Jury orders NSO to pay $167M for hacking WhatsApp users

223 Bender 126 5/7/2025, 12:54:19 AM arstechnica.com ↗

Comments (126)

IG_Semmelweiss · 1d ago
Not sure if this is too little, too late. The israeli cyber-intelligence firm primarily known for its proprietary spyware Pegasus, employed almost 500 people as of 2017 [1] . However, the US govt included NSO Group in its Entity List for acting against U.S. national security and foreign policy interests, effectively banning U.S. companies from supplying NSO [1]

This makes me think that NSO is effectively frozen out of the US banking network, and therefore the whatsapp judgement is ineffective to go after US assets in US jurisdictions. So, no disgorgement outside of what banks may have frozen before this lawsuit (if anything) as a result of the Entity list addition.

[1] https://en.wikipedia.org/wiki/NSO_Group

cedws · 23h ago
Given that the NSO Group is supported by the Israeli government and their weapons have been used against US civilians, and US-aligned individuals, you would think there would be much heftier consequences.
rafale · 22h ago
They knowingly attacked and destroyed USS Liberty in 1967 and didn't face any consequences.

Sometimes I wonder what's so special about Israel that they keep getting away with everything.

rozap · 12h ago
Or exfiltrating enriched nuclear material from NUMEC in the US to get their weapons program underway (Apollo affair) in 1976, or violating the nuclear test treaty off the coast of South Africa (Vela incident) in 1979, or blackmailing Clinton in 1998 (Jonathan Pollard incident). Or any number of other things. And these are just the things we know about.

But we know why they are special and get away with things that any other country would be in serious shit for. AIPAC does not fuck around. They play to win. And the evangelicals support it because of their belief about the second coming of christ.

jazzyjackson · 11h ago
Fine, not wrong, but you missed the rather heavy factor of the western powers feeling they owe a huge debt to the Jewish people for turning their boats back during the Holocaust. It's a "no one helps you til you help yourself" scenario, now that a state exists with a mission to give Jews safe refuge and self governance, they have (some of) the world's sympathy.

its not merely because of a few lobbyists and evangelicals' wacky eschatology

ratg13 · 6h ago
The heavy factor is all of the spying.

At one point Israel even handled all of the wiretaps for the US.. so if a US government agency needed a wiretap, it would have to go through Israel.

Then there's the active spying..

Stuff like this: https://www.theguardian.com/education/2002/mar/06/internatio...

And when they get caught, nothing ever happens

megous · 6h ago
No sympathy to anyone who justifies destruction of entire cities (like this https://x.com/SuppressedNws/status/1920242384111055286) as self-defense. Even in my small disgusting genocide supporting country in the center of europe, things are slowly starting to change at this point.
gruez · 18h ago
>They knowingly attacked and destroyed USS Liberty in 1967

Both sides agree it was an accident.

>Israel apologized for the attack, saying that USS Liberty had been attacked in error after being mistaken for an Egyptian ship.[5] Both the Israeli and United States governments conducted inquiries and issued reports that concluded the attack was a mistake due to Israeli confusion about the ship's identity.[6]

bn-l · 15h ago
The survivors themselves say it was deliberate.
Gud · 18h ago
And if you scratch the surface, you will quickly realise that their apology is bullshit.

Israel wanted the US involved and conducted a false flag operation:

“Some intelligence and military officials dispute Israel's explanation.[79] Dean Rusk, U.S. Secretary of State at the time of the incident, wrote: I was never satisfied with the Israeli explanation. Their sustained attack to disable and sink Liberty precluded an assault by accident or some trigger-happy local commander. Through diplomatic channels we refused to accept their explanations. I didn't believe them then, and I don't believe them to this day. The attack was outrageous.[80]”

https://en.m.wikipedia.org/wiki/USS_Liberty_incident

gruez · 17h ago
>I was never satisfied with the Israeli explanation. Their sustained attack to disable and sink Liberty precluded an assault by accident or some trigger-happy local commander.

