A federal jury in California has ordered NSO Group, the Israeli firm behind the Pegasus spyware, to pay WhatsApp $167 million (around £125 million) for hacking 1,400 users in 2019.

The ruling marks the first time a spyware developer has been held legally responsible for exploiting vulnerabilities in smartphone platforms, setting a precedent that could have far-reaching consequences for many comms tech companies (especially those operating on the more opaque fringes of the surveillance industry).

In a statement issued on its Newsroom, Meta said: “Today’s verdict in WhatsApp’s case is an important step forward for privacy and security as the first victory against the development and use of illegal spyware that threatens the safety and privacy of everyone.”

Pegasus is sophisticated malware that can be silently installed on phones, granting attackers access to microphones, cameras, messages, and location data.

While NSO Group insists its software is only sold to governments for tracking criminals and terrorists, investigations have repeatedly linked it to the surveillance of journalists, activists, and political dissidents. The hack targeted WhatsApp users through a missed call exploit, bypassing the app’s encryption.

Meta-owned WhatsApp, after fixing the flaw, worked with researchers at The Citizen Lab to identify victims – including human rights lawyers, diplomats, and opposition figures. The jury also awarded $444,719 (£332,783) in compensatory damages.

The Meta-issued statement goes on to say: “For the first time, this trial put spyware executives on the stand and exposed exactly how their surveillance-for-hire system – shrouded in so much secrecy – operates. Put simply, NSO’s Pegasus works to covertly compromise people’s phones with spyware capable of hoovering up information from any app installed on the device.

“Think anything from financial and location information to emails and text messages, or as NSO conceded: “every kind of user data on the phone.” It can even remotely activate the phone’s mic and camera – all without people’s knowledge, let alone authorization.”

Recommended reading

• Ofcom Introduces Over 40 New Online Safety Measures
• Meta Introduces Instagram Teen Accounts with Parental Controls
• Instagram Testing New Tools to Combat Sextortion

NSO Group, founded by Israeli military intelligence veterans, was valued at over $1 billion in 2019. Its Pegasus software became a diplomatic tool, helping Israel forge ties with Gulf states like Saudi Arabia and the UAE, despite their poor human rights records.

However, the 2021 leak of 50,000 potential targets – including royals, executives, and journalists – sparked global outrage, leading to U.S. sanctions against NSO.

The landmark verdict could also expose NSO to further lawsuits from Apple and other tech giants whose platforms were compromised by its Pegasus software.