US Judge Bans Israel’s NSO Group From Targeting WhatsApp, Cuts Damages to $4m

A United States judge has handed down a landmark ruling against Israeli spyware firm NSO Group, granting an injunction that permanently bars the company from using its Pegasus software to target WhatsApp users, but dramatically slashing an earlier $168m damages award to just $4m.

District Judge Phyllis Hamilton, ruling in California on Friday, said NSO’s actions caused “irreparable harm” and that “there is no dispute that the conduct is ongoing.” She said the company’s spyware “serves to defeat” one of WhatsApp’s core promises, user privacy.

“Part of what companies such as WhatsApp are ‘selling’ is informational privacy, and any unauthorised access is an interference with that sale,” Hamilton wrote.

Evidence presented at trial showed NSO reverse-engineered WhatsApp’s code, repeatedly rebuilt its spyware to evade detection, and used sophisticated “zero-click” exploits to infect users’ devices without interaction.

Founded in 2010 and based in Herzliya, near Tel Aviv, NSO markets Pegasus as a law enforcement tool against crime and terrorism. But investigations and lawsuits have shown the spyware was used by governments with poor human rights records to monitor journalists, activists, and dissidents.

Meta, the parent company of WhatsApp, sued NSO in 2019, alleging it exploited WhatsApp’s servers to infect users’ phones globally.

Judge Hamilton said the injunction was justified given NSO’s “multiple design-arounds” and the covert nature of its operations.

Will Cathcart, head of WhatsApp, hailed the verdict:

“The ruling bans spyware maker NSO from ever targeting WhatsApp and our global users again. It sets an important precedent that there are serious consequences to attacking an American company.”

Meta had sought to expand the injunction to cover Facebook, Instagram, and Threads, but Hamilton said there was insufficient evidence that NSO had targeted those platforms.

While the injunction was sweeping, the financial blow proved softer. The judge ruled that the initial $168m award was “excessive,” noting there were too few precedents on smartphone-era surveillance to deem NSO’s conduct “particularly egregious.” The damages were therefore capped at a 9-to-1 punitive ratio, reducing Meta’s payout to $4m.