US court hits Israeli spyware firm NSO with $167m fine

The verdict delivers a clear message that commercial enterprises profiting from intrusive surveillance tools cannot hide behind their governmental clients. Jurors deliberated for just one day before determining that NSO had acted with “malice, oppression or fraud” when deploying its Pegasus spyware against 1,400 WhatsApp users.

Pegasus software, which provides nearly complete access to a target’s device—including microphones, cameras and encrypted communications—was used to target journalists, human rights advocates and political opponents rather than criminal elements. Meta, WhatsApp’s parent company, condemned the hacking as “despicable” and a clear breach of privacy rights.

NSO has consistently maintained that it sells its spyware exclusively to vetted government clients for national security purposes. However, investigations have revealed Pegasus being utilised to enable cross-border repression by authoritarian governments.

The previous American administration placed NSO on a trade blacklist for its involvement in such abuses, making it the first company added to the US entity list for enabling state surveillance. The jury’s decision is likely to increase pressure on Washington to implement stronger regulations for the commercial spyware industry.

Although collecting the financial penalty may prove challenging, the judgement establishes an important legal precedent: spyware companies can be held directly liable in American courts, regardless of their customers’ governmental connections.

In this way, the case redefines digital privacy not simply as a user expectation but as a civil right, and indicates that the immunity long enjoyed by private surveillance entities is drawing to a close.​​​​​​​​​​​​​​​​