If the attack was due to mistaken identity, wouldn't you expect the Israelis to go all out? I also skimmed the section and there's not much in the way of arguments besides that and "Israel pressured US to admit it was an accident".

clown_strike · 8h ago
There was no mistaken identity. They knew it was an American ship and attacked it on purpose. It was witnessed and documented that they made the decision to deliberately attack an American warship, then tried to excuse themselves from responsibility.

They were targeting lifeboats and engaging in other dishonorable behavior we've since seen repeated in Gaza as well. "Going all out" is not warfare, it is sadism in violation of the Geneva Convention.

https://web.archive.org/web/20211111095447/https://www.haare...

gruez · 4h ago
>There was no mistaken identity. They knew it was an American ship and attacked it on purpose. It was witnessed and documented that they made the decision to deliberately attack an American warship, then tried to excuse themselves from responsibility.

What evidence is of this? The article you linked only has an "anonymous source", and hearsay supposedly from a diplomat. If this is the bar for believing that a conspiracy is real, you should probably believe the moon landing is faked as well.

wkat4242 · 18h ago
There's also many voices saying it was a coverup.
gruez · 18h ago
The same could be said of the JFK assassination, or the moon landing.
carlosjobim · 17h ago
The moon landing was a cover up for what?
Loughla · 16h ago
Not having happened. Not a cover up for something else. Just that it didn't happen, but the US was so hard up to beat the Russians at something that they staged it.

It's ridiculous. But the world we live in is also ridiculous, and the internet has enabled idiots to meet in numbers that have never been possible before.

SAI_Peregrinus · 15h ago
To cover up that the moon doesn't exist, of course.

I'm sure we can come up with a ridiculous conspiracy hypothesis around what we're actually seeing when we think we're seeing the moon. Might need to involve time travel to explain historical records.

clown_strike · 7h ago
They begrudgingly paid restitution for the Liberty decades later.

> Sometimes I wonder what's so special about Israel that they keep getting away with everything.

A doctrine of full spectrum dominance, lack of ethical constraints and aggressive propagandizing would make anyone unstoppable.

logicchains · 22h ago
What's so special? A good chunk of the US population believes the Israelis were literally chosen by God over 2000 years ago to occupy that piece of land, and they're obligated to do whatever they can to help them.
swat535 · 16h ago
> A good chunk of the US population believes the Israelis were literally chosen by God

There is more to it, not only that but they believe that the Jewish state of Israel is needed for Jesus to return to earth.

This belief comes from Thessalonians 2:1-4

"1 Now concerning the coming of our Lord Jesus Christ and our being gathered together to Him, we ask you, brothers, 2 not to be easily disconcerted or alarmed by any spirit or message or letter seeming to be from us, alleging that the Day of the Lord has already come. 3 Let no one deceive you in any way, for it will not come until the rebellion occurs and the man of lawlessness—the son of destruction—is revealed. 4 He will oppose and exalt himself above every so-called god or object of worship. So he will seat himself in the temple of God, proclaiming himself to be God."

So the "temple" is required for the anti-Christ to arise, and for Jesus to return.

Now as to if that actually means the physical Third Temple of Solomon... this is up for theological debate. Some Church Fathers held that the anti-Christ would indeed arise from a physical Third Temple. While other Church Fathers held that the 3rd Temple in Christianity was technically the Church, and so the anti-Christ would arise from her.

Either way, if you side with the first view there is no qualification for a state to be present in order to rebuild the physical Third Temple.

Protestant Evangelicals in America by and large take the first stance I mentioned, and are pretty stalwart in their belief the State of Israel is the vehicle through which this will be achieved.

ImJamal · 14h ago
They invented this view in the 1800s. Christians prior to this universally considered it a heresy.

For those who want additional information, it is called dispensationalism.

mistrial9 · 8h ago
references to a Temple involve a holy Temple that is not possible on this Earth, also coinciding with physical structures that make it possible to emerge?

