NSO appeals WhatsApp decision, says it can’t pay $168 million in ‘unlawful’ damages

The NSO Group has filed an appeal in response to a jury’s $168 million award to WhatsApp last month for the spyware manufacturer’s alleged role in allowing government clients to infect some 1,400 phones with its zero-click surveillance technology.

NSO asked the Northern California federal judge who oversaw the five-year trial to either drastically reduce the $167.2 million in punitive damages the jury awarded WhatsApp or greenlight a new trial, according to a Thursday court filing.

The surveillance product allegedly used against the WhatsApp users, Pegasus, has been found on devices belonging to members of civil society worldwide for years, proving NSO’s clients widely abuse the technology.

A spokesperson for NSO declined to comment.

A WhatsApp spokesperson said the appeal is “another expected attempt to claim impunity, in response to a strong message from the jury of US citizens deciding to punish NSO for its 2019 illegal attack against an American company and its users.”

The money the jury awarded to Meta-owned WhatsApp on May 6 “grossly exceeds NSO’s ability to pay,” according to the spyware company’s filing. In addition to the $167.2 million punitive damages, NSO also was ordered to pay $445,000 in compensatory damages.

The spyware manufacturer argues in the filing that punitive damages should not exceed the compensatory damages.

NSO says Supreme Court precedent shows that punitive damages should be assessed at no greater than a 4-to-1 ratio compared to compensatory damages, which in this case would justify a maximum award of roughly $1.77 million.

The company argues in the filing that the jury sought to put it out of business.

“The most plausible explanation for the oddly specific amount of the punitive damages award is that the jury chose that amount in an attempt to bankrupt NSO,” the filing says. “The jury’s award comes close to wiping out all of NSO’s current ‘assets.’”

Citing case law, NSO called the jury’s attempt to “financially destroy” it unlawful.

The award violates NSO’s constitutional right to due process, which protects individuals from arbitrary government actions, the company says in the filing. 

NSO also argues that the punitive damages were too high because its conduct was not “reprehensible” — a standard allegedly required by precedent — in part because the harm WhatsApp suffered was economic and not physical. 

WhatsApp said its engineers spent a great deal of time updating patches to fight new NSO attack vectors.

Prior to the jury trial, NSO told Northern California federal judge Phyllis Hamilton that its product is sold to governments that are contractually bound to use it only to investigate terrorism or crime, but in the WhatsApp case a sizable chunk of victims were found to be diplomats, dissidents and journalists. 

Hamilton barred NSO from presenting evidence showing that its spyware is used to investigate terrorism and crime because the company could not explain why its clients broke into the WhatsApp users’ devices and who the clients involved were.

NSO argued in the filing that the exclusion was unfair because NSO “licenses its technology exclusively for use in government investigations lawful under the laws of those governments’ countries.”

“That the technology temporarily functioned by sending harmless messages through WhatsApp servers is hardly reprehensible,” NSO says in the filing.