Super spyware maker NSO must pay Meta $168M in WhatsApp court battle
(2025/05/07)
- Reference: 1746575426
- News link: https://www.theregister.co.uk/2025/05/06/nso_group_meta_verdict/
- Source link:
A California jury has awarded Meta more than $167 million in damages from Israeli surveillanceware slinger NSO Group, after the latter exploited a flaw in WhatsApp to allow its government customers to spy on supposedly secure communications.
In May 2019 engineers at WhatsApp [1]discovered a zero-click, zero-day vulnerability in the Meta-owned chat platform that would allow an attacker to install malware on a device with just a single phone call and no requirement on the victim to do anything other than have their handheld switched on. The surveillanceware in question was Pegasus, developed by the NSO Group.
Pegasus is carefully designed to use zero-day vulnerabilities to infect handsets, ideally without any user interaction. Once on a phone, it has access to all and any data the devices contain, including phone records, emails, messages, and video, as well as the location of the device. It can even let its operator turn on the handset's camera and microphone for clandestine recording.
[2]
Pegasus compromised around 1,400 WhatsApp accounts, and WhatsApp's engineers patched the flaw within days. But it's very unwise to f**k with billionaire Meta supremo Mark Zuckerberg; he unleashed the lawyers, who [3]filed a lawsuit against NSO that October. On Tuesday, after less than two days of consideration, the eight-person jury handed out a fine that amounts to nearly three times NSO's annual R&D budget, according to Meta's estimates.
[4]
[5]
In an extra twist of the knife, the company formerly known as Facebook is [6]sharing transcripts of NSO executives' court depositions on its PR website, "so that these records are available to researchers and journalists studying these threats and working to protect the public." The mega-corp added, "We intend to add official court transcripts once they become available."
In a statement to The Register , Meta warned of the continuing threat from the super spyware. "While we stopped the attack vector that exploited our calling system in 2019, Pegasus has had many other spyware installation methods to exploit other companies’ technologies to manipulate people’s devices into downloading malicious code and compromising their phones."
[7]
The statement continued, "NSO was forced to admit that it spends tens of millions of dollars annually to develop malware installation methods including through instant messaging, browsers, and operating systems, and that its spyware is capable of compromising iOS or Android devices to this day."
Meta thanked the Canadian nonprofit Citizen Lab for its help in investigating Pegasus. The social networking giant also pledged that if and when NSO Group pays up, it will donate the funds - which amount to 21 hours of profit in its last quarter - to digital-rights groups.
"For a long time there were a handful of us doing mercenary spyware research," [8]said John Scott-Railton, a senior researcher at Citizen Lab.
[9]
"Having WhatsApp independently do serious investigating and publicly attribute hacking to NSO Group was huge for helping the rest of the world see the severity of the issue. Thankfully, today this has changed."
Oh what a tangled web we weave
NSO Group has been fighting Meta's lawsuit tooth and nail, and has tried a variety of different legal tactics in the long case. Meta alleged among other things that NSO broke computer abuse and trespass laws.
The spyware maker [10]lost an initial judgment by default when it failed to show up in court, after [11]claiming Facebook hadn't delivered legal documents on time. It also accused Facebook of hypocrisy, [12]claiming executives had approached NSO Group to use its surveillanceware to spy on its own customers.
Next up, NSO argued Facebook couldn't sue it as the software maker only sold to governments, it didn't [13]operate in the US, and so had legal [14]immunity . However, it then came out that a sister company to NSO Group, Westbridge, [15]was caught trying to sell Pegasus to US police.
By 2020 the judge gave a green light for the case to [16]begin in earnest and the discovery process began, allowing the first official glimpses into how NSO was running its operations. A year later, NSO Group tried to [17]claim sovereign immunity yet again - only to be shot down in court.
[18]Israeli spyware maker NSO channels Hollywood spy thrillers in appeal for legal immunity in WhatsApp battle
[19]Would you buy Pegasus spyware from this scammer?
[20]UK activists targeted with Pegasus spyware ask police to charge NSO Group
[21]Britain approved £2.5m of snooping kit exports to thoroughly snuggly regime in Saudi Arabia
In November 2021 Apple joined Meta [22]in suing the NSO Group, calling the business "amoral 21st century mercenaries." The case was based around reports that Pegasus was being used to spy on iPhone users and had been found on [23]US , [24]EU , and [25]UK government devices. A lawsuit also claims that the Saudi Arabian government used it to spy on journalists who disagreed with the monarchym, such as the assassinated journalist [26]Jamal Khashoggi . (NSO [27]denied this.)
