Case 4:19-cv-07123-PJH Document 889 Filed 10/30/26 Page 1 of 8 PageID #: 34606 Greg D. Andres 1 Antonio J. Perez-Marques 2 Luca Marzorati (admitted pro hac vice) 3 DAVIS POLK & WARDWELL LLP 450 Lexington Avenue 4 New York, New York 10017 Telephone: (212) 450-4000 5 Facsimile: (212) 701-5800 6 Email: greg.andres@davispolk.com antonio.perez@davispolk.com 7 luca.marzorati@davispolk.com 8 Micah G. Block (SBN 270712) DAVIS POLK & WARDWELL LLP 9 900 Middlefield Road, Suite 200 10 Redwood City, California 94063 Telephone: (650) 752-2000 11 Facsimile: (650) 752-2111 Email: micah.block@davispolk.com 12 Attorneys for Plaintiffs 13 WhatsApp LLC and Meta Platforms, Inc. 14 UNITED STATES DISTRICT COURT 15 FOR THE NORTHERN DISTRICT OF CALIFORNIA 16 17 OAKLAND DIVISION 18 ) WHATSAPP LLC and ) Case No. 4:19-cv-07123-PJH 19 META PLATFORMS, INC., ) ) 20 Plaintiffs, ) DECLARATION OF LUCA ) MARZORATI IN SUPPORT OF 21 v. ) PLAINTIFFS’ MOTION TO COMPEL ) POST-JUDGMENT DISCOVERY 22 NSO GROUP TECHNOLOGIES LIMITED ) and Q CYBER TECHNOLOGIES LIMITED, ) DISCOVERY MATTER 23 ) Defendants. ) Date: December 17, 2026 24 ) Time: 1:30 p.m. ) Ctrm: 3 25 ) ) Judge: Hon. Phyllis J. Hamilton 26 ) ) 27 ) Action Filed: October 29, 2019 ) 28 ) Case 4:19-cv-07123-PJH Document 889 Filed 10/30/26 Page 2 of 8 PageID #: 34607 1 I, Luca Marzorati, declare as follows: 2 1. I am an associate at the law firm of Davis Polk & Wardwell LLP and admitted pro 3 hac vice to practice before this Court. I am counsel for Plaintiffs WhatsApp LLC and Meta Platforms, 4 Inc. (“Plaintiffs”) in the above-captioned action filed on October 29, 2019 against Defendants NSO 5 Group Technologies Limited (“NSO Group”) and Q Cyber Technologies Limited (“Q Cyber”) 6 (together, “NSO” or “Defendants”). I have personal knowledge of the facts set forth below and, if 7 called as a witness in a court of law, could and would testify competently thereto. 8 2. I submit this declaration in support of Plaintiffs’ Motion to Compel Post-Judgment 9 Discovery, filed concurrently herewith. 10 3. On March 4, 2026, Plaintiffs served their First Set of Requests for Production of 11 Documents in Aid of Judgment (the “RFPs”) and their First Set of Interrogatories in Aid of Judgment 12 (the “Interrogatories”) on Defendants. Attached hereto as Exhibit A is a true and correct copy of the 13 RFPs, and attached hereto as Exhibit B is a true and correct copy of the Interrogatories. 14 4. On May 4, 2026, Defendants served their Responses and Objections to the RFPs and 15 their Answers and Objections to the Interrogatories. Attached hereto as Exhibit C is a true and 16 correct copy of Defendants’ Responses and Objections to the RFPs, and attached hereto as Exhibit 17 D is a true and correct copy of Defendants’ Answers and Objections to the Interrogatories. 18 5. As of the date of this declaration, Defendants have not paid any portion of the 19 $4,447,190 judgment entered on November 12, 2025 (Dkt. No. 810) or the $15,914,095 in attorneys’ 20 fees awarded on January 30, 2026 (Dkt. No. 835), have not posted a supersedeas bond, and have not 21 obtained a stay of execution or of post-judgment discovery. 22 6. Counsel for the parties met and conferred by videoconference regarding the RFPs and 23 Interrogatories on May 8 and May 22, 2026, and, on the balance of the requests, on June 16 and June 24 26, 2026, and exchanged extensive correspondence between those conferences. On June 4, 2026, the 25 parties filed a stipulation under which Defendants agreed to produce certain categories of documents 26 while negotiations continued as to the remaining scope of the requests. Dkt. No. 853. On June 5, 27 2026, I sent Defendants’ counsel an agenda for a further meet-and-confer on the balance of the RFPs 28 and Interrogatories. Dkt. No. 870-9. On June 23, 2026, Defendants offered to produce additional 1 DECL. OF LUCA MARZORATI IN SUPP. OF PLS.’ MOT. TO COMPEL POST-J. DISCOVERY - CASE NO. 4:19-CV-07123-PJH Case 4:19-cv-07123-PJH Document 889 Filed 10/30/26 Page 3 of 8 PageID #: 34608 1 documents on the condition that the corresponding requests “would be deemed satisfied and 2 eliminated.” Dkt. No. 870-7 at 1. On July 15, 2026, Defendants proposed a revised stipulation that 3 deferred negotiation of the loan and credit agreements. Dkt. No. 870-12. On July 31, 2026, the 4 parties filed a joint letter presenting the disputes over RFP Nos. 1, 4, 11, and 13 and Interrogatory 5 Nos. 5–7 and 9. Dkt. No. 870. 