Evangelical beliefs and others start to be more of a political topic, subject to survey? A basis of the practice is that it is done in the open and lawfully, so Church leaders might be fairly plain about what they actually believe, when asked?

late2part · 20h ago
The same chunk of population "should" (??) think that the Israeli ancestors killed Jesus, and that the Jews will go to hell if they don't accept Jesus as their savior - so - people are weird.
dragonwriter · 14h ago
They do; they have other theological reasons for supporting the State of Israel, despite often not being very well inclined toward the Jewish people or Judaism as a religion.

https://en.m.wikipedia.org/wiki/Christian_Zionism

InsideOutSanta · 17h ago
Surprisingly, it's internally consistent. Evangelical Christians don't support Israel because they like the people who live there. Instead, they support Israel because, based on their interpretation of Revelation 20, they believe that Israel must be rebuilt or restored as part of God's plan for the end times.

This story does not end well for Israel or the people who live there.

graemep · 16h ago
I am not no expert on the American evangelical version of Christianity so happy to hear better explanations, but not all evangelicals believe the same things so I do not think there is a reason to say they "should" believe those things. The argument that God's covenant with the Jews is still in effect implies the opposite, if anything.

It looks to me that it is correlated with whatever this survey defines as "traditionalist": https://www.pewresearch.org/religion/2005/04/15/american-eva...

Traditionalist applies across denominations with different traditions and theology so no idea whether it has a consistent meaning.

weatherlite · 14h ago
Well in that case they "should" also believe that Jesus was Jewish just like the Israelis of today, no? If Israelis are blamed for killing him they should also be praised for creating him.

No comments yet

markus_zhang · 21h ago
The neo crusader kingdom?
graemep · 17h ago
There is no similarity at all between Israel and the crusader kingdoms: different historical circumstances, different aims.
markus_zhang · 17h ago
Some guys àrrived in the middle of that land and beat the hell of others and built a kingdom. Sort of the same.
graemep · 16h ago
That is a mischaracterise of the crusades, at least with regard to the crusaders.

The crusades were a reaction to the Arab and Turkish Empires, which by then (between them) invaded at some point (and mostly conquered) Spain, France, southern Italy, most of the Mediterranean, North Africa, Italy, Anatolia, and the Levant, and more.

I had not noticed the Palestinians aggressive expansionist empire.

BobaFloutist · 12h ago
If I had a nickel for every time that happened in Israel...
weatherlite · 14h ago
Yeah that's the story of the West
tuyguntn · 21h ago
I also wonder about this, my personal conclusion is israelis work very hard to create a dirt on politicians over the years, and politicians just afraid of losing everything in one day vs joining the club of other blackmailed, powerful politicians. cases: Epstein, Monica Lewinsky, AIPAC, and probably many more

No comments yet

jona-f · 21h ago
US's legitimization of it's leading role in the world is based on the story how they saved the world from the nazis. This story escalated ideologically, so now any critique of Israel is indirectly questioning USA as the world leader.
graemep · 16h ago
I do not think so. Not outside the US anyway.

The legitimisation lies in the alternatives having been (historically) the Soviet Union, and (now) China.

krageon · 16h ago
In any practical sense the Soviet Union did in fact do the lion's share of beating the Nazis. They opened an extra front and sent in a staggering amount of troops. I don't see why it is still so demonized, except when you view it directly through the lens of US propaganda.

Their death toll, such as it is, is not even a tenth of the incredible casualty rate of the British. It does not need to be said that they're nowhere near as demonised, except in India. The scope and depth of a civilisation's deaths is not actually all that relevant to how much people hate it.

nrml_amnt · 13h ago
Molotov-Ribbentrop is not US propaganda.
OsrsNeedsf2P · 1d ago
Not sure how I feel about this - on one hand the NSO Group happily sold this exploit to absolutely horrible clients[0], but on the other, app security shouldn't depend on legal enforcement.

[0] https://www.theguardian.com/news/2021/jul/18/revealed-murder...

