Judge weighs sanctions against Israeli spyware company NSO Technologies

OAKLAND, Calif. (CN) — Arguing for sanctions against NSO Group Technologies Thursday, WhatsApp and its parent company Meta claimed the Israeli hacker-for-hire company withheld evidence in WhatApp’s computer fraud lawsuit over NSO’s controversial spyware program, Pegasus.

“Their conduct has been willful. In a case about computer intrusions, the defendants have not produced the computer code in this case,” said Greg Andres of Davis Polk, who represents WhatsApp.

WhatsApp argued that NSO should be subject to terminating sanctions, or at the very least evidentiary sanctions, for its refusal to comply with a discovery order issued in August and for violating three federal court orders by refusing to produce the Pegasus source code.

“The court was clear about NSO’s discovery obligations, and NSO has willfully defied the court’s orders,” said WhatsApp in their recent motion.

NSO argues that Israeli law prevents them from producing the code out-of-country and that the full code is not necessary to the case.

Furthermore, NSO claims that it has produced the code in Israel, but the move leaves the code inaccessible by any lawyer at Meta, nor can it be brought to a court in the U.S. and used at trial.

“We even wanted them to violate Israeli law and produce us the code, but they wouldn’t and we only had three weeks for the order,” said Aaron Craig of King & Spalding, who represents NSO. So, he claims, they did what they could with what was possible.

The hearing culminated in a tense exchange between Craig and U.S. District Judge Phyllis J. Hamilton over whether NSO had complied with the order by producing the code in Israel.

“In my view, that is not sufficient,” said the judge.

“You may not think it is sufficient, but it is compliant with your order,” replied Craig.

“No, I don’t believe it is,” the judge said, adding that she expected a physical copy of the code to be present in court and that the defendants understood that was implied.  “I think anything else is pure gamesmanship.”

When Craig responded that he’d never seen any court levy terminating sanctions based on an implicit element of an order, the Clinton appointee, sounded like she had enough.

“Well, if that’s the position you’re going to take, I think I’ve heard enough,” she said as she leaned forward in her chair, presumably for her gavel.

“That’s not our entire position, Your Honor,” Craig said, quickly walking back the intensity of his statements.

Hamilton also heard a motion for summary judgment from WhatsApp on all four claims of its suit. NSO opposed the motions and moved for summary judgment on one of the claims.

Hamilton did not indicate when she would issue a ruling on either matter, which was heard in the U.S. District Court of Northern California.

WhatsApp — an encrypted communication app owned by Facebook’s parent company Meta Platforms that boasts over 2 billion users around the world — originally brought the case to court in 2019 after NSO’s cyber-surveillance spyware, Pegasus, reportedly compromised the privacy of 1,400 activists, journalists and diplomats via WhatsApp servers.

Pegasus is a program that allows the user to observe a cellphone’s location data and gain control over the device’s microphone and camera. Originally designed as a tool for government law enforcement and intelligence agencies, the software is NSO’s flagship product and is licensed to governments around the world.

To embed the spyware into someone’s phone, Pegasus clients send a text message which then invades devices through a malicious code lurking in these messages sent via WhatsApp, Telegram or other messaging services.

Once implanted, it can control a phone’s microphones and cameras while extracting the personal and location data of its owner — for example by scraping browser history and contacts, grabbing screenshots, and infiltrating communications.

Pegasus can also infect users through missed phone calls and  “zero-click” attacks, which do not require any action from the phone’s owner to succeed.

WhatsApp is seeking damages and a permanent injunction that prevents NSO and their affiliates from accessing their computer systems or engaging in further activities that could disrupt their platform’s functionality.

“We remain focused on protecting our users. We firmly believe that NSO’s operations violate U.S. law and they must be held to account for their unlawful operations," a WhatsApp spokesperson told Courthouse News.

NSO Group — blacklisted by the U.S. government in 2021 — says it says it only sells its spyware to legitimate government law enforcement and intelligence agencies vetted by Israel’s Defense Ministry for use against terrorists and criminals.

The company landed on the U.S. Commerce Department’s entity list in 2021 for activities counter to national security interests.