Meta fights to keep Israeli spyware firm off its platforms in trial aftermath

OAKLAND, Calif. (CN) — Meta asked a federal judge on Thursday for a court order banning Israeli cyber intelligence firm NSO Group from using any of its platforms in the aftermath of a $168 million verdict against the spyware peddler.

Meta won its jury trial against NSO in May, in a case arising from a 2019 attack that downloaded spyware on more than 1,400 WhatsApp users’ phones. But the tech giant says it still needs a court order to block NSO from operating any accounts on Instagram, Facebook and WhatsApp to prevent future harm against the company, citing “continued activity” on its servers by the hacker-for-hire firm as recently as April.

“It’s like a safecracker that still has all his tools,” Antonio Perez-Marques, an attorney from Davis Polk that represented Meta, told the court.

Meta claimed that it detected “attacker activity” from NSO on its servers less than a month before trial began, which, combined with NSO’s pattern of attacking its servers during the lawsuit, the Facebook creator said underscores the need for a a court order.

“We’re not just relying on past evidence, your honor. We believe there is independent evidence of the future risk of harm here,” Perez-Marques said.

U.S. District Judge Phyllis J. Hamilton said she was reluctant to issue an injunction blocking NSO from Facebook and Instagram, seeing as how the case was primarily about WhatsApp.

“You want an injunction that applies to all of Facebook’s messaging platforms,” the Bill Clinton Appointee said. “I’m not sure you’ve cited adequate authority to go beyond the parties that were before the court.”

NSO Group attacked Meta’s bid for an injunction, claiming that Meta could not prove its court order would be in the public interest, because law enforcement in the United States, it claims, stands to benefit from its powerful surveillance software, “Pegasus,” and its ability to circumvent end-to-end encryption.

In fact, NSO argued that a court order barring it from using WhatsApp would ultimately harm the public.

“It is in law enforcement’s interest and the public interest to have technology that can intercept end-to-end encrypted communications,” Joshua Minkler, a former federal prosecutor and expert offered by NSO, told the court.

Minkler said that law enforcement was currently “in the dark,” when it came to people who used end-to-end encryption platforms like WhatsApp for criminal purposes, showing a need for services like NSO’s.

Minker also added that, in the future, Pegasus could be legally used in the U.S. under exceptions in the federal Computer Fraud and Abuse Act.

“If used lawfully, it would be in the public benefit,” Minkler said.

Meta pushed back on these assertions, insisting that no court has ever approved of the use of Pegasus in the U.S.

Minkler testified that although he knew the FBI, a domestic law enforcement agency, had obtained a license for the use of Pegasus in 2018, he conceded that the agency would likely not use Pegasus in violation of federal law.

NSO also asked the court to reduce its “substantial” punitive damages, which it said violated Supreme Court and Ninth Circuit precedents.

After the trial, an eight-person jury awarded the Silicon Valley giant $444,719 in compensatory damages and over $167 million in punitive damages meant to deter any similar actions by NSO in the future.

NSO argued that its punitive damages were “unconstitutionally excessive” and should be capped at a four-to-one ratio with respect to compensatory damages. That, they said, would be more befitting of conduct that was “not reprehensible” and “not particularly egregious” under Ninth Circuit law.

The judge was particularly skeptical of NSO’s arguments that its damages are “substantial” considering that the company claimed at trial that the damages Meta sought were a “mere pittance” and part of a “show trial.”

“How do you reconcile the two, saying back then that it was a ‘mere pittance,’ and now saying that it’s ‘substantial?’” Hamilton asked.

“What I was saying to the jury was: ‘Can you really believe that a trillion-dollar company like Facebook is dragging you down here for a mere $440,000?’” Joe Akrotirianakis of King and Spalding, who represented NSO, responded.

In the event that Hamilton doesn’t approve of a reduction in damages, NSO asked the court for a new trial.

Whatever her ruling, Hamilton indicated to attorneys a strong desire for “this case to be over.”

“I’m not inclined to go any further beyond this hearing,” Hamilton said.

The judge took the motion under submission and did not indicate when she would issue a ruling.

The damages awarded at the trial represented a major win for privacy advocates and human rights organizations, who have repeatedly criticized NSO for its licensing of Pegasus, a powerful surveillance software that allows its users to remotely gain control over a device’s microphone and camera, listen to phone calls in real-time and download nearly all user data from a target’s phone, among other capabilities.

Originally designed as a tool for government law enforcement and intelligence agencies, Pegasus — NSO’s flagship product licensed to governments around the world — reportedly compromised the privacy of 1,400 activists, journalists and diplomats via WhatsApp servers in 2019.

In order to embed the spyware into someone’s phone, Pegasus clients send a text message, which then invades devices through a malicious code lurking in these messages sent via WhatsApp, Telegram or other messaging services.

Once implanted, it can control a phone’s microphones and cameras while extracting the personal and location data of its owner — for example by scraping browser history and contacts, grabbing screenshots and infiltrating communications.

Pegasus can also infect users through missed phone calls and  “zero-click” attacks, which do not require any action from the phone’s owner to succeed.

NSO Group says it only sells its spyware to legitimate government law enforcement and intelligence agencies vetted by Israel’s Defense Ministry for use against terrorists and criminals.

The company landed on the U.S. Commerce Department’s entity list in 2021 for activities counter to national security interests.

NSO has previously faced sanctions for refusing to comply with court orders ordering it to produce the Pegasus code in its entirety.

Meta’s lawsuit against NSO has involved more than half a decade of courtproceedings.