A California jury ordered NSO Group Technologies to pay WhatsApp $444,719 in compensatory damages and $167,254,000 in punitive damages on Tuesday. The jury found that “NSO engaged in malice, oppression, or fraud in violating the California Comprehensive Data Access and Fraud Act”.
WhatsApp brought its complaint against NSO, an Israeli cybersecurity company, on October 29, 2019, in the District Court for the Northern District of California. WhatsApp alleged that NSO had sent “malware to approximately 1,400 mobile phones and devices… for the purpose of conducting surveillance of specific WhatsApp users” without their authorization. In its motion to dismiss, NSO argued that its Pegasus technology is used exclusively by government agencies for “prevention and investigation of terrorism and criminal activity.” They further stated that the agencies themselves, and not NSO, which operate the software “within the scope of their sovereign authority”.
The California Comprehensive Data Access and Fraud Act (CDAFA) is the state equivalent of the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. § 1030. The court ruled in December 2024 that NSO violated sections (a)(2) and (a)(4) of the CFAA, which prescribes punishment for whoever “intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains information…” or “knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and and by means of such conduct furthers the intended fraud and obtains anything of value.” Section (b) “assigns liability to co-conspirators”, leading the court to reject NSO’s argument that they bear no responsibility for the actions of their clients.
In a statement on the Meta website, WhatsApp called the decision “a critical deterrent to this malicious industry against their illegal acts aimed at American companies and the privacy and security of the people we serve.” Amnesty International (AI) said, “We trust that this victory will deter the spyware industry, its investors and its government customers worldwide.” NSO stated that it would “carefully examine the verdict’s details and pursue appropriate legal remedies, including further proceedings and an appeal.”
NSO’s Pegasus spyware has been linked to human rights abuses worldwide, including the targeting of journalists and the surveillance of human rights activists in countries like Serbia, Morocco, and Thailand. Once remotely installed, the spyware can access a phone’s camera and microphone as well as text messages and passwords. There have been calls for governments to take action against the use of such spyware.
