In a significant legal victory, Meta has secured $167 million in punitive damages from the Israeli spyware maker, NSO Group. The decision by a California jury comes in response to allegations that NSO exploited a vulnerability in WhatsApp, affecting 1,400 users globally. This hack reportedly targeted individuals such as diplomats, activists, political dissidents, and journalists who relied on encrypted messaging for secure communication. Meta, which owns WhatsApp, initially filed the lawsuit in 2019, accusing NSO of reverse-engineering the app to develop its notorious Pegasus malware.
A spokesperson from Meta hailed the jury’s verdict as a major step toward enhancing privacy and security. The decision forces NSO Group, described as a “notorious foreign spyware merchant,” to pay substantial damages, acting as a critical deterrent to others in the spyware industry. The verdict follows a summary judgment granted by Judge Phyllis J. Hamilton of the U.S. District Court for the Northern District of California, which found NSO Group liable for violating both federal and California anti-hacking laws, as well as breaching WhatsApp’s terms of service.
The trial has shed light on the operations of surveillance-for-hire firms, often shrouded in secrecy. By putting executives from NSO on the stand, the trial exposed the inner workings of their operations. Meta’s spokesperson emphasized that the ruling serves as a warning to spyware companies engaging in illegal activities against American technologies, stating such actions will not go unpunished.
In addition to the punitive damages, Meta was awarded $444,719 in compensatory damages to cover costs related to investigating the breach, securing systems, and mitigating reputational damage. While experts had anticipated punitive damages could soar into the tens of millions, there are concerns that NSO Group’s potential bankruptcy might not halt the continued spread of Pegasus malware.
WhatsApp CEO Will Cathcart previously highlighted the sophistication of the attack in a Washington Post column, revealing that the attackers utilized servers and internet-hosting services linked to NSO Group. Despite the advanced nature of the hack, Cathcart noted that the attackers’ efforts to conceal their tracks were not entirely successful, marking an early breakthrough in identifying the group responsible for the breach.