NSO Group works to explain no-show in court for WhatsApp suit, plots defense

Facebook claims NSO Group was a no-show, NSO Group says Facebook is lying.

The Israeli surveillance software firm accused of exploiting WhatsApp to run surveillance operations against users has asked the court for a 120-day extension to reply to WhatsApp’s lawsuit.

NSO Group alleges that Facebook, WhatsApp’s parent company, lied in a recent procedural filing about whether it had properly served NSO Group under The Hague Convention, according to court documents filed with the U.S. District Court for the Northern District of California obtained by CyberScoop.

“Facebook lied to the court in its February 27 application for default, saying that service was complete,” NSO Group said in a statement shared with CyberScoop. “In fact, Facebook and its lawyers had been told two days earlier (February 25) by the Government of Israel that service under the Hague Convention was not complete — a fact Facebook concealed from the court.”

It’s the latest logistics squabble in the case, which alleges NSO Group’s custom malware was used against thousands of WhatsApp users last year. NSO Group’s accusation comes days after Facebook accused NSO Group of being a no-show in court, where the company could have responded to the surveillance allegations.

Facebook accused NSO Group of deciding not to defend their actions.

“NSO Group has chosen not to appear or otherwise defend their actions in court. The dangerous proliferation of hacking tools sold and operated by NSO Group pose a clear threat to the safety of users everywhere,” Facebook said in a statement.

WhatsApp urged the court to not acquiesce to NSO Group’s requests for an extension to respond, according to court documents filed late Monday evening.

“The Court should not permit Defendants’ procedural gamesmanship,” attorneys for WhatsApp and Facebook said in one filing, obtained by CyberScoop. “Defendants have had more than four months to prepare their response to the Complaint.”

Facebook, which claims it did not mislead the court in the filings, proposed the default filing be set aside so that the case can proceed on its merits, according to the filings.

It is unclear if the court has agreed to NSO Group’s request for an extension to reply.

Clues about NSO Group’s ‘immunity’ defense

The court filings also reveal NSO Group plans to hinge its defense on a “sovereign immunity” claim, which is usually invoked by nation-states to argue immunity when trying to avoid civil damages in other countries. Because NSO Group claims its products are used only by nation-states for national security purposes, NSO Group plans to argue a “derivative” of that claim, according to the documents.

“Obtaining evidence to support Defendants’ derivative foreign sovereign immunity argument will be delicate,” the lawyers’ filing notes. “Given the security concerns and varying national security legal frameworks, defendants ask for an extended briefing schedule to have a fair opportunity to ascertain what information — if any — may be disclosed to this Court by these sovereign nations.”

NSO’s CEO Shalev Hulio issued a rare comment on the matter through an affidavit.

“NSO Group’s only customers are sovereign states and the intelligence and law enforcement agencies of sovereign states, which use NSO Group’s products in furtherance of their national security interests,” reads Hulio’s affidavit, obtained by CyberScoop.

And yet, that argument could prompt prosecutors to raise allegations that NSO Groups’ spyware has been used against human rights activists and journalists, as researchers and nonprofits have alleged on multiple occasions.

Meta accuses NSO Group of defying spyware injunction, files contempt of court complaint

The company said it spotted a spearphishing campaign linked to the Israeli spyware maker targeting WhatsApp users, despite a court order prohibiting it.

WhatsApp releases account feature that looks to combat spyware

NSO Group argues WhatsApp injunction threatens existence, future U.S. government work

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems