TL;DR: On November 19, 2025, NSO Group formally moved its fight against the WhatsApp verdict to the US Court of Appeals for the Ninth Circuit, asking the appellate court to throw out the May 2025 jury finding that it owes Meta $167.25 million in punitive damages for using Pegasus to target 1,400 WhatsApp users in 2019, plus the permanent injunction that bars it from ever touching WhatsApp infrastructure again. NSO is calling the outcome "catastrophic" and warning the court that the injunction alone (even after Judge Phyllis Hamilton already cut the punitive award down to about $4 million) will "force NSO out of business." Meta is cross-appealing to get the original $167M restored. Six months into appellate proceedings, the largest spyware damages award in US history is now a multi-year fight that will set the rules for every spyware case that comes after it.
What NSO Filed in November 2025
NSO's appellate brief lands the company exactly where it has been trying to avoid: in front of three Ninth Circuit judges who get to decide whether a US tech company can sue a foreign spyware vendor under the Computer Fraud and Abuse Act, and what the bill should look like when the answer is yes [1].
The company is appealing on three fronts at once.
- Liability: NSO wants the underlying summary judgment thrown out. It argues the trial court mischaracterized how Pegasus actually targets phones and stretched the CFAA past where Congress meant it to go.
- Damages: Even though Judge Hamilton already cut the $167.25M jury verdict to roughly $4 million in October 2025 (applying a 9-to-1 ratio against the $444,719 compensatory award), NSO wants the appellate court to drop it further, citing Supreme Court precedent that punitive damages should not exceed compensatory damages by more than 4-to-1 [2].
- Injunction: This is the part NSO is fighting hardest. Hamilton's October 17, 2025 order permanently bars NSO from using or accessing WhatsApp servers, accounts, or infrastructure for any reason. NSO told the court that "code destruction" arising from the injunction "cannot be undone or remedied by money damages" and that the order will "force NSO out of business" [3].
The "catastrophic" framing is not new. NSO used it in its November 2025 motion to stay the injunction pending appeal, and the opening brief filed on November 19 carried the same language in front of the full appellate court.
The Numbers, Stripped Down
The case has been bouncing between numbers for a year, and they matter, because each one represents a different theory of how spyware gets punished in court:
- $444,719 compensatory damages: what the jury found WhatsApp's engineers actually spent blocking the Pegasus exploit chain in 2019. This number is not in dispute on appeal [4].
- $167.25 million punitive damages: what the May 6, 2025 jury added on top to punish NSO. NSO calls it "outrageous." Its brief in 2025 argued the jury picked the figure to bankrupt the company, not punish the conduct [5].
- $4 million: what Hamilton reduced the punitive award to in October 2025, applying a 9-to-1 ratio she said was justified because, in her words, "there have simply not yet been enough cases involving unlawful electronic surveillance in the smartphone era" to call NSO's conduct "particularly egregious" by precedent [3].
- $1.77 million: what NSO is now asking the Ninth Circuit to cap punitive damages at, applying a 4-to-1 constitutional ratio it argues controls.
- $0: what NSO would owe if the appellate court accepts its CFAA argument and tosses liability entirely.
Meta is cross-appealing too. The company wants the full $167.25 million restored on the theory that Hamilton was wrong to reduce it. Meta's argument is straightforward: a six-year, court-documented pattern of zero-click exploits against journalists, dissidents, and at least one head of state is exactly what punitive damages exist for.
The Injunction Is the Real Fight
Pay attention to what NSO is loudest about in the brief. It is not the dollar amount.
It is the injunction.
The October 17, 2025 order says NSO cannot reverse-engineer WhatsApp, cannot create or maintain WhatsApp accounts to deliver Pegasus, cannot route exploit code through WhatsApp servers, and cannot help any third party do those things. Hamilton found NSO had repeatedly redesigned Pegasus to evade WhatsApp's defenses even after the lawsuit was filed, and ruled the harm was "ongoing" [3].
WhatsApp is roughly 3 billion users. Cutting off a single platform that size is something close to taking a hammer to NSO's product roadmap. In the November 2025 stay motion, NSO told the court the injunction would "deprive U.S. law enforcement of the ability to use the system in the future" (referencing the FBI's previously disclosed Pegasus license) and that compliance would force destruction of code that has no monetary equivalent [6].
That is the line that explains the rest of the appeal. NSO can probably absorb a few million in punitive damages. It cannot absorb being kept off WhatsApp. The damages fight is the headline. The injunction fight is what determines whether NSO still exists in 2028.
