WhatsApp Inc. et al v. NSO Group Technologies Limited et al

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
United States District Court
Northern District of California
UNITED STATES DISTRICT COURT
NORTHERN DISTRICT OF CALIFORNIA
WHATSAPP INC., et al.,
Plaintiffs,
v.
NSO GROUP TECHNOLOGIES
LIMITED, et al.,
Defendants.
Case No. 19-cv-07123-PJH
ORDER DENYING MOTION FOR
CONTEMPT
Re: Dkt. 854, 879, 880
Plaintiffs’ motion for contempt came on for hearing on August 20, 2026. Plaintiffs
appeared through their counsel, Micah Block, Luca Marzorati, Antonio Perez-Marques,
and Greg Andres. Defendants appeared through their counsel, Kellen Dwyer. Having
read the papers filed by the parties and carefully considered their arguments and relevant
authority, and good cause appearing, the court hereby rules as follows.
A. 	Legal standard
“Civil contempt ... consists of a party’s disobedience to a specific and definite order
by failure to take all reasonable steps within the party's power to comply.” Epic Games,
Inc. v. Apple Inc., 161 F.4th 1162, 1176 (9th Cir. 2025) (citing In re Dual-Deck Video
Cassette Recorder Antitrust Litig., 10 F.3d 693, 695 (9th Cir. 1993)).
In a civil contempt action, “[t]he moving party has the burden of showing by clear
and convincing evidence that the contemnors violated a specific and definite order of the
court. The burden then shifts to the contemnors to demonstrate why they were unable to
comply.” FTC v. Enforma Natural Products, 362 F.3d 1204, 1211 (9th Cir. 2004) (citing
FTC v. Affordable Media, LLC, 179 F.3d 1228, 1239 (9th Cir.1999); Stone v. City and
County of San Francisco, 968 F.2d 850, 856 n. 9 (9th Cir.1992)).
Case 4:19-cv-07123-PJH Document 884 Filed 10/16/26 Page 1 of 11

2
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
United States District Court
Northern District of California
The contempt “need not be willful,” however, a person should not be held in
contempt if his action “appears to be based on a good faith and reasonable interpretation
of the court's order.” Reno Air Racing Ass’n, Inc. v. McCord, 452 F.3d 1126, 1130 (9th
Cir. 2006) (citing In re Crystal Palace Gambling Hall, Inc., 817 F.2d 1361, 1365 (9th
Cir.1987); but see also Dual-Deck Video Cassette Recorder, 10 F.3d at 695 (“there is no
good faith exception to the requirement of obedience to a court order.”).
“In contempt proceedings[,] ... a decree will not be expanded by implication or
intendment beyond the meaning of its terms,” but those terms must be “read in the light
of the issues and the purpose for which the suit was brought.” Epic Games v. Apple, 161
F.4th at 1176 (citing Terminal R.R. Ass'n of St. Louis v. United States, 266 U.S. 17, 29
(1924)).
B. 	Analysis
After plaintiffs prevailed at trial on their CFAA, CDAFA, and breach of contract
claims, plaintiffs sought a permanent injunction against defendants. For purposes of this
motion, the relevant provisions of the injunction are those prohibiting or requiring the
following conduct:
Paragraph 3(a): 	Developing, using, selling, offering for sale, distributing,
transferring, 	or 	licensing, 	whether 	directly 	or 	through 	a 	third 	party,
intermediary, or proxy, any technology that interacts with or emulates any
aspect of the WhatsApp Platform in any way, including as a method or
approach used to install and deploy the technology (an “installation vector”),
without first requesting and obtaining Plaintiffs’ express written permission;
Paragraph 3(d): Creating accounts, whether directly or through a third party,
intermediary, or proxy, on the WhatsApp Platform, without first requesting
and obtaining Plaintiffs’ express written permission.
Paragraph 4: The Prohibited Parties are required to delete and destroy any
and all computer code or technologies that use, access, or depend on the
WhatsApp Platform, including the WhatsApp Installation Server (“WIS”), to
delete all data obtained or derived from use of or access to the WhatsApp
Platform in the Prohibited Parties’ possession, and to disable customer
access to any and all computer code or technologies maintained by the
Prohibited Parties that use, access, or depend on the WhatsApp Platform.
Case 4:19-cv-07123-PJH Document 884 Filed 10/16/26 Page 2 of 11

