Case 4:19-cv-07123-PJH Document 884 Filed 10/16/26 Page 1 of 11 1 2 UNITED STATES DISTRICT COURT 3 NORTHERN DISTRICT OF CALIFORNIA 4 5 WHATSAPP INC., et al., 6 Case No. 19-cv-07123-PJH Plaintiffs, 7 v. ORDER DENYING MOTION FOR 8 CONTEMPT NSO GROUP TECHNOLOGIES 9 LIMITED, et al., Re: Dkt. 854, 879, 880 10 Defendants. 11 12 United States District Court 13 Plaintiffs’ motion for contempt came on for hearing on August 20, 2026. Plaintiffs 14 appeared through their counsel, Micah Block, Luca Marzorati, Antonio Perez-Marques, 15 and Greg Andres. Defendants appeared through their counsel, Kellen Dwyer. Having Northern District of California 16 read the papers filed by the parties and carefully considered their arguments and relevant 17 authority, and good cause appearing, the court hereby rules as follows. 18 A. Legal standard 19 “Civil contempt ... consists of a party’s disobedience to a specific and definite order 20 by failure to take all reasonable steps within the party's power to comply.” Epic Games, 21 Inc. v. Apple Inc., 161 F.4th 1162, 1176 (9th Cir. 2025) (citing In re Dual-Deck Video 22 Cassette Recorder Antitrust Litig., 10 F.3d 693, 695 (9th Cir. 1993)). 23 In a civil contempt action, “[t]he moving party has the burden of showing by clear 24 and convincing evidence that the contemnors violated a specific and definite order of the 25 court. The burden then shifts to the contemnors to demonstrate why they were unable to 26 comply.” FTC v. Enforma Natural Products, 362 F.3d 1204, 1211 (9th Cir. 2004) (citing 27 FTC v. Affordable Media, LLC, 179 F.3d 1228, 1239 (9th Cir.1999); Stone v. City and 28 County of San Francisco, 968 F.2d 850, 856 n. 9 (9th Cir.1992)). Case 4:19-cv-07123-PJH Document 884 Filed 10/16/26 Page 2 of 11 1 The contempt “need not be willful,” however, a person should not be held in 2 contempt if his action “appears to be based on a good faith and reasonable interpretation 3 of the court's order.” Reno Air Racing Ass’n, Inc. v. McCord, 452 F.3d 1126, 1130 (9th 4 Cir. 2006) (citing In re Crystal Palace Gambling Hall, Inc., 817 F.2d 1361, 1365 (9th 5 Cir.1987); but see also Dual-Deck Video Cassette Recorder, 10 F.3d at 695 (“there is no 6 good faith exception to the requirement of obedience to a court order.”). 7 “In contempt proceedings[,] ... a decree will not be expanded by implication or 8 intendment beyond the meaning of its terms,” but those terms must be “read in the light 9 of the issues and the purpose for which the suit was brought.” Epic Games v. Apple, 161 10 F.4th at 1176 (citing Terminal R.R. Ass'n of St. Louis v. United States, 266 U.S. 17, 29 11 (1924)). 12 B. Analysis United States District Court 13 After plaintiffs prevailed at trial on their CFAA, CDAFA, and breach of contract 14 claims, plaintiffs sought a permanent injunction against defendants. For purposes of this 15 motion, the relevant provisions of the injunction are those prohibiting or requiring the Northern District of California 16 following conduct: 17 Paragraph 3(a): Developing, using, selling, offering for sale, distributing, 18 transferring, or licensing, whether directly or through a third party, intermediary, or proxy, any technology that interacts with or emulates any 19 aspect of the WhatsApp Platform in any way, including as a method or approach used to install and deploy the technology (an “installation vector”), 20 without first requesting and obtaining Plaintiffs’ express written permission; 21 22 Paragraph 3(d): Creating accounts, whether directly or through a third party, intermediary, or proxy, on the WhatsApp Platform, without first requesting 23 and obtaining Plaintiffs’ express written permission. 24 Paragraph 4: The Prohibited Parties are required to delete and destroy any 25 and all computer code or technologies that use, access, or depend on the WhatsApp Platform, including the WhatsApp Installation Server (“WIS”), to 26 delete all data obtained or derived from use of or access to the WhatsApp 27 Platform in the Prohibited Parties’ possession, and to disable customer access to any and all computer code or technologies maintained by the 28 Prohibited Parties that use, access, or depend on the WhatsApp Platform. 2 Case 4:19-cv-07123-PJH Document 884 Filed 10/16/26 Page 3 of 11 1 See Dkt. 809. 2 Plaintiffs now seek an order holding defendants in civil contempt for violating the 3 above provisions of the permanent injunction. Plaintiffs’ opening motion argued that 4 defendants had violated the injunction in two ways: (1) creating and operating Whatsapp 5 accounts, and (2) deploying one-click malicious URLs through the Whatsapp platform. 6 See Dkt. 854 at 9-10. However, in their opposition brief, defendants drew a distinction 7 between the alleged creation of new accounts and the alleged operation of pre-existing 8 Whatsapp accounts, the latter of which was not barred by the injunction, defendants 9 argued. See Dkt. 863 at 18-20. In their reply, Whatapp divides category (1) into two 10 subcategories – one for ‘creating’ Whatsapp accounts and one for ‘operating’ Whatsapp 11 accounts. See Dkt. 864 at 6-12. 12 Before reaching the merits of plaintiffs’ arguments regarding contempt, the court United States District Court 13 must address and clarify the applicable legal standard, about which plaintiffs argue 14 several different positions. The court will also discuss the proper procedure for resolving 15 a contempt motion, including the parties’ arguments on whether an evidentiary hearing is Northern District of California 16 necessary. 17 When plaintiffs first filed their contempt motion, they did not discuss any need to 18 hold an evidentiary hearing. Instead, plaintiffs submitted the declaration of Andrew 19 Blaich, and only in their reply did plaintiffs offer that “Mr. Blaich is available to testify at 20 any evidentiary hearing the court may wish to hold.” See Dkt. 854-3; Dkt. 864 at 7. 21 In their reply, plaintiffs also expressly made the argument, for the first time, that a 22 court may grant a contempt motion on the papers, without any evidentiary hearing at all. 23 See Dkt. 864 at 7-8. Specifically, plaintiffs argued that the Ninth Circuit’s decisions in 24 Peterson v. Highland Music, Inc. and Hoffman ex rel. NLRB v. Beer Drivers & Salesmen’s 25 Loc. Union No. 888 held that a court may “treat as true the facts set forth in 26 uncontroverted affidavits,” and may, in turn, grant contempt motions on the basis of those 27 facts. See Peterson, 140 F.3d 1313, 1324 (9th Cir. 1998); Hoffman, 536 F.2d 1268, 1277 28 (9th Cir. 1977). 3 Case 4:19-cv-07123-PJH Document 884 Filed 10/16/26 Page 4 of 11 1 In arguing that no hearing was necessary, plaintiffs also argued that their evidence 2 (i.e., the Blaich declaration) fully satisfied the “clear and convincing evidence” standard 3 that is applicable to a contempt motion. 4 Plaintiffs maintained their position at the motion hearing, arguing that the Peterson 5 case “stands for the very clear proposition at the Ninth Circuit that you do not need an 6 evidentiary hearing.” See Dkt. 878 at 44. 7 Later in the motion hearing, plaintiffs explained that, if the court was not convinced 8 that they had already satisfied the “clear and convincing evidence” standard, that the 9 “correct next step is an order to show cause” issued to defendants, directing them to 10 present evidence to rebut plaintiffs’ evidentiary showing. See Dkt. 878 at 42. 11 In contrast, defendants argued that there was no need to issue an order to show 12 cause or hold an evidentiary hearing, because plaintiffs’ evidence was not sufficient to United States District Court 13 meet the “clear and convincing evidence” standard. See Dkt. 878 at 20-22. Defendants 14 argued that plaintiffs were misstating the relevant standard by claiming that the Blaich 15 declaration was enough to shift the evidentiary burden from plaintiffs to defendants. Northern District of California 16 Defendants argued that the proper application of the standard was to first require 17 plaintiffs’ evidence to meet the “clear and convincing evidence” standard, and only if that 18 occurred, then the burden would shift to the defendants to rebut the plaintiffs’ showing. 