The US Supreme Court [28]snubbed NSO Group's last-gasp bid at claiming sovereign immunity in 2023, and the case continued. During the discovery process, NSO [29]was forced to cough up its crown jewels - the source code for Pegasus - so Meta could see it.
Last year, a judge finally found the surveillanceware slinger guilty, and the jury sat down on Monday to decide what the penalties should be. Meta's lawyers suggested that the NSO Group's research budget was $60 million, and so that might be a figure to consider. The jury took less than two days to decide they would like a more punitive fine.
In a statement to The Register , the NSO Group said it was considering going back to court to argue for a more favorable decision.
“Today's jury decision marks another step in a lengthy judicial process. We firmly believe that our technology plays a critical role in preventing serious crime and terrorism and is deployed responsibly by authorized government agencies," it said.
"This perspective, validated by extensive real-world evidence and numerous security operations that have saved many lives, including American lives, was excluded from the jury's consideration in this case. We will carefully examine the verdict's details and pursue appropriate legal remedies, including further proceedings and an appeal." ®
Get our [30]Tech Resources
[1] https://www.theregister.com/2019/05/14/whatsapp_zero_day/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aBra4IOb-PiwZXnJL84bhwAAAEs&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.theregister.com/2019/10/29/whatsapp_sue_nso_group/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aBra4IOb-PiwZXnJL84bhwAAAEs&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aBra4IOb-PiwZXnJL84bhwAAAEs&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://about.fb.com/news/2025/05/winning-the-fight-against-spyware-merchant-nso/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aBra4IOb-PiwZXnJL84bhwAAAEs&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://bsky.app/profile/jsrailton.bsky.social/post/3lojtsbzabk26
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aBra4IOb-PiwZXnJL84bhwAAAEs&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[10] https://www.theregister.com/2020/03/09/roundup_march6_2020/
[11] https://www.theregister.com/2020/03/09/nso_facebook_lied/
[12] https://www.theregister.com/2020/04/03/nso_facebook_pegasus_whatsapp/
[13] https://www.theregister.com/2020/05/01/nso_whatsapp_california/
[14] https://www.theregister.com/2020/04/24/nso_group_cant_claim_immunity/
[15] https://www.theregister.com/2020/05/13/senator_police_spyware_nso/
[16] https://www.theregister.com/2020/07/17/facebook_whatsapp_nsa/
[17] https://www.theregister.com/2020/11/17/israeli_hacking_group_goes_hollywood/
[18] https://www.theregister.com/2020/11/17/israeli_hacking_group_goes_hollywood/
[19] https://www.theregister.com/2024/05/23/fake_pegasus_spyware_circulating/
[20] https://www.theregister.com/2024/09/19/pegasus_spyware_met_police_complaint/
[21] https://www.theregister.com/2018/12/12/britain_2_5m_spytech_exports_saudi_arabia/
[22] https://www.theregister.com/2021/11/23/apple_nso_group/
[23] https://www.theregister.com/2021/12/04/american_diplomats_nso/
[24] https://www.theregister.com/2022/04/11/nso_spyware_eu/
[25] https://www.theregister.com/2022/04/18/uk_catalan_spyware/
[26] https://www.theguardian.com/world/2021/jul/18/nso-spyware-used-to-target-family-of-jamal-khashoggi-leaked-data-shows-saudis-pegasus
[27] https://www.timesofisrael.com/nso-founder-denies-its-cellphone-hacking-software-used-to-track-khashoggi/
[28] https://www.theregister.com/2023/01/09/supreme_court_pegasus_spyware/
[29] https://www.theregister.com/2024/03/01/nso_pegasus_source_code/
[30] https://whitepapers.theregister.com/
In May 2019 engineers at WhatsApp [1]discovered a zero-click, zero-day vulnerability in the Meta-owned chat platform that would allow an attacker to install malware on a device with just a single phone call and no requirement on the victim to do anything other than have their handheld switched on. The surveillanceware in question was Pegasus, developed by the NSO Group.
Pegasus is carefully designed to use zero-day vulnerabilities to infect handsets, ideally without any user interaction. Once on a phone, it has access to all and any data the devices contain, including phone records, emails, messages, and video, as well as the location of the device. It can even let its operator turn on the handset's camera and microphone for clandestine recording.
