Judge limits evidence about NSO Group customers, victims in damages trial

The ruling strikes at NSO Group’s fundamental strategy in the case, one observer noted.

A federal judge last week placed strict limits on the kind of evidence NSO Group can raise during a trial on damages in the lawsuit WhatsApp brought against the spyware vendor over allegations it hacked 1,400 of the messaging platform’s users.

Under the order, NSO Group is prohibited from presenting evidence about its customers’ identities, implying  the targeted WhatsApp users are suspected or actual criminals, or alleging that WhatsApp had insufficient security protections.

It’s a ruling that strikes at NSO Group’s fundamental strategy in the case, said Natalia Krapiva, senior tech-legal counsel at Access Now. 

“This ruling is a win not just for WhatsApp but also for WhatsApp’s users who were victims of Pegasus hacking,” she said. “NSO’s strategy has been to try to attack the reputation of civil society victims, claiming that they were in fact criminals and terrorists and therefore deserved to be hacked. The court’s ruling will make it very difficult for NSO to launch such attacks. The trial will have to be focused on the conduct of NSO Group, not its clients or victims. As it should.”

NSO Group has revealed some client information as part of the case.

In making her ruling, Northern District of California Judge Phyllis Hamilton said NSO Group undercut its arguments to use evidence about its customers with contradictory statements.

“Defendants cannot claim, on the one hand, that its intent is to help its clients fight terrorism and child exploitation, and on the other hand say that it has nothing to do with what its client does with the technology, other than advice and support,” she wrote. “Additionally, there is no evidence as to the specific kinds of crimes or security threats that its clients actually investigate and none with respect to the attacks at issue.”

Hamilton ruled in favor of WhatsApp last December in an unprecedented legal blow against NSO Group. Courts have proven a difficult avenue to challenge spyware makers.

A spokesman for the Israel-based firm declined comment.

“For over five years NSO has tried every trick in the book to delay these trial proceedings and hide potential evidence while simultaneously demanding other parties to disclose sensitive information that is not relevant to the trial,” Krapiva said. “The court has been extremely patient with NSO and gave it a lot of benefit of a doubt. But it looks like the patience has run out.”

NSO Group, too, won some concessions in the ruling. WhatsApp cannot introduce evidence of the identities and occupations of the 1,400 targets, nor evidence about other lawsuits against NSO over the use of Pegasus related to the death of Washington Post journalist Jamal Khashoggi. WhatsApp did not oppose the second motion, and the first motion was rendered moot by the ruling on limitations on NSO Group — WhatsApp had said it would want to respond if NSO Group introduced evidence of criminal behavior by WhatsApp users.

Meta accuses NSO Group of defying spyware injunction, files contempt of court complaint

The company said it spotted a spearphishing campaign linked to the Israeli spyware maker targeting WhatsApp users, despite a court order prohibiting it.

WhatsApp releases account feature that looks to combat spyware

NSO Group argues WhatsApp injunction threatens existence, future U.S. government work

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems