NSO Ordered to Pay $168M to WhatsApp: Implications for Israeli Companies

In early May, a federal court in the Northern District of California ordered the Israeli company  NSO Group to pay USD 168 million to WhatsApp (owned by Meta). This precedent-setting ruling raises fundamental questions about American jurisdiction over foreign companies and about the regulation of defense tech exports.

Background: NSO and US Jurisdiction

NSO Group Technologies is an Israeli cyber-intelligence firm that gained global notoriety for its proprietary Pegasus software for remote surveillance of smartphone users, including through WhatsApp. NSO claims its clients are predominantly government law enforcement agencies combatting major crime, while human rights activists allege dictatorial regimes use the software to spy on dissidents. Against this backdrop, the US Department of Commerce added NSO to its restricted Entity List in 2021.

The lawsuit was filed after a string of US court rulings over the past six years dismissed claims the plaintiffs’ phones were hacked, on the grounds of a lack of personal jurisdiction and forum non conveniens. This was because the plaintiffs were not American citizens and the alleged hacks did not take place on American soil.

However, the American judicial system is sending a clear message with this ruling: entities operating outside of the United States will be held liable if they harm American companies using technological means.

The Allegations

About six years ago, WhatsApp filed a lawsuit against NSO alleging that Pegasus was used to hack into 1,400 cellphones through WhatsApp’s servers in California. WhatsApp accused NSO of violating federal and California anti-hacking laws and of breaching WhatsApp’s terms of service by deploying Pegasus on WhatsApp’s servers.

NSO presented a series of defense arguments. Inter alia, it argued the federal court had no jurisdiction since, pursuant to relevant legislation, to acquire jurisdiction, the court would have to be convinced that NSO purposefully and deliberately accessed servers located in California and obtained information from them. NSO claimed that, although its Pegasus spyware moved through WhatsApp’s servers, no information was taken from the servers and only Pegasus’ clients, and not NSO, hacked and collected information from the targeted end-users’ devices. NSO further argued that WhatsApp suffered no actual damage.

Partial Ruling on the Question of Liability

On December 20, 2024, the federal court issued a summary judgment accepting WhatsApp’s position that NSO Group was liable under California jurisdiction. It only briefly discussed the liability issues raised by the plaintiff. The court’s ruling stemmed primarily from NSO’s failure to cooperate during discovery and its noncompliance with court orders, including to disclose Pegasus’ source code to the plaintiff. NSO argued that Israeli Ministry of Defense directives prohibit it from transferring the source code outside of Israel or to anyone who is not an Israeli citizen. Instead, NSO proposed that WhatsApp’s Israeli lawyers seek to obtain access to the source code, or that WhatsApp request permission from the Ministry of Defense to transfer the source code for the purposes of the hearing. The court rejected NSO’s arguments and proposals as impractical and ruled that it violated the discovery orders issued by the court.

As a result, the court imposed evidentiary sanctions on NSO. It thus accepted WhatsApp’s claims that it could have proven its allegations had it been able to examine Pegasus’ source code. Accordingly, the court also accepted WhatsApp’s claims that the court had jurisdiction because Pegasus used servers and information extracted from WhatsApp’s servers in California for the purpose of hacking into other devices.

The court ultimately issued a summary judgment regarding NSO’s liability and ruled that a jury trial was necessary only to determine the volume of damages.

The Jury Verdict

The jury set the damages caused to WhatsApp as a result of the hack at less than USD 0.5 million but imposed punitive damages on NSO exceeding USD 167 million. The jury’s decision to impose punitive damages apparently derived mainly from testimony it heard regarding various regimes’ use of Pegasus as a key tool for committing human rights violations.

NSO is likely to appeal to the US Courts of Appeals.

Implications for Israeli Companies 

If not overturned on appeal, the fee imposed on NSO is extremely significant. More than 99% of the damages are punitive, while the actual damage caused to WhatsApp is relatively negligible. In other words, a US court has ruled that it has jurisdiction to adjudicate a lawsuit against an Israeli company even for merely indirect damages caused in the United States. Moreover, upon taking jurisdiction, the court then scrutinized NSO’s overall actions, and not only any specific damage caused in the United States.

Cyber surveillance was one of the most dynamic segments of the Israeli high-tech sector over the past decade. However, after several reported incidents of companies committing privacy protection and other statutory violations in various countries and helping governments suppress dissent, they were hit with sanctions and other punitive measures.

This ruling shows that Israeli cyber companies face increased exposure to civil lawsuits in the United States, which could result in payouts of enormous sums. Even when the client is a legitimate democratic country, the very use of the software for controversial purposes may expose a company to lawsuits and cause a chilling effect in its international operations.

Another issue that requires addressing is the activities of high-tech companies under Israeli Ministry of Defense supervision. The Defense Export Control Division supervises exports of defense products to foreign countries, and all such exports require a license. The ruling on the NSO case now raises questions about the Ministry of Defense’s ability to control software exports, and about Israeli companies’ ability to defend themselves against such lawsuits.

Since exports of products that other countries use for security purposes entail material legal issues, companies should obtain legal advice before engaging in international activities.

***

Prof. Amichai Cohen is a special counsel on international law at our firm.

The firm’s International Law Department advises clients on matters involving international trade, national security, Israeli constitutional law, international criminal law, and the application of international law within the Israeli legal system.