WhatsApp Inc. v. NSO Group Technologies Limited — Entry #884: ORDER by Judge Hamilton denying 854 motion for contempt
Case: WhatsApp Inc. v. NSO Group Technologies Limited cand · 4:19-cv-07123
filed October 29, 2019
What this document is
Docket entry #884 · filed October 16, 2026
ORDER by Judge Hamilton denying 854 motion for contempt. (pjhlc3, COURT STAFF) (Filed on 10/16/2026)
Who is involved
- Bill Marczak
- Francisco Partners LP
- Josh Shaner
- King & Spalding LLP
- Meta Platforms, Inc.
- NSO Group Technologies Limited
- Q Cyber Technologies Limited
- Terry Divittorio
- The Citizen Lab
- United States Department of Justice
- Westbridge Technologies, Inc.
- WhatsApp Inc.
Why we have it
We follow this case because it names a company we track, although that company is not a party:
- Nebius: its former name “Yandex N.V.” appears in a filing in this case.
….8 11 Perfect 10, Inc. v. Yandex N.V., No. C 12-1521-WHA,…
A free copy from the RECAP archive of federal court filings (mirrored at the Internet Archive), retrieved November 11, 2026. Federal court filings are public records.
Document text
11 page(s), 39,046 characters, converted from the PDF's text layer · plain text.
Full text
Case 4:19-cv-07123-PJH Document 884 Filed 10/16/26 Page 1 of 11
1
2 UNITED STATES DISTRICT COURT
3 NORTHERN DISTRICT OF CALIFORNIA
4
5
WHATSAPP INC., et al.,
6 Case No. 19-cv-07123-PJH
Plaintiffs,
7
v. ORDER DENYING MOTION FOR
8 CONTEMPT
NSO GROUP TECHNOLOGIES
9 LIMITED, et al., Re: Dkt. 854, 879, 880
10 Defendants.
11
12
United States District Court
13 Plaintiffs’ motion for contempt came on for hearing on August 20, 2026. Plaintiffs
14 appeared through their counsel, Micah Block, Luca Marzorati, Antonio Perez-Marques,
15 and Greg Andres. Defendants appeared through their counsel, Kellen Dwyer. Having
Northern District of California
16 read the papers filed by the parties and carefully considered their arguments and relevant
17 authority, and good cause appearing, the court hereby rules as follows.
18 A. Legal standard
19 “Civil contempt ... consists of a party’s disobedience to a specific and definite order
20 by failure to take all reasonable steps within the party's power to comply.” Epic Games,
21 Inc. v. Apple Inc., 161 F.4th 1162, 1176 (9th Cir. 2025) (citing In re Dual-Deck Video
22 Cassette Recorder Antitrust Litig., 10 F.3d 693, 695 (9th Cir. 1993)).
23 In a civil contempt action, “[t]he moving party has the burden of showing by clear
24 and convincing evidence that the contemnors violated a specific and definite order of the
25 court. The burden then shifts to the contemnors to demonstrate why they were unable to
26 comply.” FTC v. Enforma Natural Products, 362 F.3d 1204, 1211 (9th Cir. 2004) (citing
27 FTC v. Affordable Media, LLC, 179 F.3d 1228, 1239 (9th Cir.1999); Stone v. City and
28 County of San Francisco, 968 F.2d 850, 856 n. 9 (9th Cir.1992)).
Case 4:19-cv-07123-PJH Document 884 Filed 10/16/26 Page 2 of 11
1 The contempt “need not be willful,” however, a person should not be held in
2 contempt if his action “appears to be based on a good faith and reasonable interpretation
3 of the court's order.” Reno Air Racing Ass’n, Inc. v. McCord, 452 F.3d 1126, 1130 (9th
4 Cir. 2006) (citing In re Crystal Palace Gambling Hall, Inc., 817 F.2d 1361, 1365 (9th
5 Cir.1987); but see also Dual-Deck Video Cassette Recorder, 10 F.3d at 695 (“there is no
6 good faith exception to the requirement of obedience to a court order.”).
7 “In contempt proceedings[,] ... a decree will not be expanded by implication or
8 intendment beyond the meaning of its terms,” but those terms must be “read in the light
9 of the issues and the purpose for which the suit was brought.” Epic Games v. Apple, 161
10 F.4th at 1176 (citing Terminal R.R. Ass'n of St. Louis v. United States, 266 U.S. 17, 29
11 (1924)).
