A California jury has awarded Meta more than $167 million in damages from Israeli surveillanceware slinger NSO Group, after the latter exploited a flaw in WhatsApp to allow its government customers to spy on supposedly secure communications.

In May 2019 engineers at WhatsApp discovered a zero-click, zero-day vulnerability in the Meta-owned chat platform that would allow an attacker to install malware on a device with just a single phone call and no requirement on the victim to do anything other than have their handheld switched on. The surveillanceware in question was Pegasus, developed by the NSO Group.

Pegasus is carefully designed to use zero-day vulnerabilities to infect handsets, ideally without any user interaction. Once on a phone, it has access to all and any data the devices contain, including phone records, emails, messages, and video, as well as the location of the device. It can even let its operator turn on the handset’s camera and microphone for clandestine recording.

Pegasus compromised around 1,400 WhatsApp accounts, and WhatsApp’s engineers patched the flaw within days. But it’s very unwise to f**k with billionaire Meta supremo Mark Zuckerberg; he unleashed the lawyers, who filed a lawsuit against NSO that October. On Tuesday, after less than two days of consideration, the eight-person jury handed out a fine that amounts to nearly three times NSO’s annual R&D budget, according to Meta’s estimates.

In an extra twist of the knife, the company formerly known as Facebook is sharing transcripts of NSO executives’ court depositions on its PR website, “so that these records are available to researchers and journalists studying these threats and working to protect the public.” The mega-corp added, “We intend to add official court transcripts once they become available.”

In a statement to The Register, Meta warned of the continuing threat from the super spyware. “While we stopped the attack vector that exploited our calling system in 2019, Pegasus has had many other spyware installation methods to exploit other companies’ technologies to manipulate people’s devices into downloading malicious code and compromising their phones.”

The statement continued, “NSO was forced to admit that it spends tens of millions of dollars annually to develop malware installation methods including through instant messaging, browsers, and operating systems, and that its spyware is capable of compromising iOS or Android devices to this day.”

Meta thanked the Canadian nonprofit Citizen Lab for its help in investigating Pegasus. The social networking giant also pledged that if and when NSO Group pays up, it will donate the funds – which amount to 21 hours of profit in its last quarter – to digital-rights groups.

“For a long time there were a handful of us doing mercenary spyware research,” said John Scott-Railton, a senior researcher at Citizen Lab.

“Having WhatsApp independently do serious investigating and publicly attribute hacking to NSO Group was huge for helping the rest of the world see the severity of the issue. Thankfully, today this has changed.”

Oh what a tangled web we weave

NSO Group has been fighting Meta’s lawsuit tooth and nail, and has tried a variety of different legal tactics in the long case. Meta alleged among other things that NSO broke computer abuse and trespass laws.

The spyware maker lost an initial judgment by default when it failed to show up in court, after claiming Facebook hadn’t delivered legal documents on time. It also accused Facebook of hypocrisy, claiming executives had approached NSO Group to use its surveillanceware to spy on its own customers.

Next up, NSO argued Facebook couldn’t sue it as the software maker only sold to governments, it didn’t operate in the US, and so had legal immunity. However, it then came out that a sister company to NSO Group, Westbridge, was caught trying to sell Pegasus to US police.

By 2020 the judge gave a green light for the case to begin in earnest and the discovery process began, allowing the first official glimpses into how NSO was running its operations. A year later, NSO Group tried to claim sovereign immunity yet again – only to be shot down in court.

In November 2021 Apple joined Meta in suing the NSO Group, calling the business “amoral 21st century mercenaries.” The case was based around reports that Pegasus was being used to spy on iPhone users and had been found on US, EU, and UK government devices. A lawsuit also claims that the Saudi Arabian government used it to spy on journalists who disagreed with the monarchym, such as the assassinated journalist Jamal Khashoggi. (NSO denied this.)

The US Supreme Court snubbed NSO Group’s last-gasp bid at claiming sovereign immunity in 2023, and the case continued. During the discovery process, NSO was forced to cough up its crown jewels – the source code for Pegasus – so Meta could see it.

Last year, a judge finally found the surveillanceware slinger guilty, and the jury sat down on Monday to decide what the penalties should be. Meta’s lawyers suggested that the NSO Group’s research budget was $60 million, and so that might be a figure to consider. The jury took less than two days to decide they would like a more punitive fine.

In a statement to The Register, the NSO Group said it was considering going back to court to argue for a more favorable decision.

“Today’s jury decision marks another step in a lengthy judicial process. We firmly believe that our technology plays a critical role in preventing serious crime and terrorism and is deployed responsibly by authorized government agencies,” it said.

“This perspective, validated by extensive real-world evidence and numerous security operations that have saved many lives, including American lives, was excluded from the jury’s consideration in this case. We will carefully examine the verdict’s details and pursue appropriate legal remedies, including further proceedings and an appeal.” ®