US jury awards WhatsApp $168 mn in NSO Group cyberespionage suit

A US jury on Tuesday handed WhatsApp a major victory in its cyberespionage suit against NSO Group, ordering the Israel-based firm to pay some $168 million in damages.

Meta-owned WhatsApp sued NSO in late 2019 in federal court in Northern California, accusing it of planting Pegasus spy software on the smartphones of targets using the messaging app.

"This trial put spyware executives on the stand and exposed exactly how their surveillance-for-hire system –- shrouded in so much secrecy –- operates," Meta said in a blog post.

"Put simply, NSO's Pegasus works to covertly compromise people's phones with spyware capable of hoovering up information from any app installed on the device."

Pegasus software also enables smartphone cameras or microphones to be remotely turned on without letting users know, according to Meta.

WhatsApp accused NSO of cyberespionage targeting journalists, lawyers, human rights activists and others on the Facebook-owned messaging service.

A jury on Tuesday found that NSO should pay WhatsApp $444,719 in compensatory damages and another $167,254,000 in punitive damages intended to discourage repeating the behavior that landed it in court.

"We will carefully examine the verdict's details and pursue appropriate legal remedies, including further proceedings and an appeal," NSO vice president for global communication Gil Lainer said in response to an AFP inquiry.

"We firmly believe that our technology plays a critical role in preventing serious crime and terrorism and is deployed responsibly by authorized government agencies."

Evidence presented at the trial said NSO had spyware installation methods to exploit the technology of companies other than Meta, spending tens of millions of dollars annually on ways to install malicious code through messaging, browsers and operating systems, according to Meta.

In 2016, Apple rushed out a security update after researchers said prominent Emirati rights activist Ahmed Mansoor was targeted by UAE authorities using Pegasus spyware.

The software has been pinpointed by independent experts as likely being used in a number of countries with poor human rights records.

"Given how much information people access on their devices, including through private end–to-end encrypted apps like WhatsApp, Signal and others, we will continue going after spyware vendors indiscriminately targeting people around the world," Meta said in the blog post.

"These malicious technologies are a threat to the entire ecosystem and it'll take all of us to defend against it."

The legal complaint said the attackers "reverse-engineered the WhatsApp app and developed a program to enable them to emulate legitimate WhatsApp network traffic in order to transmit malicious code" to take over the devices.

Infecting smartphones or other gadgets being used for WhatsApp messages meant the content of messages encrypted during transmission could be accessed after they were unscrambled for recipients.

Founded in 2010 by Israelis Shalev Hulio and Omri Lavie, NSO Group is based in the Israeli seaside hi-tech hub of Herzliya, near Tel Aviv.

Source: AFP