Jury awards Meta $168M for WhatsApp hacking by Pegasus

An Oakland federal jury on Tuesday ordered NSO Group, the Israeli cyber intelligence company behind the spyware Pegasus, to pay Meta Platforms Inc. $168 million for hacking 1,400 WhatsApp users in 2019.

NSO defended the Pegasus software and said it is considering an appeal.

The verdict comes after a five-day damages trial before U.S. District Judge Phyllis Hamilton, who granted summary judgment against NSO on all of Meta's causes of action in December. Hamilton also sanctioned the company for failing to produce Pegasus' source code, internal communications and other evidence. WhatsApp Inc. et al. v. NSO Group Technologies Limited et al., 4:19-cv-07123 (N.D. Cal. filed Oct. 29, 2019).

Gil Kanier, NSO's vice president for global communications, said in an email Tuesday the company is considering appealing the verdict and defended the societal value of Pegasus.

"Today's jury decision marks another step in a lengthy judicial process. We firmly believe that our technology plays a critical role in preventing serious crime and terrorism and is deployed responsibly by authorized government agencies," Kanier wrote. "This perspective, validated by extensive real-world evidence and numerous security operations that have saved many lives, including American lives, was excluded from the jury's consideration in this case. We will carefully examine the verdict's details and pursue appropriate legal remedies, including further proceedings and an appeal."

Meta's press office and trial attorneys could not be reached for comment on Tuesday. Meta's trial team was led by Greg D. Andres, a New York City partner for Davis Polk and Wardwell LLP, who previously served as assistant special counsel to Robert Mueller during the investigation into allegations of Russian interference in the 2016 U.S. presidential election.

At the heart of the immediate dispute is the claim from Meta, and its subsidiary WhatsApp Inc., that NSO violated state and federal laws by using its spyware product, Pegasus, to remotely infiltrate WhatsApp's servers and "secretly inject malicious code onto target devices" from Bahrain, the United Arab Emirates, Mexico and other countries.

In a March 13 trial brief, Andres and his co-counsel described how NSO used Pegasus to hack WhatsApp servers and argued that NSO's "redesign" of Pegasus after the lawsuit was filed justified an award of punitive damages.

"Defendants NSO Group Technologies developed, marketed, licensed, and used spyware called Pegasus, which used a manipulated version of the WhatsApp application to access and to send malicious code through WhatsApp's servers, all for the purpose of surveilling WhatsApp users," the brief stated. "Plaintiffs are entitled to punitive damages for NSO's violation of the CDAFA. In finding NSO liable, the court determined that NSO acted with fraudulent intent when it redesigned Pegasus to evade detection after plaintiffs first fixed the security breach--and after Plaintiffs filed this lawsuit. At trial, plaintiffs will prove that NSO is 'guilty of oppression, fraud, or malice,' which allows the jury to award punitive damages."

Human rights activists and regulators throughout the globe have criticized the use of Pegasus by foreign governments, claiming they use spyware to hack into the cell phones of political opponents and surveil them.

In November 2021 the U.S. Department of Commerce added NSO to its "Entity List," which identifies companies outside the U.S. that pose a threat to consumers.

In a news release the department explained its reasons for warning the public. "NSO Group and Candiru (Israel) were added to the Entity List based on evidence that these entities developed and supplied spyware to foreign governments that used these tools to maliciously target government officials, journalists, businesspeople, activists, academics, and embassy workers."

Andres' colleagues from Davis Polk & Wardell who served as co-counsel in the case are: Micah G. Block of Redwood City and Antonio Perez-Marques, Luca Marzorati, Gina Cora of New York City.

Joseph Akrotirianakis, Aaron Craig, and Matthew Noller of King & Spalding LLP represent NSO and could not immediately be reached for comment on Tuesday.

Prior to trial, NSO's legal team secured a procedural win when Hamilton ordered NSO's draft of the punitive damages instruction be given to the jury at the end of trial.

"Regarding the punitive damages instruction, the court has reviewed the authorities cited by the parties, and concludes that defendants' authority is more persuasive on the issue of whether the instruction should include language tying any damages award to acts committed within California," Hamilton wrote in an April 25 order. "Additionally, defendants objected to plaintiffs' proposed language regarding a 'disregard' or 'knowing disregard' of the rights, health, or safety of another, and the court sustained defendants' objection. Accordingly, the court adopts defendants' proposed instruction no. 5, regarding punitive damages."