclosed, and listed the case for 30 July 2025 (Supreme Court Observer).

These were remarks from the bench in a hearing. No judgment followed that ordered the report to be disclosed.

The Supreme Court lists the Pegasus petitions for 22 April Supreme Court hearing or order

A bench directed the registry to list all matters on the issue on 22 April, after a long gap since the committee’s 2022 report (Business Standard, PTI). Kapil Sibal told the Court only two petitions had been listed that day and the connected petitions also needed hearing (Deccan Herald). The hearing took place on 29 April (The Tribune).

A US judge rules NSO Group liable for hacking WhatsApp users US litigation

On WhatsApp’s motion, Judge Hamilton found NSO Group liable for breaching WhatsApp’s terms of service and for violating US computer-fraud law, and sanctioned it for failing to produce key evidence, including Pegasus source code. The case moved to a trial on damages only (Security Affairs). The order described the key facts about the exploits as undisputed, drawn from testimony by NSO’s own witnesses.

The Court takes the committee’s reports on record: malware on 5 of 29 phones, not shown to be Pegasus Technical committee

The bench noted that the technical committee had examined 29 devices submitted to it, found malware in five, and that it could not be said to be Pegasus. CJI Ramana said “Government of India has not cooperated”; he said the Union took before the committee the same stand it took in Court and did not clearly say whether it had bought the spyware (LiveLaw; Bar and Bench).

The committee’s report came in three parts, with a separate report by the overseeing judge, Justice R. V. Raveendran, covering protection of citizens, accountability, amending the law on privacy and a grievance mechanism. The Court had earlier said Raveendran’s report would be uploaded, but it re-sealed both reports in the custody of the Supreme Court’s Secretary General and said the case would be listed after four weeks (LiveLaw). Members who had submitted phones had asked that the report not be released.

The Court did not say Pegasus had been found, and it did not say it had been ruled out. It said the five infections could not be tied to Pegasus.

The committee gets more time Technical committee

The Court extended the technical committee’s deadline to 20 June 2022 (Supreme Court Observer). The committee had held deposition hearings with experts and petitioners between December 2021 and February 2022, and submitted its report to the Court in late July 2022.

The New York Times reports India bought Pegasus in 2017 Research or revelation

The New York Times reported that India bought Pegasus from Israel in 2017 as part of a roughly $2 billion defence package in which the spyware and a missile system were the “centrepieces” (Scroll). It was a newspaper report based on interviews; neither government confirmed the purchase at the time.

The Union government had declined to say in the Supreme Court whether it had acquired Pegasus, and the Court later recorded that it had taken the same stand before the committee.

The Supreme Court appoints an independent technical committee Supreme Court hearing or order

The bench said the State “does not get a free pass every time the spectre of national security is raised”, and that any security concern must be specifically pleaded and proved on affidavit. It named a three-member technical committee (Dr Naveen Kumar Chaudhary, Dr Prabaharan P. and Dr Ashwin Anil Gumaste) overseen by former Supreme Court judge Justice R. V. Raveendran (Supreme Court judgment, Indian Kanoon).

The terms of reference asked whether Pegasus was used on citizens’ phones, who the victims were, what the Union did after the 2019 WhatsApp reports, whether the Union, any state or any agency acquired Pegasus, and if so under what law; and asked for recommendations on surveillance law, cyber security and a grievance mechanism. The order did not find that any agency had used Pegasus.

The Court reserves its order Supreme Court hearing or order

After weeks of hearings, the Court reserved its interim order (Supreme Court Observer). The Union had said it was ready to have all questions examined by a committee of experts but did not want to put details in a public affidavit for reasons of national security (The Indian Express).

The Court hears the first petitions and calls the allegations “serious” Supreme Court hearing or order

On 5 August the Court heard eight petitions and described the allegations as “serious”, while asking why no FIR had been filed if phones had been hacked. On 16 August the Union filed a limited affidavit offering to set up its own expert committee, and the Court said it could not compel the “reluctant” Centre to file a detailed one. On 17 August it issued a pre-admission notice, saying it would not ask the government to disclose information affecting national security (The Indian Express).

West Bengal sets up its own inquiry commission Government response

Chief Minister Mamata Banerjee announced a commission of inquiry, with retired Supreme Court judge Madan B. Lokur and former Calcutta High Court Chief Justice Jyotirmay Bhattacharya as members (The Indian Express). The Supreme Court Observer reports that the Court refused to stay the commission’s activities at one of its hearings (Supreme Court Observer).

The government and NSO Group reject the reports Government response

IT Minister Ashwini Vaishnaw told the Lok Sabha that illegal surveillance by unauthorised persons was not possible in India given its checks, called the report an attempt “to malign Indian democracy” and said its timing, a day before the Monsoon Session, could not be a coincidence (The Tribune). The government told ANI the allegations had “no concrete basis or truth” (BOOM). NSO Group called the Forbidden Stories report “full of wrong assumptions and uncorroborated theories” (The Indian Express).

These were denials of the reports. They did not say whether Indian agencies had ever bought or used Pegasus, a question the government declined to answer in court.

The Pegasus Project publishes a leaked list of potential targets Research or revelation

A consortium reported on a leaked list of about 50,000 phone numbers said to have been selected as potential surveillance targets by clients of NSO Group. The Wire reported that it included at least 300 Indian numbers, among them numbers of journalists, opposition leaders, activists, lawyers and two serving ministers (The Indian Express). Forensic analysis of phones belonging to at least 10 of the journalists on the list showed a successful or attempted Pegasus hack (BOOM).

A number on the list is not proof of infection. Whether a phone was compromised depends on forensic examination of the device, which was possible only for phones whose owners handed them over.

WhatsApp sues NSO Group and says Indian journalists and activists were targeted Research or revelation

WhatsApp said Pegasus had been used against about 1,400 users worldwide, including Indian journalists and activists, and sued NSO Group in California. In Parliament the IT ministry disclosed that WhatsApp had told CERT-In on 5 September 2019 that about 121 users in India may have been reached, after earlier saying it lacked details of the scale (MediaNama).

The ministry’s answer called reports of government purchase of Pegasus misleading. It did not say whether any agency had bought it.

WhatsApp fixes a vulnerability that could install Pegasus Research or revelation

CERT-In published a vulnerability note on 17 May 2019, and on 20 May WhatsApp told it that it had fixed a flaw in its calling feature that could let an attacker insert and execute code on a phone. The flaw was later tracked as CVE-2019-3568 (MediaNama; Security Affairs).

Citizen Lab maps Pegasus infrastructure in 45 countries, including India Research or revelation

Citizen Lab scanned the internet from August 2016 to August 2018 for servers matching NSO Group’s Pegasus, found 1,091 IP addresses and 1,014 domain names, and identified 45 countries, India among them, where operators of Pegasus may be conducting operations (Citizen Lab). The report stressed the limits of country-level attribution; it did not identify who operated Pegasus in India or whom they targeted.