WhatsApp Inc. v. NSO Group Technologies Limited

Background

WhatsApp Inc. and Facebook, Inc. alleged that defendants sent spyware through WhatsApp’s system to approximately 1,400 mobile phones and devices to surveil their users. The operative claims were under the federal Computer Fraud and Abuse Act, the California Comprehensive Computer Data Access and Fraud Act, breach of contract, and trespass to chattels. The court’s footnote states that it had dismissed the trespass-to-chattels claim under Rule 12(b)(6), which concerns whether a complaint states a legally sufficient claim.

The court had previously refused to excuse defendants from all discovery because of United States and Israeli restrictions. It had instead adopted a framework from a prior appellate decision requiring consideration of factors including the importance of the requested information and the specificity of the discovery request. The court stated that disputes in this case would focus on those two factors.

Plaintiffs’ Motion to Compel Discovery

The court granted in part and denied in part plaintiffs’ motion to compel discovery. Defendants had already agreed that some requests sought sufficiently important and specific information and that those materials had to be produced.

For the remaining requests, the court ruled as follows:

- Relevant spyware: The court adopted plaintiffs’ definition of “all relevant spyware” as any NSO spyware targeting or directed at WhatsApp servers, or using WhatsApp in any way to access target devices. The production could not be limited to the Pegasus program or to one operating system. The required timeframe was April 29, 2018, through May 10, 2020, covering one year before through one year after the alleged attack. Plaintiffs could seek additional discovery if later evidence showed that an attack lasted beyond that period. - Spyware functionality: Defendants had to provide information sufficient to show the full functionality of the relevant spyware, not merely its installation layer. The court reasoned that the claims involved alleged access to and extraction of information from target devices. - Third-party clients: Defendants did not have to disclose the identities of their third-party clients. Plaintiffs could obtain information about what those parties did and the role defendants played, but the court found that the clients’ specific identities were not necessary for that discovery. - Server architecture: Defendants did not have to provide specific server-architecture information at that time because the court concluded that plaintiffs could obtain the relevant information from discovery about the spyware’s full functionality.

Defendants’ Motion to Compel Discovery

The court denied defendants’ motion to compel. Defendants sought plaintiffs’ communications with Citizen Lab and internal documents concerning plaintiffs’ identification of users allegedly targeted by defendants’ software. Plaintiffs had produced the internal documents after the motion was filed, so the court found no current dispute requiring resolution as to that category.

As to Citizen Lab communications, the court found that defendants had not shown that the requested discovery was relevant under Federal Rule of Civil Procedure 26(b)(1). The court denied the request to the extent it sought post-complaint communications, concluding that defendants had not connected those communications to the remaining claims or asserted defenses.

Case Schedule and Other Motions

The court granted defendants’ motion for relief from the case management schedule. Expert disclosures were due by August 30, 2024, the start of trial was continued to March 3, 2025, and the parties were ordered to submit a stipulation covering the remaining dates. The stipulation had to follow the court’s standing order and provide at least 120 days between the summary-judgment hearing and trial.

Because defendants’ scheduling motion was granted, plaintiffs’ motion for interim schedule relief and administrative motion to shorten time were denied as moot. The parties’ motions to seal were granted.