A California court has ordered the Israeli spyware company NSO Group to pay over $167 million in punitive damages and nearly $445,000 in compensatory damages. This decision followed state-sponsored hacks targeting 1,400 users of Meta’s WhatsApp.
The ruling came five months after Judge Phyllis Hamilton sided with Meta, having reviewed evidence showing NSO’s Pegasus software exploited a vulnerability in WhatsApp’s voice calling feature. NSO’s actions violated WhatsApp’s terms by using the platform for illegal purposes.
NSO has faced backlash for its role in facilitating hacks for government agencies, many linked to systemic abuses. Investigations by Citizen Lab revealed how Pegasus was misused, including in cases like the murder of a journalist by the Saudi government. Despite claiming rigorous vetting of its clients, NSO’s disconnect on usage seemed critical to Meta’s win.
In addition to this lawsuit, NSO has faced U.S. sanctions and had previously been sued by Apple, though that case was dropped for security concerns.
A Meta spokesperson called the verdict a significant win for privacy, emphasizing that it represents a step forward in combating the illegal spyware industry. They highlighted how Pegasus can covertly gather extensive data from users’ devices, including activating microphones and cameras without consent.
Access Now welcomed the judgment, seeing it as a victory for digital rights and urging other companies to take similar legal actions against spyware vendors. The decision sends a strong message: targeting individuals through U.S.-based platforms can have serious consequences for spyware companies.
Experts like Carolyn Crandall from AirMDR noted that this case raises important questions about accountability in cybersecurity. The ruling establishes a distinction between companies enabling illicit hacking and those developing defensive tools.
NSO’s Gil Lanier insisted their technology is vital for fighting crime and claimed lives had been saved by its use. He mentioned plans to appeal, arguing that crucial evidence was omitted from the trial. Meanwhile, Meta aims to collect the awarded damages and hopes to donate a portion to organizations advocating for digital rights and protection against spyware.