19 See id. 20 At the end of the hearing, the court noted that the parties’ briefing did not discuss 21 these procedural issues, and thus directed the parties to file supplemental briefs with 22 their competing procedural proposals to resolve the contempt motion. See Dkt. 878 at 23 53. 24 Plaintiffs’ supplemental brief again argued that “the court should find NSO in 25 contempt on the papers.” See Dkt. 879 at 2. Plaintiffs argued that their evidence already 26 satisfied the “clear and convincing evidence” standard, and that Peterson and Hoffman 27 were clear in holding that an evidentiary hearing was not required in order to issue a 28 contempt order. See id. at 2-3. Plaintiffs argued only “in the alternative” that the court 4 Case 4:19-cv-07123-PJH Document 884 Filed 10/16/26 Page 5 of 11 1 could issue an order to show cause and require defendants to come forth with evidence 2 to rebut plaintiffs’ showing. Importantly, plaintiffs also articulated a new standard for 3 determining whether to issue an order to show cause – plaintiffs argued that “the court 4 need only find that there has been a ‘sufficient preliminary showing’ of contempt to 5 require the alleged contemnor to come forward with evidence.” See id. at 3. 6 Plaintiffs’ supplemental brief contained the first mention of this new “sufficient 7 preliminary showing” standard. For support, plaintiffs cited to Epic Games, Inc. v. Apple 8 Inc., No. 20-cv-5640, Dkt. 925 (N.D. Cal. Apr. 23, 2024). However, in that order, the 9 court did not purport to set out a new legal standard; in fact, the Epic court specifically 10 noted that “[t]o succeed on such a motion, Epic Games must show, by clear and 11 convincing evidence, that (1) Apple violated the injunction, (2) its violation was ‘beyond 12 substantial compliance,’ and (3) its conduct was ‘not based on any good faith and United States District Court 13 reasonable interpretation of the injunction.’” Id. (emphasis added). When the Epic court 14 ultimately concluded that “Epic Games has made a sufficient preliminary showing that, 15 viewed holistically, Apple’s practice changes undermine the spirit of the injunction by Northern District of California 16 limiting competition, impeding the free flow of information, and constraining user choice,” 17 it was implicitly applying the “clear and convincing evidence” standard and determining 18 that the plaintiff had indeed made a sufficient preliminary showing under that “clear and 19 convincing evidence” standard. 20 Plaintiffs also cite three other cases from this district. See Hernandez v. City of 21 Monterey, No. 13-cv-2354, Dkt. 900 (N.D. Cal. Aug. 2, 2024); Vasquez v. Libre, 2023 WL 22 360242 (N.D. Cal. Jan. 23, 2023); Facebook v. Power Ventures, 2017 WL 3394754 (N.D. 23 Cal. Aug. 8, 2017). While plaintiffs are correct that those cases involved proceedings 24 where the court held some type of evidentiary hearing and/or directed the alleged 25 contemnors to certify compliance, all of them also involved only the ‘clear and convincing’ 26 evidentiary standard, rather than any sort of lower ‘preliminary’ standard. In each of 27 those cases, the court applied the ‘clear and convincing’ standard and found that it was 28 met, and ordered further proceedings/submissions only after finding that the standard 5 Case 4:19-cv-07123-PJH Document 884 Filed 10/16/26 Page 6 of 11 1 was met. That is consistent with the ‘burden-shifting’ framework identified back in 2 plaintiffs’ opening motion – the initial burden is indeed the ‘clear and convincing’ burden, 3 and only if plaintiffs meet that standard does the burden shift to the contemnors to show 4 compliance. See Dkt. 854 at 9; see also Dkt. 880 at 3 (citing FTC v. Affordable Media). 5 Defendants’ supplemental brief makes the same argument that they made in their 6 opposition brief – that plaintiffs have misstated the burden-shifting framework, and that 7 plaintiffs must first meet the “clear and convincing evidence” standard before the burden 8 shifts to defendants to rebut the evidentiary showing. See Dkt. 880 at 3-4. 