3
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
United States District Court
Northern District of California
See Dkt. 809.
Plaintiffs now seek an order holding defendants in civil contempt for violating the
above provisions of the permanent injunction. Plaintiffs’ opening motion argued that
defendants had violated the injunction in two ways: (1) creating and operating Whatsapp
accounts, and (2) deploying one-click malicious URLs through the Whatsapp platform.
See Dkt. 854 at 9-10. However, in their opposition brief, defendants drew a distinction
between the alleged creation of new accounts and the alleged operation of pre-existing
Whatsapp accounts, the latter of which was not barred by the injunction, defendants
argued. See Dkt. 863 at 18-20. In their reply, Whatapp divides category (1) into two
subcategories – one for ‘creating’ Whatsapp accounts and one for ‘operating’ Whatsapp
accounts. See Dkt. 864 at 6-12.
Before reaching the merits of plaintiffs’ arguments regarding contempt, the court
must address and clarify the applicable legal standard, about which plaintiffs argue
several different positions. The court will also discuss the proper procedure for resolving
a contempt motion, including the parties’ arguments on whether an evidentiary hearing is
necessary.
When plaintiffs first filed their contempt motion, they did not discuss any need to
hold an evidentiary hearing. Instead, plaintiffs submitted the declaration of Andrew
Blaich, and only in their reply did plaintiffs offer that “Mr. Blaich is available to testify at
any evidentiary hearing the court may wish to hold.” See Dkt. 854-3; Dkt. 864 at 7.
In their reply, plaintiffs also expressly made the argument, for the first time, that a
court may grant a contempt motion on the papers, without any evidentiary hearing at all.
See Dkt. 864 at 7-8. Specifically, plaintiffs argued that the Ninth Circuit’s decisions in
Peterson v. Highland Music, Inc. and Hoffman ex rel. NLRB v. Beer Drivers & Salesmen’s
Loc. Union No. 888 held that a court may “treat as true the facts set forth in
uncontroverted affidavits,” and may, in turn, grant contempt motions on the basis of those
facts. See Peterson, 140 F.3d 1313, 1324 (9th Cir. 1998); Hoffman, 536 F.2d 1268, 1277
(9th Cir. 1977).
Case 4:19-cv-07123-PJH Document 884 Filed 10/16/26 Page 3 of 11

4
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
United States District Court
Northern District of California
In arguing that no hearing was necessary, plaintiffs also argued that their evidence
(i.e., the Blaich declaration) fully satisfied the “clear and convincing evidence” standard
that is applicable to a contempt motion.
Plaintiffs maintained their position at the motion hearing, arguing that the Peterson
case “stands for the very clear proposition at the Ninth Circuit that you do not need an
evidentiary hearing.” See Dkt. 878 at 44.
Later in the motion hearing, plaintiffs explained that, if the court was not convinced
that they had already satisfied the “clear and convincing evidence” standard, that the
“correct next step is an order to show cause” issued to defendants, directing them to
present evidence to rebut plaintiffs’ evidentiary showing. See Dkt. 878 at 42.
In contrast, defendants argued that there was no need to issue an order to show
cause or hold an evidentiary hearing, because plaintiffs’ evidence was not sufficient to
meet the “clear and convincing evidence” standard. See Dkt. 878 at 20-22. Defendants
argued that plaintiffs were misstating the relevant standard by claiming that the Blaich
declaration was enough to shift the evidentiary burden from plaintiffs to defendants.
Defendants argued that the proper application of the standard was to first require
plaintiffs’ evidence to meet the “clear and convincing evidence” standard, and only if that
occurred, then the burden would shift to the defendants to rebut the plaintiffs’ showing.
See id.
At the end of the hearing, the court noted that the parties’ briefing did not discuss
these procedural issues, and thus directed the parties to file supplemental briefs with
their competing procedural proposals to resolve the contempt motion. See Dkt. 878 at
53.
Plaintiffs’ supplemental brief again argued that “the court should find NSO in
contempt on the papers.” See Dkt. 879 at 2. Plaintiffs argued that their evidence already
satisfied the “clear and convincing evidence” standard, and that Peterson and Hoffman
were clear in holding that an evidentiary hearing was not required in order to issue a
contempt order. See id. at 2-3. Plaintiffs argued only “in the alternative” that the court
Case 4:19-cv-07123-PJH Document 884 Filed 10/16/26 Page 4 of 11

