On Tuesday, a federal jury of the United States ordered the best known manufacturer of spy software for governments to pay the record of record of 167 million dollars to hack more than 1,000 people through WhatsApp messagesculminating in a surprising way six years of litigation.
The verdict was reached on the second day of deliberations during the phase of determination of judgment damage in Oakland, California. In December, Phyllis Hamilton district judge granted a motion of summary judgment to WhatsApp against NSO Group, based in Israel, by determining that the company had violated the United States fraud and computer abuse and a similar law of California with its espionage program known as Pegasus.
Tuesday’s compensation includes $ 167,256,000 in punitive damage and $ 440,000 in compensatory damages, which constitutes The most significant blow to date against the growing spy software industry.
Although Pegasus is sold to governments as a tool to combat terrorism and organized crime, A constant flow of investigations has demonstrated its use against political leaders, peaceful activists and journalists in various parts of the world.
“Today’s verdict in the case of WhatsApp is an important step for privacy and security, being the first victory against the development and use of illegal spy software that endangers everyone’s safety and privacy,” said Meta, the WhatsApp matrix company.
“The jury’s decision to force NSO, a notorious foreign Software Seller, to pay damage is a key deterrent element for this malicious industry and its illegal acts directed against US companies, as well as against the privacy and safety of the people we serve.”
NSO said that It will probably appeal.
“NSO remains fully committed to its mission of developing technologies that protect public security, continuously reinforcing our leading industry compliance framework and guaranteeing that our technology is used only for its legitimate purposes and authorized by legitimate sovereign governments,” said Gil Lanier, spokeswoman for the company.
Meta said that, if he manages to collect the money of the Israeli company, he will donate it to digital rights organizations that have played a crucial role in The detection and analysis of Spy software attacks.
“We have a long way to go to collect the damages granted to NSO and plan to do it,” said Meta. “Ultimately, we would like to make a donation to digital rights organizations that work to defend people against this type of attacks worldwide. Our next step is to ensure a court order that prevents you from heading again against WhatsApp.”
The December failure of Hamilton held NSO responsible for hacking the systems of the goal unit by sending malicious software through its servers to around 1,400 selected phones, which, according to the target, belonged to government officials, journalists, human rights activists and dissidents in dozens of countries.
Hamilton also determined that WhatsApp had the right to impose penalties for refusing to deliver the software source code during the discovery process, although the corresponding fine would be determined in a later stage. He also resolved that, with the main legal issues already resolved, the case should only advance to the trial to determine how much the company should pay for civil damage.
The case included The first testimony in the United States of Executives of NSOwho for a long time have avoided appearing publicly.
The jury’s decision is, with much, the most significant result of dozens of demands in an industry that is in the Center for Global Disputes over the Government surveillance powers and individual freedoms. That the case has taken so long to reach trial, after an appeal that reached the Supreme Court of the United States, underlines what is at stake and the national interests involved.
The United States government sanctioned NSO and a handful of other companies and individuals after determining that they operated in opposition to US interests. Most American allies have been slow to follow their example.
Apple left a similar case against NSO in September, after the Israeli authorities allegedly confiscated the company’s source code and NSO declared that it could no longer produce it. NSO has been closely allied with the Israeli governmentof which the company has affirmed that it needs permission to export its products.
-NSO had argued that he should be exempt from legal punishment because he only sells to government agencies, which are the ones that determine which people aim at the programs, but the appeal courts rejected that defense. The company’s executives recognized in the depositions that determine how the hackeos are carried out, depending on the telephone and software that each objective uses.
Pegasus and similar programs have exploited a series of security failures, including those on WhatsApp and Apple’s operating system, for Access phones and capture photos, emails and text messages, even those that are completely encrypted during their transmission.
In some cases, these violations do not require any user interaction and leave the software practically undetectable.
The evidence presented in the case demonstrated how capable and dangerous it has been NSO, having 140 employees looking for ways to exploit Apple iPhones and Android phones driven by Google, as well as the applications that work in them. A NSO executive testified that The Espía program had been installed through operating systems, instant messagers and browsers.
Pegasus is scheduled with technical blockages to avoid espionage within the United States and on phones with US numbers physically located anywhere else in the world, according to a NSO lawyer.
However, espionage programs created by other suppliers or national agencies have no such limitations. This is one of the reasons why security experts have shown alarm to the use of Signal and a file program for their messages by White House officials, including Michael Waltz, who was recently dismissed as National Security Advisor, and Defense Secretary Pete Hegseth. Although Signal is encrypted from end to end, Any spy software that can control a phone can access all those messages.
The testimony in the case of WhatsApp showed that NSO used a succession of attacks against the company between 2018 and 2020, altering its technique when WhatsApp blocked previous methods. One of those modifications occurred after WhatsApp filed the lawsuit, which reinforced the goal argument that NSO had acted deliberately.
Meta informed the court that he had paid more than $ 400,000 (approximately 379,000 euros) in wages to employees while fighting NSO.
However, NSO’s lawyer, Joseph Akrotirianakis, told the jury that these salaries would have been paid anyway and were not asked to consider impacts on the final victims of hackeos, only the costs for finishing.
“This demand deals with advertising,” he said in his final arguments. “Facebook wanted to generate headlines about how deeply, firmly and genuinely believe in protecting the privacy of its users, and saw NSO demand as an easy way to obtain those good headlines”.
NSO emphasized that he had used WhatsApp servers only to pass contaminated messages to the victims.
“Pegasus didn’t take anything from WhatsApp servers,” Akrotirianakis said. “He left nothing behind. He did not execute any code on WhatsApp servers, or eliminated, changed or corrupted any data.”
To gain punitive damage under the statute of Hack of California, goal had to demonstrate with convincing evidence that it was “guilty of oppression, fraud or malice”.
To transmit to the jury the magnitude that would have to have compensation to have an impact, WhatsApp established, through a combative testimony, which nose spent about 50 million dollars (approximately 47.3 million euros) a year in research and development.
The executive director of NSO, Yaron Shohat, testified that NSO lost 12 million dollars (approximately 11.4 million euros) in 2024 and 9 million dollars (approximately 8.5 million euros) in 2023 and that it would have difficulties to pay significant damage.
© 2025, The Washington Post.
