Clash between Meta and NSO ends in $168 million defeat for spyware firm

Meta won a $168 million verdict against the Israeli surveillance firm NSO, the company said Tuesday, capping a six-year arm wrestling match between America's biggest social networking platform and the world's best known spyware company.

Meta had already won a December ruling finding that NSO had unlawfully exploited a bug in its messaging service WhatsApp to plant spy software on its users' phones. On Tuesday, a jury in California ruled that NSO owed Meta $444,719 in compensatory damages – and $167.3 million in punitive damages, Meta said.

“Today's verdict in WhatsApp's case is an important step forward for privacy and security as the first victory against the development and use of illegal spyware that threatens the safety and privacy of everyone,” Meta said in a statement.

In its statement, NSO said it would “carefully examine the verdict's details and pursue appropriate legal remedies, including further proceedings and an appeal.”

NSO, an Israeli firm that first drew global attention in 2016, has become “a poster child for the surveillance industry and their abuses and impunity,” said Natalia Krapiva, a senior lawyer with the human rights group Access Now.

NSO has long argued that its software is used to track terrorists and pedophiles, but the firm has been implicated in abusive surveillance in countries around the world, including Saudi Arabia, Spain, Mexico, Poland, and El Salvador.

WhatsApp's lawsuit – which was filed in 2019 and at one point made its way to the Supreme Court – has been closely followed both by NSO's competitors in the surveillance technology space and by human rights advocates critical of the industry.

Victims of state-backed hacking have struggled to hold suppliers of spy software accountable for what their customers do with their tools, while hacking firms have long worried that their products could draw legal sanctions. The WhatsApp verdict was a sign that both outcomes were possible, said Krapiva.

“This is something that will hopefully show spyware companies that there will be consequences if you are careless, if you are brazen, and if you act in such a way as NSO did in these cases,” she said.

Beyond sending a message to spyware merchants, the case also pulled back the curtain – ever so slightly – on the inner workings of NSO itself.

The court heard about NSO's 140 person-strong research team, whose $50 million budget was in part devoted to exploiting security vulnerabilities in smartphones. An attorney for the company disclosed that its customers included Uzbekistan, Saudi Arabia, and Mexico – rare on-the-record names from NSO's closely guarded client list.

Much about the spyware company's targets and clients remains unknown, in part because the firm refused to hand over evidence. In her December ruling, District Judge Phyllis Hamilton accused NSO of having “repeatedly failed to produce relevant discovery and failed to obey court orders regarding such discovery.”

The Guardian newspaper reported last year that Israeli officials had seized documents from NSO in an effort to prevent the files from making their way to US court.

“This whole case is shrouded in so much secrecy,” Hamilton said during the trial. “There's so much that's not known.”