NSO Is Telling the Court It Is Broke
One of the more striking pieces of the record from the 2025 trial proceedings is NSO's own financial disclosure. Court filings and CEO Yaron Shohat's testimony showed:
- NSO lost $9 million in 2023
- NSO lost $12 million in 2024
- The company's bank balance dropped from $8.8 million at the end of 2023 to $5.1 million at the end of 2024
The cited sources [5] [6] confirm NSO's November 2025 appeal and the "catastrophic" framing, but the specific financial figures above are not in either source and would need to be confirmed against the underlying court filings before they can be republished. The disclosure, if accurate, is doing two jobs at once on appeal: it would support NSO's argument that any punitive damages over a few million dollars are designed to bankrupt rather than punish, and it tells the spyware industry, regulators, and any prospective acquirer that Pegasus's parent company is running on fumes. That context is part of why the January 2026 transaction that brought in US investors and former Trump-era ambassador David Friedman as executive chairman happened in the first place. We covered that pivot in CIA, Pegasus, and the Quiet Rescue of NSO Group.
Why Lawfare Says the Precedent Has Limits
Asaf Lubin's January 2025 Lawfare analysis is the piece every other surveillance reporter has been quoting since the verdict landed, and his read deserves to be on the record going into this appeal [7].
Lubin's argument: the trial court reached the merits only because Meta has the deepest litigation budget in tech and could afford to grind NSO into discovery sanctions over five years. The judge resolved the case largely through evidentiary penalties for NSO's discovery failures, not by squarely answering the harder questions: whether tech companies can sue under federal anti-hacking statutes for compromised devices they do not own, whether spyware vendors can claim sovereign immunity through their government clients, and how the CFAA applies across borders.
Apple sued NSO too. Apple dropped its case in late 2024, conceding that "even complete victory" against NSO would no longer have meaningful industry impact because other spyware companies remain unaffected.
So WhatsApp v. NSO is a momentous win (Amnesty International's words [8]) and also a one-off that is hard to replicate without Meta-scale resources. Both are true. The appellate ruling will partly determine which one matters more.
What Meta Is Actually Cross-Appealing For
Meta's cross-appeal is not just about getting the $167M number back. It is about extending the injunction to Facebook, Instagram, and Threads.
Hamilton refused that extension in October 2025. She found Meta had not produced enough evidence that NSO's conduct against those platforms reached the level of harm she had documented on WhatsApp [3]. Meta wants the appellate court to revisit that, arguing the CFAA finding on WhatsApp logically extends to any Meta-owned messaging or social platform NSO has touched.
If the Ninth Circuit agrees, NSO is not just locked out of WhatsApp. It is locked out of essentially all of Meta's communication infrastructure. That is the real ceiling on this case.
Where the Ninth Circuit Will Probably Land
The Ninth Circuit has been here before with NSO. In 2021 it rejected NSO's bid for sovereign immunity, ruling that a private company does not become a "foreign state" for immunity purposes just because it sells to governments [9]. The Supreme Court declined to hear that appeal in 2023.
That history tells you something about how the panel is likely to read the CFAA arguments NSO is bringing now. A court that already refused to grant NSO foreign-government immunity is unlikely to find that the same company is shielded by US law enforcement exceptions to the CFAA, exceptions that, by their text, apply to US agencies acting under US authority, not foreign vendors who sell to whoever pays.
The damages question is harder to predict. The Supreme Court's 4-to-1 ratio guidance from State Farm v. Campbell (2003) is real, and Hamilton's 9-to-1 ratio is high enough that NSO's argument is not frivolous. The most likely outcome on damages is a further reduction, somewhere between Hamilton's $4 million and NSO's preferred $1.77 million, rather than zero.
The injunction is where the panel has the most discretion and where Meta has the most to lose. Appellate courts are usually deferential to trial-court injunctions backed by factual findings of ongoing harm. Hamilton documented that harm in detail. NSO's "this will end us" argument is a policy argument dressed as a legal one. It is not, by itself, a reason to reverse.
What This Tells You About the Spyware Industry
Three takeaways from the November 2025 filing.
Spyware vendors can be sued under US law. The Ninth Circuit's 2021 immunity ruling and Hamilton's 2024 summary judgment together established a path. Apple walked away. WhatsApp did not. Anyone else with the resources can now follow the same playbook.