9 Having reviewed all of the authority cited by the parties, the court concludes that 10 defendants are correct that plaintiffs’ evidence must meet the “clear and convincing 11 evidence” standard before the burden shifts to defendants to rebut the evidentiary 12 showing. The court has found no lower, preliminary standard that applies to the decision United States District Court 13 to issue an order to show cause. Thus, the first proper inquiry for the court is to 14 determine whether the evidence submitted in support of plaintiffs’ contempt motion is 15 sufficient to constitute “clear and convincing evidence” of contempt. If it does, the court Northern District of California 16 can then determine whether it is preferable to issue an order to show cause, or to simply 17 grant the contempt motion on the same basis as in Peterson and Hoffman. 18 As mentioned above, plaintiffs’ evidentiary showing consists entirely of the 19 declaration of Andrew Blaich, a security engineer investigator on the ‘threat intelligence’ 20 team at Meta. See Dkt. 854-3. And as also mentioned above, plaintiffs set forth three 21 categories1 of defendants’ conduct that they allege violate the injunction: (1) creating 22 Whatsapp accounts, (2) operating Whatsapp accounts, and (3) deploying one-click 23 malicious URLs through the Whatsapp platform. See Dkt. 864 at 6-12. 24 1. Creating Whatsapp accounts 25 Plaintiffs argue that defendants violated paragraph 3(d) of the injunction by 26 27 1 At the motion hearing, plaintiffs attempted to add a fourth alleged category of injunction- 28 violating conduct, but the court rejected that attempt, because the defendants had no opportunity to meaningfully respond to a newly-raised argument. See Dkt. 878 at 14. 6 Case 4:19-cv-07123-PJH Document 884 Filed 10/16/26 Page 7 of 11 1 creating new Whatsapp accounts. Plaintiffs rely on the testimony of Blaich, who 2 submitted a declaration attesting that NSO created at least 23 new accounts after the 3 injunction took effect. See Dkt. 854-3, ¶ 7. 4 Specifically, Blaich states that 23 new Whatsapp accounts were created, bearing 5 “technical and behavioral signatures that Meta has previously associated with NSO 6 testing, including account registration patterns, device and other related information, and 7 connections to known NSO-controlled infrastructure.” Blaich decl. (Dkt. 854-3), ¶ 7, 9. 8 Defendants respond by arguing that plaintiffs have not provided the account 9 names, phone numbers, or any other identifying information for the 23 accounts in 10 question. See Dkt. 863 at 16-18. Defendants argue that, without such identifying 11 information, plaintiffs’ evidence cannot meet the “clear and convincing evidence” 12 standard. United States District Court 13 At the motion hearing, plaintiffs acknowledged that they were “very concerned 14 about disclosing to NSO the precise tools” used to “track their activity,” and that it “would 15 be problematic” to “force us [i.e., plaintiffs] to give up the specific markers by which we Northern District of California 16 were able to identify these particular accounts.” See Dkt. 878 at 10-11. Instead, plaintiffs 17 described their approach as follows: “what we’ve done here is say, ‘Here is an affidavit. If 18 you can controvert it, please go ahead.’” Id. at 11. 19 In the court’s view, plaintiffs took a calculated risk in choosing to limit the level of 20 detail in their supporting evidence. The upside was described in the previous paragraph 21 – plaintiffs were able to limit the information about their tracking activity that was made 22 available to defendants. However, the downside is that the lack of specificity in the 23 Blaich declaration prevents the court from being able to conclude that they have met the 24 “clear and convincing evidence” standard. The court agrees with the argument, made by 25 defendants, that plaintiffs are asking the court to “simply accept Mr. Blaich’s assurance 26 that he has looked at Whatsapp’s undisclosed internal evidence and concluded, ‘with 27 high confidence,’ that NSO created new Whatsapp accounts.” See Dkt. 863 at 18. 