On Tuesday, a U.S. jury ruled in favour of WhatsApp in its cyberespionage case against Israel’s NSO Group, ordering the company to pay around $168 million in damages. The lawsuit, filed by WhatsApp’s parent company Meta in 2019 in a Northern California federal court, accused NSO of using Pegasus spyware to hack into users’ phones through the messaging platform. 

In a blog post, Meta clarified, "This trial put spyware executives on the stand and exposed exactly how their surveillance-for-hire system -- shrouded in so much secrecy -- operates." It further said, "Put simply, NSO's Pegasus works to covertly compromise people's phones with spyware capable of hoovering up information from any app installed on the device."

According to Meta, the Pegasus spyware can secretly activate a smartphone’s camera or microphone without the user’s knowledge. WhatsApp had accused the NSO Group of conducting cyberespionage against journalists, lawyers and human rights defenders through its platform. On Tuesday, a jury ruled that NSO must pay WhatsApp $444,719 in compensation, along with $167.25 million in punitive damages meant to deter similar actions in the future. 

Responding to an AFP inquiry, NSO’s vice president for global communication, Gil Lainer, stated, “We will carefully examine the verdict's details and pursue appropriate legal remedies, including further proceedings and an appeal.” He added, “We firmly believe that our technology plays a critical role in preventing serious crime and terrorism and is deployed responsibly by authorised government agencies.”

During the trial, evidence revealed that NSO invested tens of millions of dollars each year in developing spyware installation techniques that targeted the technologies of companies beyond Meta. Meta stated that these methods included exploiting messaging apps, web browsers, and operating systems to install malicious software. In 2016, Apple had to urgently release a security patch after researchers discovered that Pegasus spyware was used by UAE authorities to target well-known Emirati human rights activist Ahmed Mansoor. Independent investigators have linked Pegasus to use in several countries known for poor human rights practices. 

"Given how much information people access on their devices, including through private end-to-end encrypted apps like WhatsApp, Signal and others, we will continue going after spyware vendors indiscriminately targeting people around the world," Meta stated in the blog post. Added, "These malicious technologies are a threat to the entire ecosystem, and it'll take all of us to defend against it." The legal complaint stated that the attackers "reverse-engineered the WhatsApp app and developed a program to enable them to emulate legitimate WhatsApp network traffic in order to transmit malicious code" that allowed them to gain control of users' devices.

Hacking smartphones or devices running WhatsApp allowed attackers to read messages after they were decrypted for the user, even though they were encrypted during transmission. NSO Group, the company behind this technology, was founded in 2010 by Israelis Shalev Hulio and Omri Lavie and operates out of Herzliya, a high-tech area near Tel Aviv.