JumpCrisscross · 23h ago
> app security shouldn't depend on legal enforcement

Why not? There are significant negative externalities to not enforcing cybercrime laws.

lazide · 20h ago
I think they meant solely depend on legal enforcement.

For the same reason banks should have a decent vault for cash they aren’t using at this exact moment, since they shouldn’t just depend solely on any robbers getting caught.

bloppe · 19h ago
It's not like hacking WhatsApp was that easy. If it were, NSO wouldn't be able to sell it's exploits for so much
walterbell · 1d ago
> app security shouldn't depend on legal enforcement

EU Cyber Resilience Act (CRA) will soon impose legal security requirements on a wide class of software binaries sold in the EU.

vkou · 1d ago
Just because locks can be defeated by five seconds and a lockpick gun doesn't mean that the housebreaker, his fence, or his getaway driver is absolved of their responsibility.
TZubiri · 1d ago
Of course law plays a huge part in computer security.
knorker · 1d ago
As is constantly being made abundantly clear from blockchain stuff, code cannot make legal systems obsolete.

No crime in the world can be made physically impossible. Why would hacking be any different?

walterbell · 1d ago
firefax · 19h ago
Below are the Internet Archive copies, since Facebook doesn't have the greatest track record on stable URLs.

(I reregistered recently and was banned for being "inauthentic" -- the URL they linked to which was supposed to detail what part of the policy I broke was broken.)

https://web.archive.org/web/20250506235016/https://about.fb....

https://web.archive.org/web/20250506235104/https://about.fb....

https://web.archive.org/web/20250506235302/https://about.fb....

https://web.archive.org/web/20250506235441/https://about.fb....

jimnotgym · 23h ago
Shouldn't we be seeing criminal sanctions? If I sold app exploits I would be in jail
voxic11 · 16h ago
Selling exploits is generally legal. What law would be used to put you in jail? Using exploits can fall under the Computer Fraud and Abuse Act's criminally prohibited conduct but afaik there is no similar law that covers distributing/selling exploits. In fact selling exploits to companies via their bug bounty programs is quite common.

All that said NSO didn't just distribute/sell the exploits (that would be giving away their secret sauce). Instead they offered what was essentially a managed service for executing the exploits against user selected targets.

4oo4 · 15h ago
Wouldn't hosting a service to facilitate others' use of the exploits fall under CFAA? Since there have been numerous arrests for those hosting Ransomware-as-a-service, DDOS-as-a-service, etc. Just curious whether there is a legal nuance that prevents them from being criminally charged instead of just politics/diplomacy.
advisedwang · 11h ago
The Computer Fraud and Abuse Act has a conspiracy provision. If NSO sells an exploit to someone, they can be charged for any downstream hacking that happens.
saagarjha · 21h ago
Depends on who you sell them to
razakel · 21h ago
You're not a three-letter agency, though.
jimnotgym · 21h ago
NSO is not a three-letter agency, it is a private company
razakel · 20h ago
One of the founders is ex-Mossad.
bloppe · 19h ago
Which is obviously 6 letters
rabid_turtle · 14h ago
NSO is very cozy with Israel intelligence. It being private gives it the legal ability to do things that a government agency could not.
nashashmi · 1d ago
Israel defense green lights the sale and use of Pegasus software. https://www.nytimes.com/2022/01/28/magazine/nso-group-israel...
Glyptodon · 1d ago
I wonder about the other end of liability - if the app was so broken that merely calling a phone with it could lead to a back, it seems like users might reasonably also blame its authors.
aitchnyu · 23h ago
I've been thinking about requiring iMessage and other codebases in memory unsafe languages to be built by WASM compiler with the objective of being memory safe and minimal performance loss.
Meekro · 1d ago
Unfortunately, the smartest programmers in the world (people like Linus Torvalds) sometimes screw up and create security issues. If Linus can't get it 100% right, what hope is there for the rest of us?
Alex_001 · 1d ago
This feels like one of the rare moments where there's actual financial accountability for spyware abuse — but is $167M even close to meaningful for a company like NSO, backed by deep-pocketed clients?
ebfe1 · 22h ago
Ok ....where is the form so as an ex-whatsapp user, I can get a piece of that 167M pie? Oh... there isnt one... :)
autoexec · 10h ago
This is a great day for people who can make more than $167M by hacking whatsapp users! On the off chance that they happen to be caught in the first place they now know what their profit margins will look like after Facebook goes to court to take their cut.
b8 · 19h ago
They're based in Israel, so it's unlikely they'll pay. It's interesting that Zerodium has slowly stopped their gears (at least publicly) even though the USG was buying their exploits to target HVTs. It's like when the DOJ posts an arrest warrant for a Russian or a Chinese military official, it's mainly for show.
bn-l · 15h ago
It’s amazing how much justice you can get when you are a billion dollar company