28 Similarly, the Blaich declaration asserts that the 23 new accounts “share technical 7 Case 4:19-cv-07123-PJH Document 884 Filed 10/16/26 Page 8 of 11 1 and behavioral signatures that Meta has previously associated with NSO testing,” but 2 provides little detail about what those “technical and behavioral signatures” actually are, 3 stating only in general terms that they include “account registration patterns, device and 4 other related information, and connections to known NSO-controlled infrastructure.” See 5 Blaich decl. (Dkt. 854-3), ¶ 7, 9. 6 Overall, the court concludes that plaintiffs’ evidence that defendants have created 7 new Whatsapp accounts, in violation of the permanent injunction, fails to meet the 8 applicable “clear and convincing evidence” standard. Accordingly, the court will not enter 9 an order to show cause. The court also concludes that the failure to meet the applicable 10 legal standard distinguishes this case from Peterson and Hoffman. Thus, plaintiffs’ 11 motion for contempt on the basis that defendants have created new Whastapp accounts 12 is DENIED. United States District Court 13 2. Operating Whatsapp accounts 14 As discussed above, plaintiffs’ opening contempt motion grouped “creating” and 15 “operating” Whatsapp accounts into a single category of conduct. See Dkt. 854 at 9-10. Northern District of California 16 However, defendants’ opposition brief argued that the injunction “does not bar NSO 17 employees from using pre-existing Whatsapp accounts,” and plaintiffs’ reply separated 18 their arguments about “creating” new accounts from their arguments about “operating” 19 pre-existing accounts. Thus, the threshold question for the court is whether the language 20 of the injunction actually does prohibit defendants from using pre-existing Whatsapp 21 accounts. 22 While plaintiffs initially relied on paragraph 3(d) of the injunction, which barred 23 “[c]reating accounts, whether directly or through a third party, intermediary, or proxy, on 24 the WhatsApp Platform,” plaintiffs now argue that the operation of already-existing 25 Whatsapp accounts violates paragraph 3(a) of the injunction, which prohibits “using . . . 26 any technology that interacts with or emulates any aspect of the WhatsApp Platform in 27 any way.” Plaintiffs also argue that, to the extent that the Whatsapp app itself cannot 28 constitute “technology that interacts with” Whatsapp, that the cellphones used to interact 8 Case 4:19-cv-07123-PJH Document 884 Filed 10/16/26 Page 9 of 11 1 with Whatsapp are themselves the applicable “technology.” Dkt. 864 at 11. 2 Defendants argue that the injunction’s language could have barred them from 3 using Whatsapp “for any purpose” if plaintiffs had so chosen, and argue that any 4 ambiguities should be resolved against the party who drafted the language. See Dkt. 863 5 at 20. 6 Though a close call, the court agrees that the language of the injunction is 7 ambiguous at best in prohibiting all uses of pre-existing Whatsapp accounts, and that the 8 ambiguity should be resolved against plaintiffs, who, at the court’s request, due to the 9 complexity of and the secrecy surrounding the technology, drafted the injunction’s 10 language. Plaintiffs’ interpretation of paragraph 3(a) to cover any and all uses of pre- 11 existing accounts is a tortured one, and not what the court had in mind by issuing an 12 order that prohibited using “any technology that interacts with or emulates any aspect of United States District Court 13 the WhatsApp Platform in any way.” Accordingly, plaintiffs’ motion for contempt is 14 DENIED to the extent that it is premised on defendants’ alleged use of pre-existing 15 Whatsapp accounts. Northern District of California 16 3. Deploying one-click malicious URLs through the Whatsapp platform 17 Plaintiffs claim that defendants violated paragraph 3(a) of the injunction by “using . 18 . . developing . . . distributing, transferring, or licensing . . . technology that interacts with 19 or emulates any aspect of the Whatsapp platform,” and paragraph 4 of the injunction by 20 failing to “disable customer access to any and all computer code or technologies” that 21 depend on the Whatsapp platform. 