On May 6, 2025, a California jury delivered a landmark verdict in favour of WhatsApp, owned by Meta, awarding the company $16,72,54,000 in punitive damages and $4,44,719 in compensatory damages against NSO Group, an Israeli firm notorious for its Pegasus spyware. Founded in 2010 by Niv Karmi, Shalev Hulio, and Omri Lavie, NSO Group is based in the seaside hi-tech hub of Herzliya, near Tel Aviv.
The legal battle, spanning over five years, involved numerous delays and tactics by NSO Group to obstruct proceedings. However, the jury deliberated for just one day before awarding WhatsApp the substantial damages. This decision, following a lawsuit initiated in 2019, marks a pivotal moment in the fight against mercenary spyware, highlighting the legal accountability of surveillance technology providers.
NSO Group specialises in developing Pegasus, a sophisticated surveillance tool capable of remotely accessing smartphones to extract data such as messages, calls, and location information without user consent. The spyware has been linked to authoritarian regimes targeting journalists, activists, and dissidents, raising significant privacy and human rights concerns. In 2019, WhatsApp discovered that NSO Group exploited a vulnerability in its audio-calling feature to install Pegasus on approximately 1,400 devices, affecting users including human rights defenders, journalists, and political dissidents
The lawsuit, filed by WhatsApp, accused NSO Group of violating federal and California hacking laws, as well as breaching WhatsApp’s terms of service. This legal action was supported by investigations from civil organisations like The Citizen Lab, which played a crucial role in identifying victims and raising awareness about the misuse of spyware.
Also Read | Pegasus: Dystopias by design
John Scott-Railton, affiliated with The Citizen Lab, described the verdict as a “precedent-setting win” in a thread on X, emphasising its significance in exposing NSO Group’s secrecy. The trial revealed details about NSO’s operations, including customer identities and victim locations, which were previously shrouded in confidentiality. According to an analysis by Lawfare, the legal strategy targeted NSO Group’s reliance on secrecy, a critical component of its business model. WhatsApp’s efforts to battle motions for protective orders and ensure discovery obligations played a key role in exposing NSO’s practices.
The case has broader implications for the spyware industry as well, setting a precedent for future legal actions against similar companies. It has contributed to a growing accountability ecosystem crucial for monitoring the global reach and adverse impacts of targeted surveillance, as noted in statements from Access Now, a New-York based NGO that John Scott-Railton also mentions as having helped in “investigations of mercenary spyware… and alarm raising”.
The fallout
The financial penalty on NSO Group is substantial and could severely damage its operations, potentially deterring customers due to increased scrutiny. NSO vice president of global communications, Gil Lainer, has indicated plans to appeal, stating, “We will carefully examine the verdict’s details and pursue appropriate legal remedies, including further proceedings and an appeal”, but the immediate impact is significant.
Evidence presented at the trial said NSO had spyware installation methods to exploit the technology of companies other than Meta, spending tens of millions of dollars annually on ways to install malicious code through messaging, browsers and operating systems, according to Meta.
The Pegasus scandal erupted in 2021 after a list of 50,000 phone numbers—belonging to suspected hacking targets—was leaked to major media organisations. Investigations by major news outlets revealed that the list included the phone numbers of politicians, heads of state, business leaders, activists, members of Arab royalty, and more than 180 journalists. The software has been pinpointed by independent experts as likely being used in a number of countries with poor human rights records.
India has been significantly affected by NSO Group’s activities, with reports indicating that at least 100 individuals were targeted by Pegasus spyware in 2019, making it the second-most targeted country after Mexico. A 2021 report further revealed that over 300 Indian mobile numbers, including those of serving ministers, opposition leaders, journalists, and business people, were compromised using Pegasus.
Also Read | Surveillance state: The Pegasus saga unravels in India
WhatsApp’s decision to pursue the lawsuit and notify affected users in 2019 was crucial. The notifications helped victims, including dissidents, learn of the compromises, setting a tone for subsequent actions by tech companies.
In a blog post following the verdict, WhatsApp stated, “Today, the jury’s decision to force NSO, a notorious foreign spyware merchant, to pay damages is a critical deterrent to this malicious industry against their illegal acts aimed at American companies and the privacy and security of the people we serve.” The company also announced plans to donate the awarded damages to organisations defending against spyware attacks, reinforcing their commitment to privacy.
Additionally, WhatsApp intends to publish transcribed depositions from NSO Group, providing an unprecedented view into the company’s exploit development, operations, and financials. This transparency is expected to be a valuable resource for researchers and investigators, further exposing the spyware industry’s practices.
(With inputs from agencies)
source: https://frontline.thehindu.com/news/whatsapp-pegasus-privacy-lawsuit-nso-verdict-2025/article69552778.ece