5
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
United States District Court
Northern District of California
could issue an order to show cause and require defendants to come forth with evidence
to rebut plaintiffs’ showing. Importantly, plaintiffs also articulated a new standard for
determining whether to issue an order to show cause – plaintiffs argued that “the court
need only find that there has been a ‘sufficient preliminary showing’ of contempt to
require the alleged contemnor to come forward with evidence.” See id. at 3.
Plaintiffs’ supplemental brief contained the first mention of this new “sufficient
preliminary showing” standard. For support, plaintiffs cited to Epic Games, Inc. v. Apple
Inc., No. 20-cv-5640, Dkt. 925 (N.D. Cal. Apr. 23, 2024). However, in that order, the
court did not purport to set out a new legal standard; in fact, the Epic court specifically
noted that “[t]o succeed on such a motion, Epic Games must show, by clear and
convincing evidence, that (1) Apple violated the injunction, (2) its violation was ‘beyond
substantial compliance,’ and (3) its conduct was ‘not based on any good faith and
reasonable interpretation of the injunction.’” Id. (emphasis added). When the Epic court
ultimately concluded that “Epic Games has made a sufficient preliminary showing that,
viewed holistically, Apple’s practice changes undermine the spirit of the injunction by
limiting competition, impeding the free flow of information, and constraining user choice,”
it was implicitly applying the “clear and convincing evidence” standard and determining
that the plaintiff had indeed made a sufficient preliminary showing under that “clear and
convincing evidence” standard.
Plaintiffs also cite three other cases from this district. See Hernandez v. City of
Monterey, No. 13-cv-2354, Dkt. 900 (N.D. Cal. Aug. 2, 2024); Vasquez v. Libre, 2023 WL
360242 (N.D. Cal. Jan. 23, 2023); Facebook v. Power Ventures, 2017 WL 3394754 (N.D.
Cal. Aug. 8, 2017). While plaintiffs are correct that those cases involved proceedings
where the court held some type of evidentiary hearing and/or directed the alleged
contemnors to certify compliance, all of them also involved only the ‘clear and convincing’
evidentiary standard, rather than any sort of lower ‘preliminary’ standard. In each of
those cases, the court applied the ‘clear and convincing’ standard and found that it was
met, and ordered further proceedings/submissions only after finding that the standard
Case 4:19-cv-07123-PJH Document 884 Filed 10/16/26 Page 5 of 11

6
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
United States District Court
Northern District of California
was met. That is consistent with the ‘burden-shifting’ framework identified back in
plaintiffs’ opening motion – the initial burden is indeed the ‘clear and convincing’ burden,
and only if plaintiffs meet that standard does the burden shift to the contemnors to show
compliance. See Dkt. 854 at 9; see also Dkt. 880 at 3 (citing FTC v. Affordable Media).
Defendants’ supplemental brief makes the same argument that they made in their
opposition brief – that plaintiffs have misstated the burden-shifting framework, and that
plaintiffs must first meet the “clear and convincing evidence” standard before the burden
shifts to defendants to rebut the evidentiary showing. See Dkt. 880 at 3-4.
Having reviewed all of the authority cited by the parties, the court concludes that
defendants are correct that plaintiffs’ evidence must meet the “clear and convincing
evidence” standard before the burden shifts to defendants to rebut the evidentiary
showing. The court has found no lower, preliminary standard that applies to the decision
to issue an order to show cause. Thus, the first proper inquiry for the court is to
determine whether the evidence submitted in support of plaintiffs’ contempt motion is
sufficient to constitute “clear and convincing evidence” of contempt. If it does, the court
can then determine whether it is preferable to issue an order to show cause, or to simply
grant the contempt motion on the same basis as in Peterson and Hoffman.
As mentioned above, plaintiffs’ evidentiary showing consists entirely of the
declaration of Andrew Blaich, a security engineer investigator on the ‘threat intelligence’
team at Meta. See Dkt. 854-3. And as also mentioned above, plaintiffs set forth three
categories1 of defendants’ conduct that they allege violate the injunction: (1) creating
Whatsapp accounts, (2) operating Whatsapp accounts, and (3) deploying one-click
malicious URLs through the Whatsapp platform. See Dkt. 864 at 6-12.
1. 	Creating Whatsapp accounts
Plaintiffs argue that defendants violated paragraph 3(d) of the injunction by
1 At the motion hearing, plaintiffs attempted to add a fourth alleged category of injunction-
violating conduct, but the court rejected that attempt, because the defendants had no
opportunity to meaningfully respond to a newly-raised argument. See Dkt. 878 at 14.
Case 4:19-cv-07123-PJH Document 884 Filed 10/16/26 Page 6 of 11