12 B. Analysis
United States District Court
13 After plaintiffs prevailed at trial on their CFAA, CDAFA, and breach of contract
14 claims, plaintiffs sought a permanent injunction against defendants. For purposes of this
15 motion, the relevant provisions of the injunction are those prohibiting or requiring the
Northern District of California
16 following conduct:
17
Paragraph 3(a): Developing, using, selling, offering for sale, distributing,
18 transferring, or licensing, whether directly or through a third party,
intermediary, or proxy, any technology that interacts with or emulates any
19 aspect of the WhatsApp Platform in any way, including as a method or
approach used to install and deploy the technology (an “installation vector”),
20
without first requesting and obtaining Plaintiffs’ express written permission;
21
22 Paragraph 3(d): Creating accounts, whether directly or through a third party,
intermediary, or proxy, on the WhatsApp Platform, without first requesting
23 and obtaining Plaintiffs’ express written permission.
24
Paragraph 4: The Prohibited Parties are required to delete and destroy any
25 and all computer code or technologies that use, access, or depend on the
WhatsApp Platform, including the WhatsApp Installation Server (“WIS”), to
26
delete all data obtained or derived from use of or access to the WhatsApp
27 Platform in the Prohibited Parties’ possession, and to disable customer
access to any and all computer code or technologies maintained by the
28 Prohibited Parties that use, access, or depend on the WhatsApp Platform.
2
Case 4:19-cv-07123-PJH Document 884 Filed 10/16/26 Page 3 of 11
1 See Dkt. 809.
2 Plaintiffs now seek an order holding defendants in civil contempt for violating the
3 above provisions of the permanent injunction. Plaintiffs’ opening motion argued that
4 defendants had violated the injunction in two ways: (1) creating and operating Whatsapp
5 accounts, and (2) deploying one-click malicious URLs through the Whatsapp platform.
6 See Dkt. 854 at 9-10. However, in their opposition brief, defendants drew a distinction
7 between the alleged creation of new accounts and the alleged operation of pre-existing
8 Whatsapp accounts, the latter of which was not barred by the injunction, defendants
9 argued. See Dkt. 863 at 18-20. In their reply, Whatapp divides category (1) into two
10 subcategories – one for ‘creating’ Whatsapp accounts and one for ‘operating’ Whatsapp
11 accounts. See Dkt. 864 at 6-12.
12 Before reaching the merits of plaintiffs’ arguments regarding contempt, the court
United States District Court
13 must address and clarify the applicable legal standard, about which plaintiffs argue
14 several different positions. The court will also discuss the proper procedure for resolving
15 a contempt motion, including the parties’ arguments on whether an evidentiary hearing is
Northern District of California
16 necessary.
17 When plaintiffs first filed their contempt motion, they did not discuss any need to
18 hold an evidentiary hearing. Instead, plaintiffs submitted the declaration of Andrew
19 Blaich, and only in their reply did plaintiffs offer that “Mr. Blaich is available to testify at
20 any evidentiary hearing the court may wish to hold.” See Dkt. 854-3; Dkt. 864 at 7.
21 In their reply, plaintiffs also expressly made the argument, for the first time, that a
22 court may grant a contempt motion on the papers, without any evidentiary hearing at all.
23 See Dkt. 864 at 7-8. Specifically, plaintiffs argued that the Ninth Circuit’s decisions in
24 Peterson v. Highland Music, Inc. and Hoffman ex rel. NLRB v. Beer Drivers & Salesmen’s
25 Loc. Union No. 888 held that a court may “treat as true the facts set forth in
26 uncontroverted affidavits,” and may, in turn, grant contempt motions on the basis of those
27 facts. See Peterson, 140 F.3d 1313, 1324 (9th Cir. 1998); Hoffman, 536 F.2d 1268, 1277
28 (9th Cir. 1977).
3
Case 4:19-cv-07123-PJH Document 884 Filed 10/16/26 Page 4 of 11
1 In arguing that no hearing was necessary, plaintiffs also argued that their evidence
2 (i.e., the Blaich declaration) fully satisfied the “clear and convincing evidence” standard
3 that is applicable to a contempt motion.
