WhatsApp has secured a permanent injunction prohibiting spyware maker NSO Group from targeting its users, a significant win for the messaging giant. However, the same court ruling dramatically reduced the punitive damages previously awarded to WhatsApp against NSO Group.
Two key developments emerged from a Northern California District Court late Friday. Judge Phyllis Hamilton’s ruling granted WhatsApp’s request for an injunction, acknowledging the potential harm to Meta’s business model given the privacy-focused nature of WhatsApp’s service. Concurrently, the judge slashed the $167.3 million in punitive damages a jury had awarded in May down to $4 million.
WhatsApp Secures Injunction Against NSO Group
The injunction aims to prevent NSO Group from further developing or deploying its surveillance software to compromise the security of WhatsApp users. Judge Hamilton’s decision emphasized the importance of end-to-end encryption in modern communication services, stating that its effectiveness is a core part of WhatsApp’s appeal to users.
“Plaintiffs appear to have made such encryption, and the privacy and security that it entails, a significant part of its pitch to users, making it reasonable to conclude that users would be dissuaded from using Whatsapp if its encryption were ineffective,” the judge wrote in her opinion.
Will Cathcart, head of WhatsApp, expressed satisfaction with the ruling, calling it a victory for holding NSO Group accountable for targeting members of civil society. He highlighted the ruling as setting an important precedent regarding consequences for attacking an American company.
Implications of the Damages Reduction
While the injunction represents a strong legal statement against NSO Group’s practices, the substantial reduction in punitive damages offers NSO Group a reprieve. The judge cited previous court precedents that link the ratio of punitive damages to the specific behavior deemed unlawful. She noted that a higher punitive damage award might be justified in future cases with more established legal context around smartphone-era surveillance.
“In this court’s view, at this time, there have simply not yet been enough cases involving unlawful electronic surveillance in the smartphone era for the court to be able to conclude that defendants’ conduct was ‘particularly egregious,’” Hamilton stated.
A spokesperson for NSO Group, Gil Lainer, acknowledged the significant reduction in damages as a positive step, though they still deemed the remaining sum disproportionately high. The spokesperson also emphasized that the injunction does not apply to NSO Group’s existing customers.
“However, the continued disregard for the proven value of NSO’s technology in supporting governments and law enforcement agencies in the fight against terrorism and serious crime undermines the public interest,” Lainer said in an emailed statement.
NSO Group, a prominent entity in the spyware industry, was recently acquired by an American investment group. The company stated it would review the full decision before determining its next legal steps.
Experts in cybersecurity, such as John Scott-Railton, a senior researcher at the University of Toronto’s Citizen Lab, suggested on social media that the injunction could create a significant competitive disadvantage for NSO Group, potentially diminishing the market value of its spyware technology.
NSO Group is expected to continue operating, with its focus shifting to its contractual obligations with its government clients. The company’s future strategic direction amidst this legal landscape will be a key point to monitor, especially concerning any new contractual agreements or the development of its surveillance technologies.