6 7. On July 23, 2026, Plaintiffs served a notice of deposition of Defendants pursuant to 7 Federal Rule of Civil Procedure 30(b)(6), and on August 25, 2026, Plaintiffs served a notice of 8 deposition of NSO’s Chief Executive Officer, Akiva Rosner, pursuant to Rule 30(b)(1). Dkt. Nos. 9 881-1, 881-2. Both notices were served by email on Defendants’ U.S. counsel of record. 10 8. On August 13, 2026, counsel for the parties met and conferred regarding the Rule 11 30(b)(6) notice. During that conference, Defendants’ counsel stated that Defendants would provide 12 a markup of the noticed topics reflecting Defendants’ objections early the following week. At 13 Defendants’ urging, Plaintiffs agreed to address the injunction-related topics separately from the 14 topics relating to enforcement of the money judgment. Defendants did not provide the promised 15 markup. 16 9. On August 20, 2026, the Court held a hearing at which it addressed the parties’ post- 17 judgment discovery disputes and directed the parties to hold a final meet and confer on (i) loan and 18 credit agreements, (ii) payments and distributions to officers and equity holders, and (iii) valuation 19 and identification of assets. Attached hereto as Exhibit E is a true and correct copy of excerpts of 20 the transcript of the August 20, 2026 hearing. 21 10. On August 21, 2026, I wrote to Defendants’ counsel requesting the markup and 22 Defendants’ availability for a further meet-and-confer. Defendants’ counsel responded that 23 discussion of a deposition and of the markup should be deferred until the Court ruled on any further 24 contempt proceedings and, as to topics outside the scope of Defendants’ discovery responses and 25 production to date, until the Court ruled on any motion for protective order or motion to compel “as 26 to the proper scope of asset discovery.” 27 11. On August 25, 2026, I wrote again to request that Defendants confirm whether they 28 would engage on the deposition topics, provide the promised markup, and make Mr. Rosner 2 DECL. OF LUCA MARZORATI IN SUPP. OF PLS.’ MOT. TO COMPEL POST-J. DISCOVERY - CASE NO. 4:19-CV-07123-PJH Case 4:19-cv-07123-PJH Document 889 Filed 10/30/26 Page 4 of 8 PageID #: 34609 1 available, noting that Defendants had previously indicated that October would work for a deposition 2 and that Plaintiffs had been requesting deposition availability since July 23. Attached hereto as 3 Exhibit F is a true and correct copy of an email chain between counsel for Plaintiffs and counsel for 4 Defendants dated August 21 through September 2, 2026. See also Dkt. No. 881-3. 5 12. On September 3, 2026, counsel for the parties held the final meet-and-confer directed 6 by the Court. During that conference, Defendants’ counsel offered, only as part of a global resolution 7 of all three categories: (a) the economic terms of Defendants’ loan and credit agreements in the form 8 of a certified answer, or the agreements themselves without third-party identifying information; (b) 9 information about assets owned by Defendants in any jurisdiction other than Israel and Luxembourg 10 where Defendants hold assets valued above $150,000 in the aggregate, together with any valuations 11 of assets in those jurisdictions; and (c) information concerning payments and distributions to officers 12 and equity holders, subject to redaction of personally identifying information, which Defendants’ 13 counsel stated Israeli privacy law requires. Plaintiffs declined those proposals. See Dkt. No. 881 at 14 1–3. 15 13. At the September 3 conference, Defendants’ counsel also stated that the parties’ 16 discussions to that point had contemplated that Mr. Rosner would be deposed as Defendants’ Rule 17 30(b)(6) witness, and that he would likely be available in early-to-mid October 2026 on the post- 18 judgment Rule 30(b)(6) topics. When counsel for Plaintiffs asked for a date, Defendants’ counsel 19 did not offer one and stated that he would need to confirm with Defendants. Defendants’ counsel 20 refused to provide any markup of the Rule 30(b)(6) topics, including a markup limited to the 21 judgment-enforcement topics (Topics 1–16), and stated that no deposition should proceed until the 22 Court provided guidance on the document disputes. Defendants’ counsel further stated that 23 Defendants would object to any Rule 30(b)(1) deposition of Mr. Rosner that was not limited to topics 24 related to enforcement of the money judgment, and that, absent his appearance as a corporate witness, 25 Mr. Rosner could be deposed individually only through Hague Convention procedures. 