This past December, Meta (and its subsidiary WhatsApp) won summary judgment against Israeli spyware firm NSO Group for using WhatsApp's servers to deploy its Pegasus spyware in an attack that targeted roughly 1,400 users, including journalists and human rights activists.
The court held NSO liable for violating the Computer Fraud and Abuse Act, California's Comprehensive Computer Data Access and Fraud Act, and WhatsApp's terms of service. The court rejected NSO's claims of sovereign immunity and found it was actively involved in operating Pegasus, not merely supplying it to governments.
A trial on damages began on April 29, and the case is a textbook example of why trials on damages are some of the most difficult to try, especially for unsympathetic defendants. The jury will hear from the court that it already conclusively found NSO liable for the attack on WhatsApp. This will signal to jurors that NSO is a bad actor from the start and rehabilitating its image will be an uphill battle throughout trial.
And NSO is not a sympathetic defendant to begin with. American jurors are inherently skeptical of foreign companies, especially those they believe are in the business of infiltrating Americans' privacy. Indeed, one of Meta's engineers testified that once installed on a device, Pegasus allowed NSO's clients to read messages, listen to calls in real time, and obtain location data. NSO's counsel will have to carefully establish a compelling and credible story of NSO's history and business to gain the jury's trust and combat the narrative that Pegasus essentially enabled its clients to spy on Americans.
One of the stories that NSO will tell is that it is a national security contractor, not a rogue actor. NSO claims it sells Pegasus only to governments and law enforcement agencies for the purpose of combating terrorism, organized crime, and threats to national security. It has already emphasized this theme in opening statements and through the direct examination of its CEO, Yaron Shohat. But pretrial evidentiary rulings limit NSO's ability to tell this story, such as a ruling that NSO Group cannot introduce the identities of its clients at trial.
At the same time, Meta is painting itself not just as a victim, but as a global steward of cybersecurity acting to protect all of its users, including those users sitting in the jury box. It will emphasize that the case is not just about compensating Meta for the attack, it's about deterring surveillance abuses by foreign entities and protecting users who may not themselves have the resources to get relief in court. NSO has already tried to attack Meta's motives for bringing the lawsuit in its opening statements, arguing that the case is a public relations stunt, signaling that this will be one of NSO's main themes throughout trial.
This case will undoubtedly be a touchstone in global cybersecurity law and litigation. But it will also be an important case study in trial advocacy and how deeply unsympathetic defendants can best present themselves to jurors when liability has already been established.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
