Meta Platforms has secured a significant legal victory, winning a $168 million verdict against Israeli spyware company NSO Group in a long-running lawsuit over the unauthorized use of WhatsApp servers to deploy spyware on users’ devices. The ruling marks the first major courtroom win against a surveillance firm for the deployment of illegal spyware.
A California jury awarded Meta $444,719 in compensatory damages and $167.3 million in punitive damages, capping a six-year legal battle that began with a 2019 lawsuit. In December, a federal judge had already ruled that NSO unlawfully exploited a WhatsApp vulnerability to implant surveillance software.
Meta hailed the outcome as a “step forward for privacy and security”, adding that the verdict sets a precedent in holding spyware developers accountable.
A Rare Glimpse Into the Spyware Industry
The trial revealed rare insights into NSO’s operations:
-
Between 2018 and 2020, NSO charged governments $7 million to hack up to 15 devices simultaneously.
-
Cross-border hacking features cost an additional $1–2 million.
-
NSO maintained a 140-person research team with a $50 million budget, some of which was used to exploit smartphone security flaws.
-
Court testimony confirmed customers included Uzbekistan, Saudi Arabia, and Mexico.
Despite NSO’s claim that its software is intended to fight terrorism and crime, human rights advocates, such as Natalia Krapiva of Access Now, labeled the firm a “poster child for surveillance abuses.” She called the ruling a signal to the spyware industry: “There will be consequences if you act carelessly or brazenly.”
Continued Secrecy and Legal Resistance
NSO has indicated plans to appeal the verdict, saying it would pursue all legal remedies. Much of the case remained shrouded in secrecy, with Judge Phyllis Hamilton criticizing the firm for withholding evidence and ignoring court orders. The Israeli government even intervened, seizing documents to prevent their disclosure in U.S. courts.
This case, which reached as far as the U.S. Supreme Court, has been closely watched by privacy advocates, surveillance industry players, and governments worldwide, as it underscores both the legal vulnerability of spyware firms and the growing demand for greater accountability in cyber surveillance practices.