In a landmark legal ruling that could reshape the surveillance technology industry, WhatsApp has secured a $168 million jury verdict against NSO Group, the Israeli developer of Pegasus spyware, for exploiting a vulnerability in the encrypted messaging platform in 2019. The case, reported by the Financial Times, marks the first time a spyware manufacturer has been held legally accountable for hacking a major digital platform.
The ruling, handed down by a federal jury in California, follows years of litigation initiated by WhatsApp’s parent company, Meta. The jury found that NSO Group had violated both U.S. hacking laws and WhatsApp’s terms of service when it weaponized a technical weakness in the app, enabling its government clients to secretly surveil journalists, political dissidents, and human rights advocates around the world.
“This verdict is a crucial step forward for digital privacy and security,” Meta said in a blog post following the decision. “It’s the first successful legal action targeting the creation and use of illegal spyware that undermines the safety and privacy of people everywhere.”
The spyware in question, Pegasus, was previously exposed by the Financial Times in 2019, which reported that NSO clients could install the software on a target’s phone with just a missed call via WhatsApp. Once installed, Pegasus allowed full remote access to the device—monitoring messages, photos, location data, and even activating microphones and cameras—without the user’s knowledge.
Though WhatsApp quickly patched the vulnerability, it worked with Citizen Lab, a cybersecurity watchdog group at the University of Toronto, to trace and identify hundreds of victims. Many of these were members of civil society, including lawyers, opposition politicians, and advocates for press freedom. This evidence played a key role in the legal proceedings.
“After years of every trick and delay tactic, it only took the jury a day’s deliberation to see through to the heart of the matter: NSO’s business is built on hacking American companies so that dictators can hack dissidents,” said John Scott-Railton of Citizen Lab, who collaborated with WhatsApp on the investigation.
NSO Group, for its part, has vowed to appeal the decision. “We firmly believe that our technology plays a critical role in preventing serious crime and terrorism and is deployed responsibly by authorised government agencies,” the company said in a statement.
The verdict could open the floodgates for further legal action from other major tech firms, including Apple, Amazon, and Google’s Android platform, which have also been reportedly targeted by Pegasus. Several of these companies filed amicus briefs in support of WhatsApp’s lawsuit, underscoring industry-wide concerns about the unchecked proliferation of surveillance software.
The NSO Group, once a secretive cybersecurity firm staffed by elite veterans of Israel’s signals intelligence units, had been valued at over $1 billion in 2019 following a private equity buyout. Its Pegasus product had become a key tool in diplomatic deals between Israel and Gulf nations—such as Saudi Arabia and the UAE—despite ongoing concerns over human rights abuses.
The Biden administration blacklisted NSO in 2021 and has since taken steps to rein in the global spyware market. WhatsApp’s legal win now gives that regulatory momentum a significant boost.
“WhatsApp stuck the fight out and carried this case across the finish line,” added Scott-Railton. “This is a huge credit to their leadership, and a warning shot to spyware developers worldwide.”
