WhatsApp Receives $170 Million Judgment Against Israeli Spyware Company NSO Group

Article Comments
1

Originally published at: WhatsApp Receives $170 Million Judgment Against Israeli Spyware Company NSO Group - TidBITS

At Politico, Maggie Miller writes:

Israeli spyware company NSO Group was ordered by a U.S. federal court on Tuesday to pay WhatsApp and its parent company Meta almost $170 million in damages after its cyber tools were used to hack around 1,400 WhatsApp accounts.

NSO Group has become the poster child in recent years for the mostly underground spyware market, used increasingly by governments to surveil dissidents, journalists and politicians. The ruling, the latest step in a process that began in 2019, is a major win for privacy advocates and those pushing back against NSO Group’s controversial Pegasus software.

In September 2024, Apple dropped its suit against NSO Group, citing concerns that its threat-intelligence protections disclosed in the case could be compromised, that a legal win would have limited effect given the spyware industry’s expansion, that various governments were working together to counter the misuse of spyware, and that discovery might ultimately fail (for background on the original case, see “Apple Lawsuit Goes After Spyware Firm NSO Group,” 24 November 2021). As much as Apple’s decision leaves a bad taste in the mouth, it may have been the better part of valor.

Despite these concerns, WhatsApp’s parent Meta stayed the course and now stands to collect around $167 million in punitive damages and $440,000 in compensatory damages. NSO Group will, of course, appeal. Even if Meta prevails, collecting from an Israeli company that has enjoyed political protection from the Israeli government and may be on shaky financial footing presents significant challenges. Meta isn’t wrong when it says it has “a long road ahead to collect awarded damages.”

What’s puzzling is how Meta seems to tie the success of that collection to its following statement: “Ultimately, we would like to make a donation to digital rights organizations that are working to defend people against such attacks.” It’s unfortunate that Meta’s meager $16.6 billion in Q1 2025 profit leaves it unable to support digital rights organizations unless it first collects from a financially imperiled Israeli spyware vendor.

2 Likes
2

I would think that it’s karmic justice that a spyware vendor is financially imperiled.

2 Likes
3

It struck me:
If WhatsApp is not safe;

  • then … maybe Instagram, FB-Messenger & Facebook iOs Meta-apps are unsafe too?

end if
:thinking:

4

Huh! NSO Group has been acquired by a U.S. investment group led by a Hollywood producer.

But that’s not actually the weirdest part. It turns out that ownership of the company has changed hands several times, including two instances involving U.S.-based investment groups.

Originally founded by Niv Karmi, Shalev Hulio, and Omri Lavie, NSO Group was acquired by U.S. private equity firm Francisco Partners in 2014. Lavie and Hulio retook control of the company in 2019 with help from European private equity firm Novalpina. Then, in 2021, the California-based Berkeley Research Group took over management of the fund. In 2023, Lavie retook control of NSO as majority owner.

In fact, when Apple filed its now-dropped lawsuit against NSO Group in November 2021, it seems likely that the company was owned by the Berkeley Research Group.

I have no idea what to make of any of this, including what it implies for the Meta judgement.

5

One possibility that may seem far fetched, at first, is that the private sector firm is a front for an intelligence agency. This actually isn’t uncommon, with these perhaps the best known examples that have been revealed:

https://www.smithsonianmag.com/history/during-cold-war-ci-secretly-plucked-soviet-submarine-ocean-floor-using-giant-claw-180972154/

And recently, the exploding pager exploit.

6

It’s as good an explanation as anything else!