Court bars NSO from targeting WhatsApp users, punitive damages to $4M

A federal judge on Friday granted a permanent injunction barring Israeli cyberintelligence firm NSO Group from targeting users of the messaging app WhatsApp, finding the company’s conduct caused ongoing and irreparable harm, while sharply reducing a jury’s earlier punitive damages award from roughly $167 million to about $4 million. The decision came in U.S. District Court in the Northern District of California in the case WhatsApp, owned by Meta, filed against NSO in 2019.

Judge Phyllis Hamilton wrote that evidence at trial showed NSO reverse engineered WhatsApp code to install its Pegasus spyware on users’ phones and repeatedly redesigned the software to evade detection and bypass security fixes. The ruling described methods used to infect devices, including missed-call exploits and so called zero click attacks, and concluded there was no dispute the conduct was ongoing. “Part of what companies such as WhatsApp are selling is informational privacy, and any unauthorized access is an interference with that sale,” Hamilton wrote.

WhatsApp had accused NSO of exploiting a vulnerability to target more than 1,400 users over a two week period in April and May 2019, including...