26 14. On September 10, 2026, the parties filed a joint status statement reporting that the 27 September 3 conference had not resolved the disputes. Dkt. No. 881. In that statement, Defendants 28 represented that they “could be generally available after October 4, subject to any further rulings by 3 DECL. OF LUCA MARZORATI IN SUPP. OF PLS.’ MOT. TO COMPEL POST-J. DISCOVERY - CASE NO. 4:19-CV-07123-PJH Case 4:19-cv-07123-PJH Document 889 Filed 10/30/26 Page 5 of 8 PageID #: 34610 1 this Court.” Id. at 4. On October 16, 2026, the Court directed the parties to present all outstanding 2 disputes, including the deposition disputes, by cross-motion. Dkt. No. 885. 3 15. On September 23, 2026, Plaintiffs served a subpoena on non-party Hippocrene 4 Ventures LLC (“Hippocrene”), a Delaware entity that acquired the rights of NSO’s secured creditors 5 in October 2025. On October 28, 2026, Defendants’ counsel sent me an email stating that, in response 6 to RFP No. 6 and without prejudice to Defendants’ objections, Defendants would produce documents 7 sufficient to identify any notes issued to Hippocrene by or for the benefit of Defendants, and that 8 Defendants were producing a confidential document in conjunction with that email. Attached hereto 9 as Exhibit G is a true and correct copy of the October 28, 2026 email from David Holmes, counsel 10 for Defendants. 11 16. Attached hereto as Exhibit H is a true and correct copy of NSO Group’s audited 12 financial statements for fiscal year 2024, produced by Defendants on July 13, 2026 and bearing Bates 13 numbers PJ-NSO-000001 through PJ-NSO-000024. Defendants have designated this document 14 Confidential under the Protective Order (Dkt. No. 132), and Plaintiffs are filing it provisionally under 15 seal. 16 17. Attached hereto as Exhibit I is a true and correct copy of Q Cyber’s audited financial 17 statements for fiscal year 2024, produced by Defendants on July 13, 2026 and bearing Bates numbers 18 PJ-NSO-000025 through PJ-NSO-000042. Defendants have designated this document Confidential 19 under the Protective Order (Dkt. No. 132), and Plaintiffs are filing it provisionally under seal. 20 18. Attached hereto as Exhibit J is a true and correct copy of NSO Group’s audited 21 financial statements for fiscal year 2023, produced by Defendants on July 13, 2026 and bearing Bates 22 numbers PJ-NSO-000043 through PJ-NSO-000063. Defendants have designated this document 23 Confidential under the Protective Order (Dkt. No. 132), and Plaintiffs are filing it provisionally under 24 seal. 25 19. Attached hereto as Exhibit K is a true and correct copy of Q Cyber’s audited financial 26 statements for fiscal year 2023, produced by Defendants on July 13, 2026 and bearing Bates numbers 27 PJ-NSO-000064 through PJ-NSO-000081. Defendants have designated this document Confidential 28 under the Protective Order (Dkt. No. 132), and Plaintiffs are filing it provisionally under seal. 4 DECL. OF LUCA MARZORATI IN SUPP. OF PLS.’ MOT. TO COMPEL POST-J. DISCOVERY - CASE NO. 4:19-CV-07123-PJH Case 4:19-cv-07123-PJH Document 889 Filed 10/30/26 Page 6 of 8 PageID #: 34611 1 20. Attached hereto as Exhibit L is a true and correct copy of a document identifying 2 NSO Group’s bank details, produced by Defendants on July 13, 2026 and bearing Bates number PJ- 3 NSO-000082. 4 21. Attached hereto as Exhibit M is a true and correct copy of a document identifying 5 NSO Group’s bank account at Bank Hapoalim, produced by Defendants on July 13, 2026 and bearing 6 Bates number PJ-NSO-000083. 7 22. Attached hereto as Exhibit N is a true and correct copy of an organizational chart 8 showing NSO’s ownership chain, produced by Defendants on July 13, 2026 and bearing Bates 9 number PJ-NSO-000084. Defendants have designated this document Confidential under the 10 Protective Order (Dkt. No. 132), and Plaintiffs are filing it provisionally under seal. 11 23. Attached hereto as Exhibit O is a true and correct copy of a trademark search showing 12 a trademark (No. 6111028) registered to NSO, produced by Defendants on July 13, 2026 and bearing 13 Bates numbers PJ-NSO-000085 through PJ-NSO-000089. 