Cybersecurity Policy Report, ‘Outrageous’ Spyware Penalty in Federal Civil Case Should be Reduced, NSO Tells Court, (Jun 3, 2025)
NSO Group Technologies Ltd. is seeking a new trial or a reduction in punitive damages awarded to WhatsApp in a federal civil case, arguing that the jury had sought to bankrupt it by deciding it should pay nearly $168 million for targeting WhatsApp users with spyware.
“The jury awarded Plaintiffs $167,254,000 in punitive damages—slightly more than 376 times the compensatory damages award of $444,719. That outrageous punitive award exceeds the maximum lawful punitive damages award in this case by many orders of magnitude,” NSO told the U.S. District Court for the Northern District of California in its request for a new trial or remittitur in WhatsApp, Inc., et al., v. NSO Group Technologies Ltd., et al., No. 19-cv-07123 (N.D. Cal. Oct. 29, 2019).
An eight-person jury last month found that NSO had violated the federal Computer Fraud and Abuse Act and California’s Comprehensive Computer Data Access and Fraud Act over its use of WhatsApp’s systems to load spyware onto the devices of WhatsApp’s users (CPR, May 7).
But the punitive damages awarded by the jury were “flagrantly unconstitutional,” NSO said, citing Ninth Circuit precedent that generally limits punitive damages to no more than four times the amount of compensatory damages.
The “absurd 376-to-1 ratio of punitive to compensatory damages in this case is many times greater than ratios the Supreme Court and Ninth Circuit have held to be unconstitutional,” it said.
“In the few cases where the Ninth Circuit has approved awards at a greater ratio than 4-to-1, it has found reprehensible conduct of an entirely different magnitude than NSO’s conduct,” NSO said.
“The only plausible explanation for the amount of the award is that the jury was attempting to bankrupt NSO. That is an improper purpose for a punitive damages award, and it resulted in an award that grossly exceeds NSO’s ability to pay,” the company complained.
“The award also plainly reflects an improper desire to punish NSO for alleged conduct toward third parties not before the Court, specifically the WhatsApp users on whom Plaintiffs accused NSO of spying,” it said.
“The undisputed evidence—which this Court excluded from the jury’s consideration—is that NSO licenses its technology exclusively for use in government investigations lawful under the laws of those governments’ countries. That the technology temporarily functioned by sending harmless messages through WhatsApp servers is hardly reprehensible,” it said.
“Here, in particular, the Court prohibited NSO from offering the evidence it would have introduced to rebut Plaintiffs’ ‘spying’ accusations, including evidence that the WhatsApp users against whom Pegasus has been deployed are overwhelmingly terrorists, drug traffickers, sex traffickers, pedophiles, and other criminals who Plaintiffs are very well aware use WhatsApp to commit unspeakable crimes and who are, therefore, lawful targets of government monitoring,” it added.
“NSO submits that any punitive damages in this case should not exceed Plaintiffs’ $444,719 compensatory damages award,” it said.
“But if punitive damages were to exceed compensatory damages, this case falls squarely within the category of cases in which the Supreme Court and this Court have held that a 4-to-1 ratio represents the outer constitutional limit. A 4-to-1 ratio would produce a punitive damages award of roughly $1.77 million,” it said.
The court ordered WhatsApp to respond to NSO’s request by June 12 and scheduled a July 17 hearing.
News: FederalLegislation StateLegislation LitigationEnforcement DataPrivacy DataSecurity