4 Plaintiffs maintained their position at the motion hearing, arguing that the Peterson
5 case “stands for the very clear proposition at the Ninth Circuit that you do not need an
6 evidentiary hearing.” See Dkt. 878 at 44.
7 Later in the motion hearing, plaintiffs explained that, if the court was not convinced
8 that they had already satisfied the “clear and convincing evidence” standard, that the
9 “correct next step is an order to show cause” issued to defendants, directing them to
10 present evidence to rebut plaintiffs’ evidentiary showing. See Dkt. 878 at 42.
11 In contrast, defendants argued that there was no need to issue an order to show
12 cause or hold an evidentiary hearing, because plaintiffs’ evidence was not sufficient to
United States District Court
13 meet the “clear and convincing evidence” standard. See Dkt. 878 at 20-22. Defendants
14 argued that plaintiffs were misstating the relevant standard by claiming that the Blaich
15 declaration was enough to shift the evidentiary burden from plaintiffs to defendants.
Northern District of California
16 Defendants argued that the proper application of the standard was to first require
17 plaintiffs’ evidence to meet the “clear and convincing evidence” standard, and only if that
18 occurred, then the burden would shift to the defendants to rebut the plaintiffs’ showing.
19 See id.
20 At the end of the hearing, the court noted that the parties’ briefing did not discuss
21 these procedural issues, and thus directed the parties to file supplemental briefs with
22 their competing procedural proposals to resolve the contempt motion. See Dkt. 878 at
23 53.
24 Plaintiffs’ supplemental brief again argued that “the court should find NSO in
25 contempt on the papers.” See Dkt. 879 at 2. Plaintiffs argued that their evidence already
26 satisfied the “clear and convincing evidence” standard, and that Peterson and Hoffman
27 were clear in holding that an evidentiary hearing was not required in order to issue a
28 contempt order. See id. at 2-3. Plaintiffs argued only “in the alternative” that the court
4
Case 4:19-cv-07123-PJH Document 884 Filed 10/16/26 Page 5 of 11
1 could issue an order to show cause and require defendants to come forth with evidence
2 to rebut plaintiffs’ showing. Importantly, plaintiffs also articulated a new standard for
3 determining whether to issue an order to show cause – plaintiffs argued that “the court
4 need only find that there has been a ‘sufficient preliminary showing’ of contempt to
5 require the alleged contemnor to come forward with evidence.” See id. at 3.
6 Plaintiffs’ supplemental brief contained the first mention of this new “sufficient
7 preliminary showing” standard. For support, plaintiffs cited to Epic Games, Inc. v. Apple
8 Inc., No. 20-cv-5640, Dkt. 925 (N.D. Cal. Apr. 23, 2024). However, in that order, the
9 court did not purport to set out a new legal standard; in fact, the Epic court specifically
10 noted that “[t]o succeed on such a motion, Epic Games must show, by clear and
11 convincing evidence, that (1) Apple violated the injunction, (2) its violation was ‘beyond
12 substantial compliance,’ and (3) its conduct was ‘not based on any good faith and
United States District Court
13 reasonable interpretation of the injunction.’” Id. (emphasis added). When the Epic court
14 ultimately concluded that “Epic Games has made a sufficient preliminary showing that,
15 viewed holistically, Apple’s practice changes undermine the spirit of the injunction by
Northern District of California
16 limiting competition, impeding the free flow of information, and constraining user choice,”
17 it was implicitly applying the “clear and convincing evidence” standard and determining
18 that the plaintiff had indeed made a sufficient preliminary showing under that “clear and
19 convincing evidence” standard.
20 Plaintiffs also cite three other cases from this district. See Hernandez v. City of
21 Monterey, No. 13-cv-2354, Dkt. 900 (N.D. Cal. Aug. 2, 2024); Vasquez v. Libre, 2023 WL
22 360242 (N.D. Cal. Jan. 23, 2023); Facebook v. Power Ventures, 2017 WL 3394754 (N.D.