[2]
Pegasus compromised around 1,400 WhatsApp accounts, and WhatsApp's engineers patched the flaw within days. But it's very unwise to f**k with billionaire Meta supremo Mark Zuckerberg; he unleashed the lawyers, who [3]filed a lawsuit against NSO that October. On Tuesday, after less than two days of consideration, the eight-person jury handed out a fine that amounts to nearly three times NSO's annual R&D budget, according to Meta's estimates.
[4]
[5]
In an extra twist of the knife, the company formerly known as Facebook is [6]sharing transcripts of NSO executives' court depositions on its PR website, "so that these records are available to researchers and journalists studying these threats and working to protect the public." The mega-corp added, "We intend to add official court transcripts once they become available."
In a statement to The Register , Meta warned of the continuing threat from the super spyware. "While we stopped the attack vector that exploited our calling system in 2019, Pegasus has had many other spyware installation methods to exploit other companies’ technologies to manipulate people’s devices into downloading malicious code and compromising their phones."
[7]
The statement continued, "NSO was forced to admit that it spends tens of millions of dollars annually to develop malware installation methods including through instant messaging, browsers, and operating systems, and that its spyware is capable of compromising iOS or Android devices to this day."
Meta thanked the Canadian nonprofit Citizen Lab for its help in investigating Pegasus. The social networking giant also pledged that if and when NSO Group pays up, it will donate the funds - which amount to 21 hours of profit in its last quarter - to digital-rights groups.
"For a long time there were a handful of us doing mercenary spyware research," [8]said John Scott-Railton, a senior researcher at Citizen Lab.
[9]
"Having WhatsApp independently do serious investigating and publicly attribute hacking to NSO Group was huge for helping the rest of the world see the severity of the issue. Thankfully, today this has changed."
Oh what a tangled web we weave
NSO Group has been fighting Meta's lawsuit tooth and nail, and has tried a variety of different legal tactics in the long case. Meta alleged among other things that NSO broke computer abuse and trespass laws.
The spyware maker [10]lost an initial judgment by default when it failed to show up in court, after [11]claiming Facebook hadn't delivered legal documents on time. It also accused Facebook of hypocrisy, [12]claiming executives had approached NSO Group to use its surveillanceware to spy on its own customers.
Next up, NSO argued Facebook couldn't sue it as the software maker only sold to governments, it didn't [13]operate in the US, and so had legal [14]immunity . However, it then came out that a sister company to NSO Group, Westbridge, [15]was caught trying to sell Pegasus to US police.
By 2020 the judge gave a green light for the case to [16]begin in earnest and the discovery process began, allowing the first official glimpses into how NSO was running its operations. A year later, NSO Group tried to [17]claim sovereign immunity yet again - only to be shot down in court.
[18]Israeli spyware maker NSO channels Hollywood spy thrillers in appeal for legal immunity in WhatsApp battle
[19]Would you buy Pegasus spyware from this scammer?
[20]UK activists targeted with Pegasus spyware ask police to charge NSO Group
[21]Britain approved £2.5m of snooping kit exports to thoroughly snuggly regime in Saudi Arabia
In November 2021 Apple joined Meta [22]in suing the NSO Group, calling the business "amoral 21st century mercenaries." The case was based around reports that Pegasus was being used to spy on iPhone users and had been found on [23]US , [24]EU , and [25]UK government devices. A lawsuit also claims that the Saudi Arabian government used it to spy on journalists who disagreed with the monarchym, such as the assassinated journalist [26]Jamal Khashoggi . (NSO [27]denied this.)
The US Supreme Court [28]snubbed NSO Group's last-gasp bid at claiming sovereign immunity in 2023, and the case continued. During the discovery process, NSO [29]was forced to cough up its crown jewels - the source code for Pegasus - so Meta could see it.
Last year, a judge finally found the surveillanceware slinger guilty, and the jury sat down on Monday to decide what the penalties should be. Meta's lawyers suggested that the NSO Group's research budget was $60 million, and so that might be a figure to consider. The jury took less than two days to decide they would like a more punitive fine.
In a statement to The Register , the NSO Group said it was considering going back to court to argue for a more favorable decision.
“Today's jury decision marks another step in a lengthy judicial process. We firmly believe that our technology plays a critical role in preventing serious crime and terrorism and is deployed responsibly by authorized government agencies," it said.
