29 October

End-to-end encryption keeps a message unreadable in transit, even to the servers that carry it, but a message on a compromised phone can still be read once it has been decrypted there. On 29 October 2019, WhatsApp and Facebook (now Meta) sued the spyware company NSO Group in the US District Court for the Northern District of California; according to the complaint, the defendants could not break WhatsApp's end-to-end encryption, so they used WhatsApp's servers to send malware to about 1,400 phones and devices and read messages after decryption. In November 2025 the court entered judgment and a permanent injunction barring NSO from targeting WhatsApp with spyware; NSO asked for the injunction to be put on hold, arguing that it would cause irreparable harm to its business, and the appeals court denied the request in January 2026. Anyone can keep their apps and phone software up to date, a general rule we draw from WhatsApp asking users to update the app after it patched the vulnerability used in the attack. People who need to protect their sources can consider Lockdown Mode on an iPhone (its help page lists no regional limits), which according to Apple's support page is designed to reduce the attack surface that mercenary spyware could potentially exploit, at the cost of blocking most message attachments and link previews (only general protections are listed on the help page for Android's Advanced Protection).