23 Cal. Aug. 8, 2017). While plaintiffs are correct that those cases involved proceedings
24 where the court held some type of evidentiary hearing and/or directed the alleged
25 contemnors to certify compliance, all of them also involved only the ‘clear and convincing’
26 evidentiary standard, rather than any sort of lower ‘preliminary’ standard. In each of
27 those cases, the court applied the ‘clear and convincing’ standard and found that it was
28 met, and ordered further proceedings/submissions only after finding that the standard
5
Case 4:19-cv-07123-PJH Document 884 Filed 10/16/26 Page 6 of 11
1 was met. That is consistent with the ‘burden-shifting’ framework identified back in
2 plaintiffs’ opening motion – the initial burden is indeed the ‘clear and convincing’ burden,
3 and only if plaintiffs meet that standard does the burden shift to the contemnors to show
4 compliance. See Dkt. 854 at 9; see also Dkt. 880 at 3 (citing FTC v. Affordable Media).
5 Defendants’ supplemental brief makes the same argument that they made in their
6 opposition brief – that plaintiffs have misstated the burden-shifting framework, and that
7 plaintiffs must first meet the “clear and convincing evidence” standard before the burden
8 shifts to defendants to rebut the evidentiary showing. See Dkt. 880 at 3-4.
9 Having reviewed all of the authority cited by the parties, the court concludes that
10 defendants are correct that plaintiffs’ evidence must meet the “clear and convincing
11 evidence” standard before the burden shifts to defendants to rebut the evidentiary
12 showing. The court has found no lower, preliminary standard that applies to the decision
United States District Court
13 to issue an order to show cause. Thus, the first proper inquiry for the court is to
14 determine whether the evidence submitted in support of plaintiffs’ contempt motion is
15 sufficient to constitute “clear and convincing evidence” of contempt. If it does, the court
Northern District of California
16 can then determine whether it is preferable to issue an order to show cause, or to simply
17 grant the contempt motion on the same basis as in Peterson and Hoffman.
18 As mentioned above, plaintiffs’ evidentiary showing consists entirely of the
19 declaration of Andrew Blaich, a security engineer investigator on the ‘threat intelligence’
20 team at Meta. See Dkt. 854-3. And as also mentioned above, plaintiffs set forth three
21 categories1 of defendants’ conduct that they allege violate the injunction: (1) creating
22 Whatsapp accounts, (2) operating Whatsapp accounts, and (3) deploying one-click
23 malicious URLs through the Whatsapp platform. See Dkt. 864 at 6-12.
24 1. Creating Whatsapp accounts
25 Plaintiffs argue that defendants violated paragraph 3(d) of the injunction by
26
27 1
At the motion hearing, plaintiffs attempted to add a fourth alleged category of injunction-
28 violating conduct, but the court rejected that attempt, because the defendants had no
opportunity to meaningfully respond to a newly-raised argument. See Dkt. 878 at 14.
6
Case 4:19-cv-07123-PJH Document 884 Filed 10/16/26 Page 7 of 11
1 creating new Whatsapp accounts. Plaintiffs rely on the testimony of Blaich, who
2 submitted a declaration attesting that NSO created at least 23 new accounts after the
3 injunction took effect. See Dkt. 854-3, ¶ 7.
4 Specifically, Blaich states that 23 new Whatsapp accounts were created, bearing
5 “technical and behavioral signatures that Meta has previously associated with NSO
6 testing, including account registration patterns, device and other related information, and
7 connections to known NSO-controlled infrastructure.” Blaich decl. (Dkt. 854-3), ¶ 7, 9.
8 Defendants respond by arguing that plaintiffs have not provided the account
9 names, phone numbers, or any other identifying information for the 23 accounts in
10 question. See Dkt. 863 at 16-18. Defendants argue that, without such identifying
11 information, plaintiffs’ evidence cannot meet the “clear and convincing evidence”
12 standard.
United States District Court
13 At the motion hearing, plaintiffs acknowledged that they were “very concerned
14 about disclosing to NSO the precise tools” used to “track their activity,” and that it “would
15 be problematic” to “force us [i.e., plaintiffs] to give up the specific markers by which we
Northern District of California
16 were able to identify these particular accounts.” See Dkt. 878 at 10-11. Instead, plaintiffs
17 described their approach as follows: “what we’ve done here is say, ‘Here is an affidavit. If
18 you can controvert it, please go ahead.’” Id. at 11.
