In a landmark decision, a federal jury has ordered NSO Group to pay approximately $168 million in damages to Meta-owned WhatsApp. This ruling comes after a federal judge found that the Israeli company violated U.S. laws by exploiting WhatsApp servers to deploy Pegasus spyware, targeting over 1,400 individuals globally. WhatsApp initially filed a lawsuit against NSO Group in 2019, accusing the company of using Pegasus to target journalists, human rights activists, and political dissidents.
Court documents from the trial revealed that 456 individuals in Mexico, 100 in India, 82 in Bahrain, 69 in Morocco, and 58 in Pakistan were targeted by the spyware. The attacks exploited a zero-day vulnerability in WhatsApp’s voice calling feature (CVE-2019-3568) to deploy the spyware through the messaging platform’s servers based in California. This ruling marks a significant victory for WhatsApp and a blow to the spyware industry’s illegal activities.
Meta’s head of WhatsApp, Will Cathcart, emphasized the historical significance of the court’s findings against NSO Group. He highlighted the critical deterrent effect of punishing NSO for its actions and reiterated the company’s commitment to preventing future targeting by NSO. In addition to punitive damages, the jury also awarded compensatory damages to WhatsApp for the efforts made by its engineers to block the spyware attack vectors.
Privacy advocates and human rights organizations have lauded the jury’s decision, which holds NSO Group accountable for its role in enabling surveillance of civil society members. Despite NSO Group’s claims of not being responsible for its clients’ actions, the judge emphasized the company’s involvement in developing malware installation methods and its capability to compromise iOS and Android devices. NSO Group has stated its intention to pursue legal remedies and uphold its technology’s role in preventing serious crime and terrorism.
Apple, which filed a similar lawsuit against NSO Group, dropped the case in 2024 to avoid revealing sensitive security details. The outcome of this legal battle sets a crucial precedent in the fight against spyware and underscores the importance of holding companies accountable for their actions in enabling malicious activities.
Source link