NSO Group Challenges $167 Million Spyware Damages Award

In a landmark ruling in May, a jury ordered spyware maker NSO Group to pay $167 million in damages to WhatsApp for a 2019 hacking campaign that targeted over 1,400 individuals. This verdict marks a significant legal victory for WhatsApp and a stern rebuke of NSO’s invasive surveillance practices.

However, NSO Group has vehemently opposed the ruling, labeling the damages as “outrageous,” “blatantly unlawful,” and “unconstitutionally excessive.” The company has filed a motion requesting either a new trial or a reduction in the damages through a legal procedure called remittitur, which allows courts to lower excessive verdicts.

NSO’s legal team argues that the punitive damages awarded exceed legal limits, specifically the rule that punitive damages should not surpass four times the compensatory damages. In this case, compensatory damages were approximately $445,000, making the $167 million punitive award disproportionate by many orders of magnitude.

The company further contends that the jury’s decision was influenced by a desire to financially cripple NSO due to general hostility toward its business rather than the specific illegal conduct at issue. NSO also claims the damages exceed its ability to pay, framing the verdict as punitive beyond reason.

WhatsApp, represented by spokesperson Margarita Franklin, has vowed to continue its legal battle to hold NSO accountable. Franklin emphasized that NSO has tried to evade responsibility for six years and that the company will seek a permanent injunction to prevent further spyware attacks on WhatsApp users.

This case highlights the growing legal and ethical scrutiny spyware companies face amid rising concerns over privacy and cybersecurity. It also underscores the challenges in balancing punitive damages to deter harmful conduct without imposing financially crippling penalties that could stifle legal recourse.

For organizations navigating cybersecurity risks, the NSO Group case serves as a cautionary tale about the consequences of deploying intrusive surveillance tools. It also signals the judiciary’s willingness to impose significant penalties to protect user privacy and corporate integrity.

As spyware threats evolve, companies must prioritize robust security measures and legal compliance to mitigate exposure. Meanwhile, legal battles like this one will shape the future landscape of cybersecurity accountability and corporate responsibility.