19 In the court’s view, plaintiffs took a calculated risk in choosing to limit the level of
20 detail in their supporting evidence. The upside was described in the previous paragraph
21 – plaintiffs were able to limit the information about their tracking activity that was made
22 available to defendants. However, the downside is that the lack of specificity in the
23 Blaich declaration prevents the court from being able to conclude that they have met the
24 “clear and convincing evidence” standard. The court agrees with the argument, made by
25 defendants, that plaintiffs are asking the court to “simply accept Mr. Blaich’s assurance
26 that he has looked at Whatsapp’s undisclosed internal evidence and concluded, ‘with
27 high confidence,’ that NSO created new Whatsapp accounts.” See Dkt. 863 at 18.
28 Similarly, the Blaich declaration asserts that the 23 new accounts “share technical
7
Case 4:19-cv-07123-PJH Document 884 Filed 10/16/26 Page 8 of 11
1 and behavioral signatures that Meta has previously associated with NSO testing,” but
2 provides little detail about what those “technical and behavioral signatures” actually are,
3 stating only in general terms that they include “account registration patterns, device and
4 other related information, and connections to known NSO-controlled infrastructure.” See
5 Blaich decl. (Dkt. 854-3), ¶ 7, 9.
6 Overall, the court concludes that plaintiffs’ evidence that defendants have created
7 new Whatsapp accounts, in violation of the permanent injunction, fails to meet the
8 applicable “clear and convincing evidence” standard. Accordingly, the court will not enter
9 an order to show cause. The court also concludes that the failure to meet the applicable
10 legal standard distinguishes this case from Peterson and Hoffman. Thus, plaintiffs’
11 motion for contempt on the basis that defendants have created new Whastapp accounts
12 is DENIED.
United States District Court
13 2. Operating Whatsapp accounts
14 As discussed above, plaintiffs’ opening contempt motion grouped “creating” and
15 “operating” Whatsapp accounts into a single category of conduct. See Dkt. 854 at 9-10.
Northern District of California
16 However, defendants’ opposition brief argued that the injunction “does not bar NSO
17 employees from using pre-existing Whatsapp accounts,” and plaintiffs’ reply separated
18 their arguments about “creating” new accounts from their arguments about “operating”
19 pre-existing accounts. Thus, the threshold question for the court is whether the language
20 of the injunction actually does prohibit defendants from using pre-existing Whatsapp
21 accounts.
22 While plaintiffs initially relied on paragraph 3(d) of the injunction, which barred
23 “[c]reating accounts, whether directly or through a third party, intermediary, or proxy, on
24 the WhatsApp Platform,” plaintiffs now argue that the operation of already-existing
25 Whatsapp accounts violates paragraph 3(a) of the injunction, which prohibits “using . . .
26 any technology that interacts with or emulates any aspect of the WhatsApp Platform in
27 any way.” Plaintiffs also argue that, to the extent that the Whatsapp app itself cannot
28 constitute “technology that interacts with” Whatsapp, that the cellphones used to interact
8
Case 4:19-cv-07123-PJH Document 884 Filed 10/16/26 Page 9 of 11
1 with Whatsapp are themselves the applicable “technology.” Dkt. 864 at 11.
2 Defendants argue that the injunction’s language could have barred them from
3 using Whatsapp “for any purpose” if plaintiffs had so chosen, and argue that any
4 ambiguities should be resolved against the party who drafted the language. See Dkt. 863
5 at 20.
6 Though a close call, the court agrees that the language of the injunction is
7 ambiguous at best in prohibiting all uses of pre-existing Whatsapp accounts, and that the
8 ambiguity should be resolved against plaintiffs, who, at the court’s request, due to the
9 complexity of and the secrecy surrounding the technology, drafted the injunction’s
10 language. Plaintiffs’ interpretation of paragraph 3(a) to cover any and all uses of pre-
11 existing accounts is a tortured one, and not what the court had in mind by issuing an
12 order that prohibited using “any technology that interacts with or emulates any aspect of
United States District Court
13 the WhatsApp Platform in any way.” Accordingly, plaintiffs’ motion for contempt is
14 DENIED to the extent that it is premised on defendants’ alleged use of pre-existing
15 Whatsapp accounts.
Northern District of California
16 3. Deploying one-click malicious URLs through the Whatsapp platform
17 Plaintiffs claim that defendants violated paragraph 3(a) of the injunction by “using .
18 . . developing . . . distributing, transferring, or licensing . . . technology that interacts with
19 or emulates any aspect of the Whatsapp platform,” and paragraph 4 of the injunction by
20 failing to “disable customer access to any and all computer code or technologies” that
21 depend on the Whatsapp platform.
