A United States court on Friday granted an injunction banning Israeli spyware firm NSO Group from targeting WhatsApp users in a 2019 cyber espionage case, saying that its conduct had caused “irreparable harm”, AFP reported.

However, Judge Phyllis Hamilton of the US District Court for the Northern District of California, in her ruling on Friday, also slashed an earlier amount of about $168 million that the NSO Group was directed to pay in punitive damages to $4 million, Al Jazeera reported.

Hamilton said that the NSO Group’s behaviour fell short of a “particularly egregious” standard needed to support the jury’s calculations in May on the financial penalty.

But the court “concluded that defendants’ conduct causes irreparable harm, and there being no dispute that the conduct is ongoing”, AFP reported.

In late 2019, WhatsApp, owned by US-based technology company Meta, sued NSO Group in the Northern California court for allegedly installing the Pegasus spyware on users’ phones including those of journalists and activists via the messaging app.

The messaging platform has alleged that the NSO Group’s spyware had been used against 1,400 users of the application over a two-week period in April and May 2019.

In December 2024, the judge ruled in the social media company’s favour, holding that the NSO Group illegally used a flaw in WhatsApp to install spyware on users’ phones. The case then proceeded on the question of damages.

In May, the jury ordered the NSO Group to pay WhatsApp $167.3 million, or more than Rs 1,417 crore, in punitive damages in the 2019 case. The jury had also ordered the Israeli firm to pay $444,719, or more than Rs 37 lakh, as compensatory damages.

In her ruling on Friday, Hamilton noted that the NSO Group’s conduct “serves to defeat” one of the key purposes of the service offered by WhatsApp, which is privacy.

“Part of what companies such as WhatsApp are ‘selling’ is informational privacy, and any unauthorised access is an interference with that sale,” Al Jazeera quoted Hamilton as saying.

The court added that the evidence at the trial showed that the Israeli firm reverse-engineered WhatsApp code to “stealthily” install Pegasus on users’ phones, and repeatedly redesigned it to escape detection and bypass security fixes.

Hamilton also said that her broad injunction was appropriate given the NSO Group’s “multiple design-arounds” to infect WhatsApp users, including missed phone calls and “zero-click” attacks, as well as the “covert nature” of its work more generally, Al Jazeera reported.

In its petition, Meta had also asked the court to extend the injunction to its other products, including Facebook, Instagram and Threads. However, the judge said there was not enough evidence for her to determine if similar harms were being done on the other platforms.

In her ruling, Hamilton said that the initial award of $168 million against the NSO Group for damages to Meta in May was excessive.

“There have simply not yet been enough cases involving unlawful electronic surveillance in the smartphone era for the court to be able to conclude that defendants’ conduct was ‘particularly egregious’,” Al Jazeera quoted the ruling as saying.

The judge said that the punitive damages ratio should be “capped at 9/1”, which reduced the initial amount to $4 million, or about Rs 35 crore.

On Saturday, Will Cathcart, the head of WhatsApp, said that the judgement banned the NSO Group from ever targeting WhatsApp and its global users again.

“We applaud this decision that comes after six years of litigation to hold NSO accountable for targeting members of civil society,” Cathcart said on social media. “It sets an important precedent that there are serious consequences to attacking an American company.”

When added to an electronic device, the Pegasus software can generally gain access to phone calls, emails, location information, encrypted messages and photographs without the user’s knowledge.

The spyware is licensed to governments around the world by the NSO Group. The cyber intelligence company says it sells the Pegasus software only to “vetted governments” with good human rights records and that it is intended to target criminals.

However, in July 2021, an investigation by a group of 17 media organisations and human rights group Amnesty International showed that Pegasus spyware was being used for the unauthorised surveillance of journalists, activists and politicians across the world, including in India.

In India, Congress leader Rahul Gandhi, former Election Commissioner Ashok Lavasa, Union ministers Ashwini Vaishnaw and Prahlad Singh Patel, industrialist Anil Ambani and former Central Bureau of Investigation Director Alok Verma were among the potential targets, The Wire had reported.

The Indian government had denied these allegations. Vaishnaw, the Union information technology minister, told Parliament in July 2021 that illegal surveillance was not possible in India.

Following the reports, the Supreme Court appointed an expert committee to look into the allegations. In August 2022, the court said that some malware was found on five of the 29 phones that the panel examined. However, it was not clear whether the malware was Pegasus.

On April 29, the Supreme Court held there was nothing wrong with India possessing spyware for national security purposes, but expressed concern about its alleged misuse against private individuals.

The US government blacklisted the NSO Group in November 2021 after it determined that the company had acted “contrary to the foreign policy and national security interests of the US”.

WhatsApp hacking case

In her December 2024 judgement, Hamilton had said that NSO Group violated sections of the Computer Fraud and Abuse Act and the California Computer Data Access and Fraud Act.

The Computer Fraud and Abuse Act is a federal legislation that criminalises unauthorised access to computers, networks and other digital information. The California Computer Data Access and Fraud Act is the state equivalent of the same law.

Hamilton also said that the Israeli firm violated WhatsApp’s terms of service.

In March 2024, Hamilton ordered the Israeli firm to hand over the code of Pegasus and its other spyware products to WhatsApp as part of the legal proceeding.

The judge said in December 2024 that the NSO Group had dragged its feet throughout the litigation and noted that the company repeatedly failed to comply with the court’s orders, The Guardian reported.

The Israeli firm made its code for its spyware available to view only in Israel by an Israeli citizen even though the lawsuit was filed in California, Hamilton said in her ruling, adding that this was “simply impracticable”.

Also read: Why US court’s fine on Israeli firm operating Pegasus is an indictment of the Indian Supreme Court

📰 Crime Today News is proudly sponsored by DRYFRUIT & CO – A Brand by eFabby Global LLC

Design & Developed by Yes Mom Hosting