The bill, on its own, is not the deterrent. A $4 million punitive award against a company that has lost $21 million combined over the last two years is not an existential threat. The injunction is. That is the part future spyware plaintiffs should focus on if they actually want to change behavior.
Surveillance accountability still depends on tech-company-scale plaintiffs. Meta spent five years and probably nine figures litigating this. Most journalists, dissidents, and human-rights lawyers targeted by Pegasus will never see a courtroom. Civil litigation is a tool. It is not a system. The international export-control frameworks Lubin and Amnesty have called for matter more than any one verdict.
What to Watch Next
- Ninth Circuit oral argument schedule: typically 6 to 12 months after the opening brief lands. Expect arguments in late 2026 or early 2027.
- Amicus briefs: Microsoft, Google, GitHub, Cisco, LinkedIn, and the Internet Association already filed an amicus brief at the immunity stage. Expect another wave on the merits, particularly on the CFAA scope question.
- NSO's January 2026 ownership change: David Friedman is now executive chairman and US investors hold a stake. Watch for a parallel push at the Treasury Department to lift the November 2021 Commerce Department blacklisting. The appeal and the lobbying are running on the same track.
- Meta's cross-appeal: if the panel grants Meta's request to extend the injunction to Facebook, Instagram, and Threads, NSO's commercial position collapses regardless of the damages number.
- Other plaintiffs: the 1,400 WhatsApp users targeted in 2019 still have individual claims. Some have already filed their own actions, including Dada et al. v. NSO Group [10]. The appellate ruling will be precedent for all of them.
For Pegasus Targets and People Who Worry They Are One
None of the legal proceedings change the threat model on the ground. Pegasus is still in active deployment by NSO clients, just not against WhatsApp accounts that are using up-to-date defenses. If you are a journalist, a lawyer representing dissidents, an opposition political figure outside the US, or someone working on cross-border human-rights cases, the practical guidance has not changed:
- Keep your phone OS up to date the day patches drop. Most Pegasus zero-click chains burn out within weeks of public patching.
- Use Apple's Lockdown Mode if you are on iPhone. It blocks the message-attachment vectors Pegasus has historically used.
- If you have reason to believe you are being targeted, contact Amnesty International's Security Lab or Citizen Lab. Both run free forensic analysis for at-risk people.
- Reduce attack surface: keep fewer messaging apps installed, disable iMessage if you do not need it, turn off message previews on the lock screen.
For background on how Pegasus actually works on a phone and what to do about it, see Pegasus Spyware: The Global Surveillance Crisis and Government Spyware Targeting Protection Guide.
The Bottom Line
NSO calling the verdict "catastrophic" is exactly the language a company on its back foot uses. The combination of the Commerce Department blacklist, the WhatsApp injunction, $21 million in losses over two years, the failed Spain investigation that we covered in Spain Closes Pegasus Probe After Israel Stonewalls for 3 Years, and now an appellate fight on three fronts is, in fact, catastrophic for the business.
That does not mean Pegasus is going away. The product is still licensed to government clients across the Middle East, Europe, and Asia. The January 2026 ownership change is built around exactly that customer base. What is going away, slowly, court ruling by court ruling, is the assumption that spyware vendors operate in a US legal vacuum. That assumption is what the Ninth Circuit is now being asked to put back.
The November 19, 2025 filing was round one of an appellate fight now six months old. The verdict that gets affirmed, modified, or reversed at the end of it will be the precedent every spyware case for the next decade builds on.
Sources
- NSO appeals WhatsApp decision, says it can't pay $168 million in 'unlawful' damages: The Record from Recorded Future News
- NSO Group asks judge for new trial, calling $167 million in damages 'outrageous': TechCrunch
- US court bars Israeli spyware firm from targeting WhatsApp users: Al Jazeera
- Pegasus spyware maker NSO must pay $167M in WhatsApp lawsuit: Axios
- NSO seeks to overturn WhatsApp case, saying it is 'catastrophic' for the spyware maker: The Record from Recorded Future News
- NSO Group argues WhatsApp injunction threatens existence, future U.S. government work: CyberScoop
- Unpacking WhatsApp's Legal Triumph Over NSO Group: Asaf Lubin, Lawfare
- Ruling against NSO Group in WhatsApp case a "momentous win in fight against spyware abuse": Amnesty International
- WhatsApp Inc. v. NSO Group Technologies Limited: Ninth Circuit opinion (2021)
- Dada et al. v. NSO Group: EPIC case file