14 24. Attached hereto as Exhibit P is a true and correct copy of a trademark search showing 15 a trademark (No. 6111029) registered to NSO, produced by Defendants on July 13, 2026 and bearing 16 Bates numbers PJ-NSO-000090 through PJ-NSO-000094. 17 25. Attached hereto as Exhibit Q is a true and correct copy of a “Confirmation of Account 18 Ownership” issued to Q Cyber for an account at Bank Leumi, produced by Defendants on July 13, 19 2026 and bearing Bates number PJ-NSO-000095. 20 26. Attached hereto as Exhibit R is a true and correct copy of a “Confirmation of Account 21 Ownership” issued to NSO Group for an account at Bank Leumi, produced by Defendants on July 22 13, 2026 and bearing Bates number PJ-NSO-000096. 23 27. Attached hereto as Exhibit S is a true and correct copy of an Israeli Company Registry 24 Extract for NSO Group dated July 7, 2026, produced by Defendants on August 7, 2026 and bearing 25 Bates numbers PJ-NSO-000097 through PJ-NSO-000107. 26 28. Attached hereto as Exhibit T is a true and correct copy of an Israeli Company Registry 27 Extract for Q Cyber dated July 24, 2026, produced by Defendants on August 7, 2026 and bearing 28 Bates numbers PJ-NSO-000108 through PJ-NSO-000114. 5 DECL. OF LUCA MARZORATI IN SUPP. OF PLS.’ MOT. TO COMPEL POST-J. DISCOVERY - CASE NO. 4:19-CV-07123-PJH Case 4:19-cv-07123-PJH Document 889 Filed 10/30/26 Page 7 of 8 PageID #: 34612 1 29. Attached hereto as Exhibit U is a true and correct copy of NSO Group’s Amended 2 Articles of Association, produced by Defendants on August 7, 2026 and bearing Bates numbers PJ- 3 NSO-000115 through PJ-NSO-000152. 4 30. Attached hereto as Exhibit V is a true and correct copy of a Certificate of 5 Incorporation for NSO Group, produced by Defendants on August 7, 2026 and bearing Bates number 6 PJ-NSO-000153. 7 31. Attached hereto as Exhibit W is a true and correct copy of a Company Name Change 8 Certificate for Q Cyber, produced by Defendants on August 7, 2026 and bearing Bates number PJ- 9 NSO-000154. 10 32. Attached hereto as Exhibit X is a true and correct copy of the early articles of 11 association for Q Cyber’s predecessor, produced by Defendants on August 7, 2026 and bearing Bates 12 numbers PJ-NSO-000155 through PJ-NSO-000160. 13 33. Attached hereto as Exhibit Y is a true and correct copy of a Certificate of 14 Incorporation for Q Cyber’s predecessor, produced by Defendants on August 7, 2026 and bearing 15 Bates number PJ-NSO-000161. 16 34. Attached hereto as Exhibit Z is a true and correct copy of an Israeli Company Registry 17 Extract for NSO Group dated May 6, 2026, produced by Defendants on August 7, 2026 and bearing 18 Bates numbers PJ-NSO-000162 through PJ-NSO-000164. 19 35. Attached hereto as Exhibit AA is a true and correct copy of a Convertible Promissory 20 Note dated September 17, 2026, produced by Defendants on October 28, 2026 and bearing Bates 21 numbers PJ-NSO-000165 through PJ-NSO-000181. Defendants have designated this document 22 Confidential under the Protective Order (Dkt. No. 132), and Plaintiffs are filing it provisionally under 23 seal. 24 36. Defendants’ U.S. counsel of record has appeared on behalf of Defendants and 25 accepted service of documents throughout this litigation. Before judgment, Plaintiffs deposed four 26 NSO executives, including its then-CEO, Yaron Shohat, on deposition notices served by email on 27 Defendants’ U.S. counsel of record, and Defendants did not insist on Hague Convention procedures. 28 Attached hereto as Exhibits BB through EE are true and correct copies of those deposition notices. 6 DECL. OF LUCA MARZORATI IN SUPP. OF PLS.’ MOT. TO COMPEL POST-J. DISCOVERY - CASE NO. 4:19-CV-07123-PJH Case 4:19-cv-07123-PJH Document 889 Filed 10/30/26 Page 8 of 8 PageID #: 34613 1 I declare under penalty of perjury under the laws of the United States of America that the 2 foregoing is true and correct. 3 Executed on the 30th day of October 2026 in New York, New York. 4 By: /s/ Luca Marzorati 5 Luca Marzorati 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 7 DECL. OF LUCA MARZORATI IN SUPP. OF PLS.’ MOT. TO COMPEL POST-J. DISCOVERY - CASE NO. 4:19-CV-07123-PJH