> The jury also awarded WhatsApp $444 million in compensatory damages.

jeisc · 23h ago
spying software should be illegal to sell under any circumstance the people who need these programs should be writing them themselves not buying them off the shelf
bell-cot · 23h ago
The same argument could be made about conventional arms.

Unfortunately, 99% of nations prioritize having quick & easy access to weapons.

And for many nations, selling weapons is also a lucrative way to exert influence.

palata · 23h ago
> Unfortunately, 99% of nations prioritize having quick & easy access to weapons.

What?

bell-cot · 19h ago
Re-read user jeisc's comment.

There are 200 or so nations on our planet.

How many of those nations have governments which believe that their own army, air force, & navy should be unable to buy (say) guns, bombs, and torpedoes? Vs. having to hire engineers to design them, then build weapon factories, then build all of their own weapons.

My assertion is that zero-ish of those governments want such legal restrictions.

(And obviously, actual legal restrictions on the sale of spyware might be similarly unpopular, with the people who actually write the our world's laws.)

palata · 8h ago
Oh right, I see what you mean.

Still, I believe there is a difference. First, it feels like anyone willing to pay enough will convince NSO to "help" them. It's not the same with firearms (in 99% countries in the world): you can't just pay a private company to go rob a bank with firearms.

Then for the police and the military, it's usually restricted to professionals. In my country, if a police officer gets their gun out (I'm not talking about firing), an investigation follows. If they fire their gun, a bigger investigation follows, they make the news, and the officer may lose their job (or be affected to a desk job for the rest of their career).

It seems a lot easier to get access to NSO than to actually fire a gun, and to me that's a good thing. I don't want a police like in the US. To the point where I do believe that it should be as hard to access NSO as it is to use firearms.

FirmwareBurner · 22h ago
Your police and military where you live doesn't have easy access to weapons?
palata · 22h ago
I wouldn't call it easy, no.
FirmwareBurner · 22h ago
How would you call it?
rpgwaiter · 1d ago
I wonder what percentage of that $167M will go to the ~1400 victims of this hack (that we know about)
nashashmi · 1d ago
None. WhatsApp has stated it will give to a privacy advocacy organization
Pesthuf · 13h ago
Whose urgent warnings on privacy concerns will be ignored by everyone, as usual.
TZubiri · 1d ago
0? I understood that the plaintiff is what'sapp. Not sure if it's for damages or punitive.

The victims are probably not citizens of the US so they would be outside of this jurisdiction. That's between those two countries. The reason it's going to the US court is because it occured in US cyberturf (Meta's servers)

TZubiri · 1d ago
This looks like a pretty spicy political bomb. I wonder if the group will pay, I'm assuming they won't, if they do it's because the Israeli government intervened and bailed them out. They are fighting a war after all.
aussieguy1234 · 1d ago
Who gets the damages here, Meta or the hacking victims?
saagarjha · 21h ago
Meta who says they will donate it to digital rights organizations.
notepad0x90 · 21h ago
I'm on NSO's side here. It's quite hypocritical of everyone involved to be against NSO but not gun makers. I don't even want to touch civilians abuse of guns, just governments buying guns from weapons manufacturers and using them in properly sanctioned wars. People are acting like exploits are more dangerous than bullets or restricted like nuclear, biological and chemical weapons, they are not!

