A jury has awarded WhatsApp $167 million in punitive damages in a case the corporate introduced in opposition to Israel-based NSO Group for exploiting a software program vulnerability that hijacked the telephones of 1000’s of customers.

The decision, reached Tuesday, comes as a serious victory not only for Meta-owned WhatsApp but in addition for privacy- and security-rights advocates who’ve lengthy criticized the practices of NSO and different exploit sellers. The jury additionally awarded WhatsApp $444 million in compensatory damages.

Clickless exploit

WhatsApp sued NSO in 2019 for an assault that focused roughly 1,400 cell phones belonging to attorneys, journalists, human-rights activists, political dissidents, diplomats, and senior international authorities officers. NSO, which works on behalf of governments and legislation enforcement authorities in varied international locations, exploited a essential WhatsApp vulnerability that allowed it to put in NSO’s proprietary spy ware Pegasus on iOS and Android units. The clickless exploit labored by inserting a name to a goal’s app. A goal didn’t need to reply the decision to be contaminated.

“At the moment’s verdict in WhatsApp’s case is a crucial step ahead for privateness and safety as the primary victory in opposition to the event and use of unlawful spy ware that threatens the protection and privateness of everybody,” WhatsApp mentioned in a statement. “At the moment, the jury’s choice to power NSO, a infamous international spy ware service provider, to pay damages is a essential deterrent to this malicious trade in opposition to their unlawful acts geared toward American firms and the privateness and safety of the folks we serve.”

NSO created WhatsApp accounts in 2018 and used them a 12 months later to provoke calls that exploited the essential vulnerability on telephones, which, amongst others, included 100 members of “civil society” from 20 international locations, in response to an investigation analysis group Citizen Lab carried out on behalf of WhatsApp. The calls handed by way of WhatsApp servers and injected malicious code into the reminiscence of focused units. The focused telephones would then use WhatsApp servers to connect with malicious servers maintained by NSO.