7
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
United States District Court
Northern District of California
creating new Whatsapp accounts. Plaintiffs rely on the testimony of Blaich, who
submitted a declaration attesting that NSO created at least 23 new accounts after the
injunction took effect. See Dkt. 854-3, ¶ 7.
Specifically, Blaich states that 23 new Whatsapp accounts were created, bearing
“technical and behavioral signatures that Meta has previously associated with NSO
testing, including account registration patterns, device and other related information, and
connections to known NSO-controlled infrastructure.” Blaich decl. (Dkt. 854-3), ¶ 7, 9.
Defendants respond by arguing that plaintiffs have not provided the account
names, phone numbers, or any other identifying information for the 23 accounts in
question. See Dkt. 863 at 16-18. Defendants argue that, without such identifying
information, plaintiffs’ evidence cannot meet the “clear and convincing evidence”
standard.
At the motion hearing, plaintiffs acknowledged that they were “very concerned
about disclosing to NSO the precise tools” used to “track their activity,” and that it “would
be problematic” to “force us [i.e., plaintiffs] to give up the specific markers by which we
were able to identify these particular accounts.” See Dkt. 878 at 10-11. Instead, plaintiffs
described their approach as follows: “what we’ve done here is say, ‘Here is an affidavit. If
you can controvert it, please go ahead.’” Id. at 11.
In the court’s view, plaintiffs took a calculated risk in choosing to limit the level of
detail in their supporting evidence. The upside was described in the previous paragraph
– plaintiffs were able to limit the information about their tracking activity that was made
available to defendants. However, the downside is that the lack of specificity in the
Blaich declaration prevents the court from being able to conclude that they have met the
“clear and convincing evidence” standard. The court agrees with the argument, made by
defendants, that plaintiffs are asking the court to “simply accept Mr. Blaich’s assurance
that he has looked at Whatsapp’s undisclosed internal evidence and concluded, ‘with
high confidence,’ that NSO created new Whatsapp accounts.” See Dkt. 863 at 18.
Similarly, the Blaich declaration asserts that the 23 new accounts “share technical
Case 4:19-cv-07123-PJH Document 884 Filed 10/16/26 Page 7 of 11

8
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
United States District Court
Northern District of California
and behavioral signatures that Meta has previously associated with NSO testing,” but
provides little detail about what those “technical and behavioral signatures” actually are,
stating only in general terms that they include “account registration patterns, device and
other related information, and connections to known NSO-controlled infrastructure.” See
Blaich decl. (Dkt. 854-3), ¶ 7, 9.
Overall, the court concludes that plaintiffs’ evidence that defendants have created
new Whatsapp accounts, in violation of the permanent injunction, fails to meet the
applicable “clear and convincing evidence” standard. Accordingly, the court will not enter
an order to show cause. The court also concludes that the failure to meet the applicable
legal standard distinguishes this case from Peterson and Hoffman. Thus, plaintiffs’
motion for contempt on the basis that defendants have created new Whastapp accounts
is DENIED.
2. 	Operating Whatsapp accounts
As discussed above, plaintiffs’ opening contempt motion grouped “creating” and
“operating” Whatsapp accounts into a single category of conduct. See Dkt. 854 at 9-10.
However, defendants’ opposition brief argued that the injunction “does not bar NSO
employees from using pre-existing Whatsapp accounts,” and plaintiffs’ reply separated
their arguments about “creating” new accounts from their arguments about “operating”
pre-existing accounts. Thus, the threshold question for the court is whether the language
of the injunction actually does prohibit defendants from using pre-existing Whatsapp
accounts.
While plaintiffs initially relied on paragraph 3(d) of the injunction, which barred
“[c]reating accounts, whether directly or through a third party, intermediary, or proxy, on
the WhatsApp Platform,” plaintiffs now argue that the operation of already-existing
Whatsapp accounts violates paragraph 3(a) of the injunction, which prohibits “using . . .
any technology that interacts with or emulates any aspect of the WhatsApp Platform in
any way.” Plaintiffs also argue that, to the extent that the Whatsapp app itself cannot
constitute “technology that interacts with” Whatsapp, that the cellphones used to interact
Case 4:19-cv-07123-PJH Document 884 Filed 10/16/26 Page 8 of 11