22 As before, plaintiffs rely on the Blaich declaration, which states that, in February
23 and April 2026, a NSO-affiliated Whatsapp account sent malicious URLs to targets over
24 Whatsapp. Blaich decl., ¶¶ 16-17. Blaich states that the attribution to NSO was based
25 on five factors: (1) URL infrastructure (i.e., the format of the URLs), (2) URL redirect
26 behavior, (3) lure design (i.e., the message templates were similar to those used by NSO
27 in the past), (4) targeting profile (i.e., the locations of the targets match areas in which
28 Pegasus has been used), and (5) continuity with prior NSO conduct. Blaich decl., ¶ 18.
9
Case 4:19-cv-07123-PJH Document 884 Filed 10/16/26 Page 10 of 11
1 Defendants make two arguments in response: (1) plaintiffs’ evidence does not
2 meet the “clear and convincing evidence” standard, and (2) the injunction does not
3 prohibit sovereign governments from using Whatsapp to send URLs to targets of their
4 operations. See Dkt. 863 at 22-28.
5 The court will start with the second argument, because it presents a threshold
6 question. Defendants seek a blanket ruling that an “independent decision by an NSO
7 customer to text a malicious URL to a target via Whatsapp” does not violate the
8 injunction, without any further information needed. See Dkt. 880 at 8-9. But the court
9 cannot go that far. Simply put, there are not enough details before the court about the
10 division of labor between defendants and their sovereign customers. In other words,
11 when one of those customers chooses to “text a malicious URL to a target,” to what
12 extent are defendants involved in the technical operations that occur after the URL is
United States District Court
13 clicked? To what extent do defendants operate and maintain the software that is
14 downloaded onto the target’s device? The answers to these questions are relevant to
15 whether the challenged conduct is indeed solely an act of the customers (and thus
Northern District of California
16 outside the injunction’s scope), or whether defendants participate in the conduct, which
17 would bring the conduct within the scope of behavior prohibited by the injunction.
18 That leaves the question of whether plaintiffs’ evidence is sufficient to constitute
19 “clear and convincing evidence” that defendants were indeed involved in the deploying of
20 malicious URLs through the Whatsapp platform. As mentioned above, plaintiffs rely on
21 the Blaich declaration to tie defendants to the deployments, and he stated that the
22 attribution to NSO was based on the five factors set forth above. Blaich decl., ¶ 18.
23 Overall, as with the evidence regarding the creation of new Whatsapp accounts,
24 the court concludes that the details provided in the Blaich declaration are simply not
25 enough to meet the demanding “clear and convincing evidence” standard. As before, it
26 appears that plaintiffs’ approach was to err on the side of under-disclosing details at first,
27 hoping that the court would allow them a second bite at the apple by supplementing their
28 evidence later, including through the order to show cause procedure. But as discussed
10
Case 4:19-cv-07123-PJH Document 884 Filed 10/16/26 Page 11 of 11
1 above, the Ninth Circuit has not provided for a procedure where a plaintiff may make a
2 ‘placeholder’ evidentiary showing at first, and then supplement it later if the evidence falls
3 short of the “clear and convincing” standard. Instead, the plaintiff’s initial showing must
4 meet the “clear and convincing evidence” standard. For that reason, plaintiffs’ motion for
5 contempt must be DENIED to the extent it is based on the alleged deployment of
6 malicious URLs through the Whatsapp platform.
7 C. Conclusion
8 For the foregoing reasons, plaintiffs’ motion for contempt (Dkt. 854) is DENIED.
9 IT IS SO ORDERED.
10 Dated: October 16, 2026
11 /s/ Phyllis J. Hamilton
PHYLLIS J. HAMILTON
12 United States District Judge
United States District Court
13
14
15
Northern District of California
16
17
18
19
20
21
22
23
24
25
26
27
28
11