The demand is there and the suppliers exist. without companies like NSO, the price of exploits goes up and it becomes more lucrative for malicious actors to sell them to even more nefarious actors. The exploit brokers become more anonymous. And when they sell to the really bad actors, it will require deanonymizing market places on Tor instead of having law suits like this.

It is much better for everyone involved to tolerate companies like NSO and regulate them.

dqv · 21h ago
> It is much better for everyone involved to tolerate companies like NSO and regulate them.

That's what this is. That's what a lawsuit is. This is them being regulated. They aren't being ordered to shut down, they're being ordered to pay damages.

notepad0x90 · 17h ago
no, there is no regulation or law for what they do. This is a civil suit between two companies, it is not a regulation. had they actually violated the law, it would have been a criminal prosecution. civil damages are not government regulation. if you can simply be anonymous, you won't even break the law as you sell to any party.
dqv · 15h ago
> no, there is no regulation or law for what they do

Yes, there is: the CFAA. Corporations and the government have even weaponized criminal complaints against individuals under the law.

> This is a civil suit between two companies, it is not a regulation

The venue in which regulation is enforced does not change its status as a regulation. The distinction between criminal and civil is irrelevant here. (Notwithstanding the possibility of a corrupt judge) Meta would not have been able to continue their suit had there not been a regulation.

> had they actually violated the law, it would have been a criminal prosecution

No, had a prosecutor wanted to pursue an indictment, it would have been a criminal prosecution. A prosecutor's willingness to enforce a law and bring trial is at their discretion. In the same way that charges don't necessarily indicate criminality, a lack thereof doesn't necessarily indicate the absence of wrongdoing.

> civil damages are not government regulation.

Civil laws are regulation. The judge is the regulating authority who enforces the penalty for being out of compliance with those laws, which comes in the form of ordering money damages in this situation.

> if you can simply be anonymous, you won't even break the law as you sell to any party

Yes and maybe the fact that they're anonymous brings it it to the level of criminality in a prosecutor's eyes. That desire to conceal their identity could the turn preponderance of the evidence (civil) into beyond a reasonable doubt (criminal).

Or it could always stay in the civil system. The criminal system is political just like anything else. See above.

notepad0x90 · 5h ago
CFAA is criminal law with specific parameters. the accused must have attempted or conspired to attempt to bypass a restricted system. Demonstrating how to steal money from a bank vault for example is not a crime, neither is teaching others how to do so for a fee or providing them with tools that can aid them in that endeavor. Especially when the other party is a government, it is reasonable to assume they will operate within the bounds of their own law. Red teamers, pentesters, security researchers, security training providers couldn't exist if the CFAA prohibited this. It isn't like their customers come to them and ask "hey, we're gonna spy on a journalist, can we buy pegasus". At the very least, it needs to be established that it is reasonable to presume pegasus will be used to break a law, it could be used for lawful reasons (which exist) and I'm sure they'll make their clients sign waivers to protect themselves fro such presumption.

Anonymity isn't a crime (at least not yet), and it alone cannot be used to presume criminal intent. It isn't a crime to offer services anonymously. Perhaps not paying your taxes (if income could be proven) is something they can go after (and fail).

The civil system can be used, if it is the government that is the plaintiff. Random companies suing is not enforcement since companies act in their interest, not in the interest of public policy and regulation. Waiting for events that align with corporate interests is not regulation, it is coincidence.

sureglymop · 21h ago
I think your last sentence is key. The NSO as far as I'm aware to targets people on an individual level.

It's not hard to phish and hack a single individual as a large organization. It's just a matter of resources and slipping up eventually. With that being said, the exploits they find are interesting and I wish they would publish them in a white hat manner instead.

ktallett · 21h ago
It isn't an either or scenario, NSO can be in the wrong and rightfully fined and weapons can also be sold by governments to the wrong parties. The latter should be regulated as well, not the former being let off as well. Demand shouldn't always equal supply.