Fiery hearing reveals details about Israeli spyware company’s clients

OAKLAND, Calif. (CN) — Who breached Meta’s servers in 2019 to spy on WhatsApp users, and why?

This question dominated a tense hearing on Thursday in WhatsApp’s high-profile computer fraud case against NSO Group Technologies, the world’s most notorious hacker-for-hire firm. Although the trial is just over two weeks away, U.S. District Judge Phyllis J. Hamilton said discovery disputes are threatening to push the case back another two years.

“I’m on the verge of blowing this whole thing up,” the judge said, referring to her deliberations on whether to grant additional discovery in the case, which she said could extend the already five-year-old lawsuit.

The judge was frustrated over WhatsApp’s recent claims that it has not received discovery on multiple key issues relevant to the upcoming trial, including who NSO’s clients were in the 2019 attack that prompted its lawsuit.

While NSO stated it was doing its best to comply with Israeli law and national security concerns, the judge indicated several times that it is falling short.

“In 34 years on this court, I’ve never proceeded to trial where so much discovery has been withheld,” the Bill Clinton appointee said, adding that the practice should be “generous” in principle.

WhatsApp implored the judge not to grant further discovery, arguing NSO could fall back on a strategy that’s worked for it before by asking for a delay of discovery, then producing the discovered material in Israel, functionally out of reach of the plaintiffs.“Nothing could benefit the defendants more than blowing up this trial, than delaying the case and denying the plaintiffs the damages they are entitled to,” said Greg Andres of Davis Polk and Wardwell, who represented WhatsApp.

Andres further claimed NSO’s whole business model was “based on illegal activity,” prompting swift condemnation from opposing counsel.

“That is a work of fiction, your honor, that he just made up on the lectern in the last five minutes,” attorney Joe Akrotirianakis, who represents NSO, said, raising his voice. “He’s just literally making that up. And I think he knows it.”

As a jury trial looms on the horizon, both sides are feeling the pressure. Attorneys for both sides argued passionately in court, often talking over each other and prompting the judge to get involved multiple times.

WhatsApp also claims NSO hasn’t provided any information indicating that the intrusions on its system were the result of a criminal investigation and that the attacks could have been for personal reasons, citing a previous scandal where Dubai’s ruler used Pegasus to hack his ex-wife’s phone during a court battle over their children.

“All we know is from the press, your honor, because nothing has been offered,” Andres said.

Throughout court proceedings, NSO has argued many of the case’s specific details exist in a black box of confidentiality, which it cannot discuss for security reasons.

“They don’t want us to know, and we don’t want to know,” Akrotirianakis said of how NSO’s clients use its software.

However, that strategy has restricted them to a level of generality that both frustrated and confused the judge and WhatsApp throughout the hearing.

After intense questioning by the judge, the Israeli tech company reluctantly confirmed the identities of several clients behind the 2019 attack using WhatsApp servers to target more than 1,400 WhatsApp users, including Uzbekistan, Saudi Arabia, and Mexico, as well as “others.”

“I’m not going to say it out loud, because the information is attorney’s-eyes only, but….” Akrotirianakis said, trailing off as his co-counsel approached him at the lectern. After his fellow attorney whispered something in his ear, Akrotirianakis confirmed the identities.

The details were an exciting revelation in a case where NSO has been reluctant to provide information about its clients, practices, or the source code of its infamous “Pegasus” program, a phone surveillance virus that has been used to target civil rights leaders, journalists, and U.S. officials, among others.

However, Akrotirianakis was hesitant to give the judge any further information.

“Are you saying that the three countries that you just mentioned are responsible for the hack in this case?” asked Hamilton.

“At least 460 of them were from Mexico,” he confirmed, although he didn’t answer the judge’s further questions about whether it was the government of Mexico, merely responding that Pegasus is “licensed for territories.”

The judge grew frustrated with this “lack of specificity” from NSO, which became an enduring pattern throughout the rest of the hearing.

“It’s the best I can do here, shooting from the hip at the lectern,” Akrotirianakis said.

The companies also disagreed about what topics are fair game for the upcoming trial, which is only being used to determine damages after Hamilton granted summary judgment to WhatsApp in December.WhatsApp fought to keep the trial as narrowly focused as possible to prevent NSO from using arguments at trial that its surveillance is a necessary evil for fighting terrorism. NSO protested, arguing that its reasons for developing the program mattered heavily in determining damages.

“If they are going to ask a jury to determine punitive damages based on my client’s intent, it’s fair — it’s basically fair — for me to show what my client’s intent was,” Akrotirianakis said.

The judge also admonished the parties’ “luminous” number of requests to seal court documents, reminding them that we should not entertain further requests without good reason.

The least controversial detail of the hearing was that Hamilton agreed to keep the Pegasus program’s code out of the trial, which NSO argued could be useful to its competitors and the criminals it could look to pursue.

“The computer code can remain sealed,” the judge stated. “I don’t know how many juries understand computer code, so I don’t imagine it’ll come up.”

The judge also declined to hear arguments for a permanent injunction until after the trial, saying that there was too much danger of confusing the jury to address the arguments at this time.“I think it’s going to be complicated enough for the jury to follow,” she said.

Ironically, the judge accidentally voice-activated her virtual assistant 30 minutes into the hearing.

“Sorry. It’s Siri. I don’t know why she’s always listening.”

“I respect your privacy,” her phone responded, to much laughter from the courtroom.

The judge did not indicate when she would issue a ruling.

The case is scheduled for trial on April 28.

WhatsApp — an encrypted communication app owned by Facebook’s parent company Meta Platforms that boasts over 2 billion users around the world — originally brought the case to court in 2019 after Pegasus reportedly compromised the privacy of 1,400 activists, journalists and diplomats by covertly transferring the program to their phones via WhatsApp servers.

Pegasus allows the user to observe a cellphone’s location data and gain control over the device’s microphone and camera. Originally designed as a tool for government law enforcement and intelligence agencies, the software is NSO’s flagship product and is licensed to governments around the world.

To embed the spyware into someone’s phone, Pegasus clients send a text message that then invades devices through a malicious code lurking in these messages sent via WhatsApp, Telegram or other messaging services.

Once implanted, it can control a phone’s microphones and cameras while extracting the personal and location data of its owner — for example, by scraping browser history and contacts, grabbing screenshots, and infiltrating communications.

Pegasus can also infect users through missed phone calls and “zero-click” attacks, which do not require any action from the phone’s owner to succeed.

NSO Group says it only sells its spyware to legitimate government law enforcement and intelligence agencies vetted by Israel’s Defense Ministry for use against terrorists and criminals.

The company landed on the U.S. Commerce Department’s entity list in 2021 for activities counter to national security interests.

The Israel-based company has a history of struggling to cooperate with the court and has even faced sanctions for refusing to comply with previous orders. This case was filed in the Northern District of California and heard at the Ron V. Dellums Federal Courthouse in Oakland, California.