9
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
United States District Court
Northern District of California
with Whatsapp are themselves the applicable “technology.” Dkt. 864 at 11.
Defendants argue that the injunction’s language could have barred them from
using Whatsapp “for any purpose” if plaintiffs had so chosen, and argue that any
ambiguities should be resolved against the party who drafted the language. See Dkt. 863
at 20.
Though a close call, the court agrees that the language of the injunction is
ambiguous at best in prohibiting all uses of pre-existing Whatsapp accounts, and that the
ambiguity should be resolved against plaintiffs, who, at the court’s request, due to the
complexity of and the secrecy surrounding the technology, drafted the injunction’s
language. Plaintiffs’ interpretation of paragraph 3(a) to cover any and all uses of pre-
existing accounts is a tortured one, and not what the court had in mind by issuing an
order that prohibited using “any technology that interacts with or emulates any aspect of
the WhatsApp Platform in any way.” Accordingly, plaintiffs’ motion for contempt is
DENIED to the extent that it is premised on defendants’ alleged use of pre-existing
Whatsapp accounts.
3. 	Deploying one-click malicious URLs through the Whatsapp platform
Plaintiffs claim that defendants violated paragraph 3(a) of the injunction by “using .
. . developing . . . distributing, transferring, or licensing . . . technology that interacts with
or emulates any aspect of the Whatsapp platform,” and paragraph 4 of the injunction by
failing to “disable customer access to any and all computer code or technologies” that
depend on the Whatsapp platform.
As before, plaintiffs rely on the Blaich declaration, which states that, in February
and April 2026, a NSO-affiliated Whatsapp account sent malicious URLs to targets over
Whatsapp. Blaich decl., ¶¶ 16-17. Blaich states that the attribution to NSO was based
on five factors: (1) URL infrastructure (i.e., the format of the URLs), (2) URL redirect
behavior, (3) lure design (i.e., the message templates were similar to those used by NSO
in the past), (4) targeting profile (i.e., the locations of the targets match areas in which
Pegasus has been used), and (5) continuity with prior NSO conduct. Blaich decl., ¶ 18.
Case 4:19-cv-07123-PJH Document 884 Filed 10/16/26 Page 9 of 11

10
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
United States District Court
Northern District of California
Defendants make two arguments in response: (1) plaintiffs’ evidence does not
meet the “clear and convincing evidence” standard, and (2) the injunction does not
prohibit sovereign governments from using Whatsapp to send URLs to targets of their
operations. See Dkt. 863 at 22-28.
The court will start with the second argument, because it presents a threshold
question. Defendants seek a blanket ruling that an “independent decision by an NSO
customer to text a malicious URL to a target via Whatsapp” does not violate the
injunction, without any further information needed. See Dkt. 880 at 8-9. But the court
cannot go that far. Simply put, there are not enough details before the court about the
division of labor between defendants and their sovereign customers. In other words,
when one of those customers chooses to “text a malicious URL to a target,” to what
extent are defendants involved in the technical operations that occur after the URL is
clicked? To what extent do defendants operate and maintain the software that is
downloaded onto the target’s device? The answers to these questions are relevant to
whether the challenged conduct is indeed solely an act of the customers (and thus
outside the injunction’s scope), or whether defendants participate in the conduct, which
would bring the conduct within the scope of behavior prohibited by the injunction.
That leaves the question of whether plaintiffs’ evidence is sufficient to constitute
“clear and convincing evidence” that defendants were indeed involved in the deploying of
malicious URLs through the Whatsapp platform. As mentioned above, plaintiffs rely on
the Blaich declaration to tie defendants to the deployments, and he stated that the
attribution to NSO was based on the five factors set forth above. Blaich decl., ¶ 18.
Overall, as with the evidence regarding the creation of new Whatsapp accounts,
the court concludes that the details provided in the Blaich declaration are simply not
enough to meet the demanding “clear and convincing evidence” standard. As before, it
appears that plaintiffs’ approach was to err on the side of under-disclosing details at first,
hoping that the court would allow them a second bite at the apple by supplementing their
evidence later, including through the order to show cause procedure. But as discussed
Case 4:19-cv-07123-PJH Document 884 Filed 10/16/26 Page 10 of 11

11
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
United States District Court
Northern District of California
above, the Ninth Circuit has not provided for a procedure where a plaintiff may make a
‘placeholder’ evidentiary showing at first, and then supplement it later if the evidence falls
short of the “clear and convincing” standard. Instead, the plaintiff’s initial showing must
meet the “clear and convincing evidence” standard. For that reason, plaintiffs’ motion for
contempt must be DENIED to the extent it is based on the alleged deployment of
malicious URLs through the Whatsapp platform.
C. 	Conclusion
For the foregoing reasons, plaintiffs’ motion for contempt (Dkt. 854) is DENIED.
IT IS SO ORDERED.
Dated: October 16, 2026
/s/ Phyllis J. Hamilton
PHYLLIS J. HAMILTON
United States District Judge
Case 4:19-cv-07123-PJH Document 884 Filed 10/16/26 Page 11 of 11