A California jury has ordered NSO Group Technologies, an Israeli cybersecurity company, to pay WhatsApp a total of $168 million in damages. This verdict comes as a result of NSO’s unauthorized deployment of its Pegasus spyware to monitor specific WhatsApp users, an act deemed to have involved “malice, oppression, or fraud” under the California Comprehensive Data Access and Fraud Act (CDAFA).
The legal battle started when WhatsApp filed a complaint on October 29, 2019, within the Northern District of California. Accusations against NSO centered on the alleged use of spyware across approximately 1,400 devices. NSO maintained in its motion to dismiss that its tool is strictly accessed by governments for counterterrorism and crime prevention purposes.
The jury’s decision aligns with a prior court ruling from December 2024, which found NSO’s actions in violation of the state-level CDAFA and the federal Computer Fraud and Abuse Act (CFAA), establishing liability for unauthorized access and information acquisition from protected computers.
WhatsApp celebrated the ruling as a pivotal move against illegal spyware activities, emphasizing its significance as a protective measure for consumer privacy. Meta’s statement called the verdict a deterrent against the spyware industry. Similarly, Amnesty International heralded the outcome as a crucial win for rights advocates. Despite the ruling, NSO has expressed intentions to explore potential appeals.
NSO’s Pegasus has faced backlash for its role in human rights invasions on a global scale, allegedly used against journalists and activists in regions like Serbia, Morocco, and Thailand. Such allegations have intensified calls for international regulatory oversight of spyware technologies. For further coverage on the case, click here.