NSO Group Ordered to Pay Meta $167 Million in Damages

The Israeli cybersecurity firm NSO Group was ordered on Tuesday to pay $167 million in damages to Meta, capping a six-year legal battle after NSO hacked 1,400 WhatsApp accounts belonging to journalists, human-rights activists and government officials.

In December, Judge Phyllis Hamilton of the U.S. District Court for the Northern District of California ruled that NSO Group had broken cybersecurity laws by using its popular Pegasus spying software to target phones with WhatsApp installed in 20 countries. Meta owns WhatsApp, an encrypted messaging app with over two billion users, as well as Facebook and Instagram.

In March, Meta filed a brief seeking damages from NSO Group, and last week a jury heard arguments about potential penalties. The jury awarded the damages on Tuesday after two days of deliberations.

“The jury’s verdict today to punish NSO is a critical deterrent to the spyware industry against their illegal acts aimed at American companies and our users worldwide,” Will Cathcart, the head of WhatsApp, said in a statement. “This is an industrywide threat, and it’ll take all of us to defend against it.”

WhatsApp said it would donate the damages to digital rights organizations that defend people.

“We will carefully examine the verdict’s details and pursue appropriate legal remedies, including further proceedings and an appeal,” said Gil Lainer, NSO Group’s vice president for global communication. “We firmly believe that our technology plays a critical role in preventing serious crime and terrorism and is deployed responsibly by authorized government agencies.”

WhatsApp sued NSO Group in 2019, accusing it of gaining access to WhatsApp servers without permission. The trial, during which NSO Group executives testified in court for the first time, shed light on the company’s ability to install its Pegasus software on the mobile devices of targets without their knowledge. Its executives argued that Pegasus helped law enforcement and intelligence agencies fight crime and protect national security.

Apple similarly sued NSO Group for hacking its devices in 2021, but dropped its suit in September. Also in 2021, the Commerce Department blacklisted NSO Group, saying the company acted “contrary to the national security or foreign policy interests of the United States.”

Spyware, a type of software installed on phones, laptops and other electronic devices to spy on unsuspecting victims, is a growing field. NSO Group’s early spyware required that people click on text messages or images sent via WhatsApp for it to be unknowingly downloaded on their phones.

According to evidence presented at the trial, new versions could hack into a phone through a sent text message, requiring no action by the receiver. The trial also revealed that NSO Group had developed technology to hack into other messaging apps.

John Scott-Railton, an outside expert who helped WhatsApp inform people that NSO Group spyware had targeted them, said Tuesday’s decision would damage the company.

“NSO’s business is based on hacking American companies,” and then “dictators can hack dissidents,” said Mr. Scott-Railton, a senior researcher at Citizen Lab, a cybersecurity watchdog group at the University of Toronto. “This verdict sends a clear signal.”