NSO Group Fined $168 Million Over WhatsApp Hack in Landmark Case Against Meta

A federal jury in California has imposed a $168 million penalty on Israel’s NSO Group, marking a significant legal victory for Meta Platforms Inc. $META after years of litigation over unauthorized surveillance activity on WhatsApp. The verdict is the culmination of a six-year legal battle between the social media conglomerate and the controversial spyware vendor, and it sets a critical precedent in the fight against the misuse of digital surveillance tools by private companies on behalf of foreign intelligence agencies.

The jury found that NSO Group unlawfully infiltrated WhatsApp servers to deploy its Pegasus spyware—enabling its clients, many of whom were government agencies, to secretly monitor targeted users across borders. This case is among the most high-profile court actions against a private cyberintelligence firm, shedding rare light on the operational and financial underpinnings of a global spyware economy.

Surveillance for Hire: The Mechanics and Market of Digital Intrusion

At the core of the lawsuit was NSO Group’s use of sophisticated spyware to breach WhatsApp’s encrypted messaging system. The company, according to testimony and internal documentation, marketed these tools to European state clients between 2018 and 2020 under a standard fee structure.

Executives testified that NSO charged $7 million for the ability to simultaneously surveil up to 15 devices. The capability to hack devices located outside the contracting nation’s borders required additional payments ranging from $1 to $2 million—revealing the premium nature of cross-border surveillance in the clandestine tech market.

While NSO has maintained that its software is used exclusively to combat terrorism and serious crime, court findings suggest broader, unauthorized applications that infringed upon user privacy and corporate cybersecurity safeguards.

Key Takeaways from the Spyware Industry Exposé

• Sophisticated Exploits: NSO’s spyware penetrated WhatsApp’s servers, bypassing encrypted protections to intercept communications.

• Cross-Border Capabilities: Premium services allowed remote access to targets in foreign jurisdictions, raising legal and ethical red flags.

• High-Priced Licensing: Standard surveillance packages were sold for millions, underscoring the commercial scale of NSO’s operations.

• Client Base of Governments: European intelligence services were among the primary customers during the years covered by the case.

• Extended Legal Battle: Meta initiated the lawsuit in 2019, alleging violation of the Computer Fraud and Abuse Act (CFAA) and breach of WhatsApp’s terms of service.

Wider Ramifications in Tech and Cybersecurity Law

1. Corporate Cyber Defense Empowered: The jury’s decision reinforces the right of tech firms to defend their infrastructure against unauthorized surveillance and exploitation.

2. Judicial Oversight of Spyware: U.S. courts are increasingly willing to hold private surveillance vendors accountable for abuses, even when acting on behalf of sovereign clients.

3. Meta’s Legal Strategy Validated: Meta’s success could encourage other tech platforms to pursue similar cases against cybersecurity threats that originate beyond traditional hacking.

4. Surveillance Industry Scrutiny Grows: The verdict brings increased attention to the shadowy surveillance industry and may influence global regulatory responses.

5. NSO Group’s Reputation Damaged: The financial and reputational impact of this case may limit NSO’s future ability to operate internationally or license its tools to government clients.

Toward Greater Accountability in the Digital Surveillance Era

The decision against NSO Group signals a watershed moment for tech industry-led legal actions against commercial surveillance entities. While the line between state security interests and individual privacy remains contested, this case establishes that even firms operating at the behest of national governments may be held liable under U.S. law if their actions violate corporate platforms and user protections.

It also highlights the growing tension between the imperatives of cybersecurity and the global market for offensive cyber capabilities. As companies like Meta invest heavily in end-to-end encryption and digital privacy, courts may play an increasingly central role in enforcing technological boundaries through legal judgments.