In a landmark ruling that echoes across the cybersecurity and human rights landscapes, a U.S. federal jury has ordered NSO Group, the Israeli cyber-intelligence firm behind the notorious Pegasus spyware, to pay Meta-owned WhatsApp a total of $168 million in damages. The decision comes over four years after WhatsApp first filed suit and just months after a U.S. federal judge ruled that NSO had violated multiple U.S. laws by misusing WhatsApp’s California-based servers to distribute its surveillance tool.

The Lawsuit That Shook the Surveillance Industry

WhatsApp’s legal battle against NSO began in 2019, alleging that the company had used a highly sophisticated zero-day vulnerability (CVE-2019-3568) in WhatsApp’s voice-calling feature to install Pegasus spyware onto the devices of over 1,400 users around the world — without them even answering the call. Victims included journalists, political dissidents, and human rights defenders.

Newly unsealed court documents shed light on the geographical scope of the attack: 456 individuals in Mexico, 100 in India, 82 in Bahrain, 69 in Morocco, and 58 in Pakistan, among others. In total, targets spanned 51 countries, highlighting the global scale of the surveillance.

Pegasus, NSO Group’s flagship spyware, is capable of infiltrating both iOS and Android devices, allowing clients to access messages, emails, microphone input, and location data in real-time. It has become a symbol of the dark side of government surveillance.

The California Connection

The critical legal turning point came in December 2024, when U.S. District Judge Phyllis J. Hamilton ruled that NSO Group had unlawfully accessed WhatsApp’s servers, which are based in California, to send Pegasus 43 times over a two-week period in May 2019.

That ruling paved the way for this week’s jury verdict, which awarded $167,254,000 in punitive damages and $444,719 in compensatory damages — the latter reflecting the engineering resources WhatsApp invested in shutting down the breach.

“This case made history when the court found NSO broke both federal and state laws in the United States,” said Will Cathcart, head of WhatsApp at Meta, in a statement posted on X (formerly Twitter). “Today’s jury verdict is a critical deterrent to the spyware industry.”

Justice Beyond the Courtroom

Cathcart added that WhatsApp would be seeking a permanent injunction to prevent NSO from ever targeting its platform again. The company also announced plans to donate a portion of the awarded damages to digital rights organizations that defend individuals against surveillance abuses.

For privacy advocates and human rights groups, this ruling represents a significant step forward. They’ve long criticized NSO for selling surveillance tools to governments accused of suppressing dissent and undermining civil liberties.

NSO’s Defense, and Continued Denial

NSO Group maintains that its technology is intended to fight terrorism and serious crime. In a statement issued to Courthouse News and POLITICO, the company said it intends to “pursue appropriate legal remedies” and defended its tools as necessary for national security operations.

However, the court wasn’t convinced. Judge Hamilton noted that NSO could not both claim to aid counterterrorism efforts and simultaneously disavow responsibility for how its software is used. The company was also forced to admit it invests tens of millions annually to develop malware delivery systems that target messaging apps, web browsers, and operating systems.

Notably, Apple filed a similar lawsuit against NSO in 2021 but quietly dropped the case in September 2024, citing concerns that continuing litigation might reveal sensitive details about its internal security architecture.

The Bigger Picture

This verdict marks the first major financial consequence for a company behind spyware abuse at this scale. It may serve as a wake-up call for other companies operating in the gray zone of state surveillance, where national security claims often mask broader suppression of civil rights.

More than just a courtroom win for Meta and WhatsApp, this decision sends a clear message to spyware vendors worldwide: the era of unchecked digital surveillance may finally be facing a long-overdue reckoning.