22 As before, plaintiffs rely on the Blaich declaration, which states that, in February 23 and April 2026, a NSO-affiliated Whatsapp account sent malicious URLs to targets over 24 Whatsapp. Blaich decl., ¶¶ 16-17. Blaich states that the attribution to NSO was based 25 on five factors: (1) URL infrastructure (i.e., the format of the URLs), (2) URL redirect 26 behavior, (3) lure design (i.e., the message templates were similar to those used by NSO 27 in the past), (4) targeting profile (i.e., the locations of the targets match areas in which 28 Pegasus has been used), and (5) continuity with prior NSO conduct. Blaich decl., ¶ 18. 9 Case 4:19-cv-07123-PJH Document 884 Filed 10/16/26 Page 10 of 11 1 Defendants make two arguments in response: (1) plaintiffs’ evidence does not 2 meet the “clear and convincing evidence” standard, and (2) the injunction does not 3 prohibit sovereign governments from using Whatsapp to send URLs to targets of their 4 operations. See Dkt. 863 at 22-28. 5 The court will start with the second argument, because it presents a threshold 6 question. Defendants seek a blanket ruling that an “independent decision by an NSO 7 customer to text a malicious URL to a target via Whatsapp” does not violate the 8 injunction, without any further information needed. See Dkt. 880 at 8-9. But the court 9 cannot go that far. Simply put, there are not enough details before the court about the 10 division of labor between defendants and their sovereign customers. In other words, 11 when one of those customers chooses to “text a malicious URL to a target,” to what 12 extent are defendants involved in the technical operations that occur after the URL is United States District Court 13 clicked? To what extent do defendants operate and maintain the software that is 14 downloaded onto the target’s device? The answers to these questions are relevant to 15 whether the challenged conduct is indeed solely an act of the customers (and thus Northern District of California 16 outside the injunction’s scope), or whether defendants participate in the conduct, which 17 would bring the conduct within the scope of behavior prohibited by the injunction. 18 That leaves the question of whether plaintiffs’ evidence is sufficient to constitute 19 “clear and convincing evidence” that defendants were indeed involved in the deploying of 20 malicious URLs through the Whatsapp platform. As mentioned above, plaintiffs rely on 21 the Blaich declaration to tie defendants to the deployments, and he stated that the 22 attribution to NSO was based on the five factors set forth above. Blaich decl., ¶ 18. 23 Overall, as with the evidence regarding the creation of new Whatsapp accounts, 24 the court concludes that the details provided in the Blaich declaration are simply not 25 enough to meet the demanding “clear and convincing evidence” standard. As before, it 26 appears that plaintiffs’ approach was to err on the side of under-disclosing details at first, 27 hoping that the court would allow them a second bite at the apple by supplementing their 28 evidence later, including through the order to show cause procedure. But as discussed 10 Case 4:19-cv-07123-PJH Document 884 Filed 10/16/26 Page 11 of 11 1 above, the Ninth Circuit has not provided for a procedure where a plaintiff may make a 2 ‘placeholder’ evidentiary showing at first, and then supplement it later if the evidence falls 3 short of the “clear and convincing” standard. Instead, the plaintiff’s initial showing must 4 meet the “clear and convincing evidence” standard. For that reason, plaintiffs’ motion for 5 contempt must be DENIED to the extent it is based on the alleged deployment of 6 malicious URLs through the Whatsapp platform. 7 C. Conclusion 8 For the foregoing reasons, plaintiffs’ motion for contempt (Dkt. 854) is DENIED. 9 IT IS SO ORDERED. 10 Dated: October 16, 2026 11 /s/ Phyllis J. Hamilton PHYLLIS J. HAMILTON 12 United States District Judge United States District Court 13 14 15 Northern District of California 16 17 18 19 20 21 22 23 24 25 26 27 28 11