Israeli spyware firm NSO ordered to pay Meta, WhatsApp nearly $170 million over hacking

A federal jury in California ordered Israeli cyber-intelligence firm NSO Group on Tuesday to pay Meta and WhatsApp nearly $170 million for hacking about 1,400 users on the instant messaging platform. 

The spyware vendor, which created the Pegasus surveillance tool, has to pay $167,256,000 in punitive damages and another $440,000 in compensatory damages. The verdict, which presents a win for privacy advocates and Meta, comes after six years of litigation. 

WhatsApp sued NSO Group in 2019 after finding out that Pegasus was utilized to hack WhatsApp users’ devices. Reports previously laid out that the Pegagus has been used to target human rights activists and reporters. 

“Today’s verdict in WhatsApp’s case is an important step forward for privacy and security as the first victory against the development and use of illegal spyware that threatens the safety and privacy of everyone,” WhatsApp said in a statement on Tuesday. 

“Today, the jury’s decision to force NSO, a notorious foreign spyware merchant, to pay damages is a critical deterrent to this malicious industry against their illegal acts aimed at American companies and the privacy and security of the people we serve,” the messaging platform, which is owned by Meta, added. 

NSO Group stated on Tuesday that the decision is "another step in a lengthy judicial process," and the company argued its technology "plays a critical role in preventing serious crime and terrorism and is deployed responsibly by authorized government agencies." 

This perspective, validated by extensive real-world evidence and numerous security operations that have saved many lives, including American lives, was excluded from the jury's consideration in this case,” NSO Group’s vice president of global communications Gil Lainer said in an emailed statement to The Hill. “We will carefully examine the verdict's details and pursue appropriate legal remedies, including further proceedings and an appeal.” 

The verdict came after a judge ruled in December last year that NSO Group was liable for hacks targeting approximately 1,400 devices and mobile phones. 

“In this specific case, we know we have a long road ahead to collect awarded damages from NSO and we plan to do so,” WhatsApp said. “Ultimately, we would like to make a donation to digital rights organizations that are working to defend people against such attacks around the world.”