OAKLAND, Calif. (CN) — A federal judge Friday approved sanctions against Israeli spyware company NSO Group Technologies for withholding evidence in a computer fraud lawsuit by WhatsApp and its parent company Meta.
The judge ruled that the hacker-for-hire company deliberately failed to obey the court’s orders to produce the code for its controversial spyware program, Pegasus, so the court could examine claims of how the program accessed and extracted data from users’ phones, a key issue in the case.
“Overall, the court concludes that defendants have repeatedly failed to produce relevant discovery and failed to obey court orders regarding such discovery,” said U.S. District Judge Phyllis J. Hamilton in her 16-page order.
The Bill Clinton appointee also granted WhatsApp’s motion for partial summary judgment on claims NSO violated the
Computer Fraud and Abuse Act and other state computer fraud laws, along with a contract claim. The issue of damages, she ruled, will be decided at trial.
WhatsApp celebrated the decision and said it was proud to stand up against the notorious tech company, which was blacklisted by the U.S. government in 2021.
“After five years of litigation, we’re grateful for today’s decision. NSO can no longer avoid accountability for their unlawful attacks on WhatsApp, journalists, human rights activists and civil society,” a WhatsApp spokesperson told Courthouse News via email.
Although the judge believed terminating sanctions may be warranted in this situation, she said the court preferred not to issue such a harsh punishment where lesser ones were available. Instead, she issued evidentiary sanctions against NSO on key issues of the case.
Evidentiary sanctions are a punitive measure where the court can prevent a party from introducing certain facts into evidence. It’s usually reserved for parties found engaging in the misuse of the discovery process.
Hamilton’s decision to issue sanctions is the result of four months of frustration with NSO’s attempts to dodge producing the Pegasus code. In August, the court clarified its instructions after the tech company responded to a previous order by producing only the installation level of the code. Finding it insufficient to determine several key issues in the case, the court ordered NSO to produce the full code.
NSO claimed that the measure was unnecessary, but under court order, it produced the code — but only in Israel. The company argued that under Israeli law, it couldn’t produce the source code, but that making the code available in this way would comply with its discovery obligations. WhatsApp and the court, it claimed, could either use Israeli counsel to view the code, or they could seek an export license from the Israeli government to use the code in the U.S.
Hamilton called the move “simply impracticable” for a lawsuit litigated in her district, as part of her most recent order.
The cat-and-mouse game of technicality gamesmanship culminated in a fiery exchange between the judge and NSO’s attorneys at a hearing in November.
A member of NSO’s legal team could not be contacted for comment by press time.
WhatsApp — an encrypted communication app owned by Facebook’s parent company Meta Platforms that boasts over 2 billion users around the world — originally brought the case to court in 2019 after NSO’s cyber-surveillance spyware, Pegasus, reportedly compromised the privacy of 1,400 activists, journalists and diplomats via WhatsApp servers.
Pegasus is a program that allows the user to observe a cellphone’s location data and gain control over the device’s microphone and camera. Originally designed as a tool for government law enforcement and intelligence agencies, the software is NSO’s flagship product and is licensed to governments around the world.
To embed the spyware into someone’s phone, Pegasus clients send a text message which then invades devices through a malicious code lurking in these messages sent via WhatsApp, Telegram or other messaging services.
Once implanted, it can control a phone’s microphones and cameras while extracting the personal and location data of its owner — for example by scraping browser history and contacts, grabbing screenshots and infiltrating communications.
Pegasus can also infect users through missed phone calls and “zero-click” attacks, which do not require any action from the phone’s owner to succeed.
NSO Group says it says it only sells its spyware to legitimate government law enforcement and intelligence agencies vetted by Israel’s Defense Ministry for use against terrorists and criminals.
The company landed on the U.S. Commerce Department’s entity list in 2021 for activities counter to national security interests.