Jury deliberations begin in damages trial between Meta and Israeli spyware company

OAKLAND, Calif. (CN) — An eight-person jury began deliberations Monday to determine what damages, if any, are owed to Meta by Israeli cyberintelligence firm NSO Group concerning a 2019 spyware attack on over 1,400 WhatsApp users’ phones, including those of journalists, activists and diplomats.

In its closing arguments, Meta implored the jurors to use their “common sense” in determining how much NSO owes in damages.

“We ask you to send a message clearly, now and in public, that spying is not legal here in the United States and certainly not in California,” Greg Andres of Davis Polk, who represents Meta, told jurors.

In contrast, NSO criticized the plaintiffs for appealing to the jury’s emotions and urged its members to be discerning and dispassionate in their analysis.

“Their case is weak, and it plays entirely on your emotion, not your reason,” Joe Akrotirianakis of King and Spalding, who represents NSO, told the jury. “You cannot decide this case based on emotion or fear. You must decide this case based on the evidence.”

Meta — the owner of WhatsApp, an encrypted communication app owned by Facebook’s parent company Meta Platforms, which boasts over 2 billion users worldwide — sued the Israel-based firm in 2019 over violations of the U.S. Computer Fraud and Abuse Act and the California Comprehensive Computer Data Access and Fraud Act, as well as for breaching WhatsApp’s terms of service.

Because U.S. District Judge Phyllis J. Hamilton, a Bill Clinton appointee, already ruled in Meta’s favor in December, the trial is only being used to determine damages.

Meta is asking the jury for over $440,000 in compensatory damages to remedy the costs of investigating malicious code on its servers, but also for an unspecified amount of punitive damages to be awarded by the jury, possibly in the millions.

“We’re not going to ask for a specific number. We’re going to leave that to the jury,” Andres said.

However, the tech giant did say that a great place to start would be with NSO’s $60 million research and development budget, implying that jurors could “take away their ability to spy” by awarding an equal amount of damages.

During the trial, Meta focused on the dangerous capabilities of Pegasus — NSO’s proprietary spyware that can remotely take control of users’ microphones, cameras and download user data — and implied that jurors could find themselves in its sights in the not-too-distant future.

“They’re not going to stop, ladies and gentlemen,” Andres said, stretching his arms wide for the jury.

Meta argued that the 1,400 users involved in the May 2019 attack on its servers was just the “tip of the iceberg,” citing witness testimony by NSO executive Tamir Gazneli that Pegasus was successfully installed between hundreds and tens of thousands of times between April 2018 and May 2020.

Meta further asked jurors to cut through the euphemisms that NSO supposedly uses to distance itself from its conduct during their deliberations.

“NSO calls them targets, but those are people,” Andres said, possibly alluding to the testimony of one of its executives, Tamir Gazneli, who previously implied that the victims of the spyware attacks weren’t people.

Meta concluded by asking the jury to award it an amount that “holds NSO accountable” and “punishes them for their conduct.”

“It’s just that simple. They attacked WhatsApp, WhatsApp responded and now WhatsApp is seeking to be compensated for those damages,” Andres said.

In return, NSO decried Meta’s efforts to “demonize” its company, and accused the tech giant of coming after NSO to “make a big PR splash.”

“They want you to picture a villain in a black hoodie, trying to steal personal information and credit card numbers,” Akrotirianakis said, displaying a stock image of a shadowy hacker on a TV screen facing the jurors. Nothing, he said, could be further from the case.

Under law, a plaintiff can obtain punitive damages when it is proven by “clear and convincing” evidence that the defendant has been guilty of oppression, fraud or malice.

NSO argued that although any one of these could go toward punitive damages, the lack of harm and intent to harm Meta’s servers proved oppression and malice were not applicable. As to fraud, NSO simply claimed it made “no misrepresentations” to Meta leading up to the lawsuit.

In addition to punitive damages, NSO argued that Meta didn’t deserve any compensatory damages because it didn’t suffer any harm to its servers throughout this case. The company stated that Meta’s own experts confirmed throughout the trial that the Pegasus agent did not damage, rewrite the code, slow down or compromise their servers in any way.

In summation, NSO called Meta’s $440,000 estimate “grossly inflated.”

“This case is about dollars and cents. It is a damages trial, and Facebook did not pay a cent more than it would have if NSO never existed,” Akrotirianakis said.

The Israeli company argued that Meta’s fear-stoking arguments were unwarranted, and told jurors that Pegasus can’t even target American phone numbers because of its technical limitations.

“This is not Alexa or Siri in your living room, listening to your loved ones in mass surveillance, as was implied last week and today,” Akrotirianakis said.

NSO repeatedly referred to Meta as “Facebook” in its closing, linking Meta to its own controversial flagship social media platform.

On rebuttal, Meta admonished NSO for what it called “victim-blaming” and accused the company of suggesting that Meta deserved the attack because its security wasn’t robust enough.

“We are not on the same footing as NSO in this lawsuit. There is no finding that we ever violated the law,” Andres said.

After asking for an extra 30 minutes to continue deliberating, the jury did not reach a verdict on Monday afternoon. Deliberations will resume Tuesday morning.

Originally designed as a tool for government law enforcement and intelligence agencies, Pegasus is licensed to governments around the world. The software has been used in the past to spy on reporters, foreign political leaders and U.S. State Department employees.

To embed the spyware into someone’s phone, Pegasus clients send a text message that then invades devices through a malicious code lurking in these messages sent via WhatsApp, Telegram or other messaging services.

Pegasus can also infect users through missed phone calls and “zero-click” attacks, which do not require any action from the phone’s owner to succeed.

Once implanted, Pegasus can control a phone’s microphones and cameras while extracting the personal and location data of its owner — for example, by scraping browser history and contacts, grabbing screenshots and infiltrating communications.