US jury awards WhatsApp compensation from Israel-based NSO Group

A US jury on Tuesday handed WhatsApp a major victory in its cyberespionage suit against NSO Group, ordering the Israel-based firm to pay some $168 million in damages.

Meta-owned WhatsApp sued NSO in late 2019 in federal court in Northern California, accusing it of planting Pegasus spy software on the smartphones of targets using the messaging app.

"This trial put spyware executives on the stand and exposed exactly how their surveillance-for-hire system - shrouded in so much secrecy - operates," Meta said in a blog post.

"Put simply, NSO's Pegasus works to covertly compromise people's phones with spyware capable of hoovering up information from any app installed on the device."

Pegasus software also enables smartphone cameras or microphones to be remotely turned on without letting users know, according to Meta.

WhatsApp accused NSO of cyberespionage targeting journalists, lawyers, human rights activists and others on the Facebook-owned messaging service.

A jury on Tuesday found that NSO should pay WhatsApp $444,719 in compensatory damages and another $167,254,000 in punitive damages intended to discourage repeating the behavior that landed it in court.

"We will carefully examine the verdict's details and pursue appropriate legal remedies, including further proceedings and an appeal," NSO vice president for global communication Gil Lainer said in response to an AFP inquiry.

"We firmly believe that our technology plays a critical role in preventing serious crime and terrorism and is deployed responsibly by authorized government agencies."

Evidence presented at the trial said NSO had spyware installation methods to exploit the technology of companies other than Meta, spending tens of millions of dollars annually on ways to install malicious code through messaging, browsers and operating systems, according to Meta.

In 2016, Apple rushed out a security update after researchers said prominent Emirati rights activist Ahmed Mansoor was targeted by UAE authorities using Pegasus spyware.

The software has been pinpointed by independent experts as likely being used in a number of countries with poor human rights records.

"Given how much information people access on their devices, including through private end-to-end encrypted apps like WhatsApp, Signal and others, we will continue going after spyware vendors indiscriminately targeting people around the world," Meta said in the blog post.

"These malicious technologies are a threat to the entire ecosystem and it'll take all of us to defend against it."

The legal complaint said the attackers "reverse-engineered the WhatsApp app and developed a program to enable them to emulate legitimate WhatsApp network traffic in order to transmit malicious code" to take over the devices.

Infecting smartphones or other gadgets being used for WhatsApp messages meant the content of messages encrypted during transmission could be accessed after they were unscrambled for recipients.

Natalia Krapiva, Senior Tech Legal Council at Access Now, a digital rights group, said that "today's verdict against NSO is an enormous victory for digital rights and for victims of Pegasus spyware around the world."

"Congratulations to Meta for sticking with their lawsuit and holding NSO to account. We urge other companies whose infrastructure and users are targeted by NSO and other spyware companies to explore filing similar legal actions," she added.

Founded in 2010 by Israelis Shalev Hulio and Omri Lavie, NSO Group is based in the Israeli seaside hi-tech hub of Herzliya, near Tel Aviv.