"This perspective, validated by extensive real-world evidence and numerous security operations that have saved many lives, including American lives, was excluded from the jury's consideration in this case. We will carefully examine the verdict's details and pursue appropriate legal remedies, including further proceedings and an appeal." ®
Get our [30]Tech Resources
[1] https://www.theregister.com/2019/05/14/whatsapp_zero_day/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aBra4IOb-PiwZXnJL84bhwAAAEs&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://www.theregister.com/2019/10/29/whatsapp_sue_nso_group/
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aBra4IOb-PiwZXnJL84bhwAAAEs&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aBra4IOb-PiwZXnJL84bhwAAAEs&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://about.fb.com/news/2025/05/winning-the-fight-against-spyware-merchant-nso/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aBra4IOb-PiwZXnJL84bhwAAAEs&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://bsky.app/profile/jsrailton.bsky.social/post/3lojtsbzabk26
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/cso&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aBra4IOb-PiwZXnJL84bhwAAAEs&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[10] https://www.theregister.com/2020/03/09/roundup_march6_2020/
[11] https://www.theregister.com/2020/03/09/nso_facebook_lied/
[12] https://www.theregister.com/2020/04/03/nso_facebook_pegasus_whatsapp/
[13] https://www.theregister.com/2020/05/01/nso_whatsapp_california/
[14] https://www.theregister.com/2020/04/24/nso_group_cant_claim_immunity/
[15] https://www.theregister.com/2020/05/13/senator_police_spyware_nso/
[16] https://www.theregister.com/2020/07/17/facebook_whatsapp_nsa/
[17] https://www.theregister.com/2020/11/17/israeli_hacking_group_goes_hollywood/
[18] https://www.theregister.com/2020/11/17/israeli_hacking_group_goes_hollywood/
[19] https://www.theregister.com/2024/05/23/fake_pegasus_spyware_circulating/
[20] https://www.theregister.com/2024/09/19/pegasus_spyware_met_police_complaint/
[21] https://www.theregister.com/2018/12/12/britain_2_5m_spytech_exports_saudi_arabia/
[22] https://www.theregister.com/2021/11/23/apple_nso_group/
[23] https://www.theregister.com/2021/12/04/american_diplomats_nso/
[24] https://www.theregister.com/2022/04/11/nso_spyware_eu/
[25] https://www.theregister.com/2022/04/18/uk_catalan_spyware/
[26] https://www.theguardian.com/world/2021/jul/18/nso-spyware-used-to-target-family-of-jamal-khashoggi-leaked-data-shows-saudis-pegasus
[27] https://www.timesofisrael.com/nso-founder-denies-its-cellphone-hacking-software-used-to-track-khashoggi/
[28] https://www.theregister.com/2023/01/09/supreme_court_pegasus_spyware/
[29] https://www.theregister.com/2024/03/01/nso_pegasus_source_code/
[30] https://whitepapers.theregister.com/
A pox on all their houses
Anonymous Coward
Who in their right mind would have anything to do with these showers?
What is really interesting.........
Anonymous Coward
.....is that when NSO/Pegasus is installed on an end point.........
.....it DOES NOT MATTER if the user uses Signal or Telegram or WhatsApp.............
.....everything that user does on that end point is available (in plain) to the scumbag who installed NSO/Pegasus!!!!
(1) Ask Angela Merkel!!!
(2) ....or Peter Hegseth
(3) ....or Mike Waltz
(4) ....or maybe Joe Biden
......or maybe YOU!!
Paranoid?..........No, not me!
Grindslow_knoll
I think it's well understood that E2E only secures the protocol, not the endpoints, as noted above.
The interesting thing here is that a company that survives by harvesting personal data they persuade people to hand over for free, then sues a spyware company.
I think Tery Pratchett would be hard pressed to come up with a cheeky plotline like this.
If the zero day was in Signal, it would be fixed, and that'd be that.
But I imagine Meta is making the point that only they have the right to hover personal data from the E2E mirage, and if anyone else wants in (C-Analytica), they need to sign on the dotted line with a hefty cheque.
That is the crossed line, and the rest is PR.
"... and numerous security operations that have saved many lives ..." Ask Khashoggi's relatives, ...
Pegasus has probably been used for many such operations. They can cloak their terms in statements that it should only be used by benevolent "state actors" but everyone knows, everyone knows that the darkest forces on earth will also be using it.
This is why state-mandated back-doors into privacy functions will be ultimately used for ill purposes. Whether by the states or by the rest of the criminals.