WhatsApp Inc. v. NSO Group Technologies Limited

District Court, N.D. California·Decided April 15, 2025·No. 4:19-cv-07123·Unknown

Opinion

WHATSAPP INC., et al., Case No. 19-cv-07123-PJH Plaintiffs, v. FINAL PRETRIAL ORDER NSO GROUP TECHNOLOGIES Re: Dkt. 488, 491, 505, 506, 509, 510, LIMITED, et al., 512, 514, 573, 593, 601 Defendants.

Pursuant to Rule 16(e) of the Federal Rules of Civil Procedure, this final pretrial order is hereby entered and shall control the course of the trial unless modified by a subsequent order. A. Plaintiffs’ Motion in Limine No. 1 Plaintiffs’ first motion in limine asks the court to preclude defendants from offering “evidence, testimony, or argument about the alleged identities or affiliations of its customers or prospective customers, including governments or law enforcement, military, or intelligence agencies.” See Dkt. 593 at 6. As an initial matter, such evidence is irrelevant to the issue of compensatory damages. The alleged identities of defendants’ customers has no bearing on the costs incurred by plaintiffs in responding to the conduct at issue. To the extent that the alleged identities of defendants’ customers are relevant to punitive damages, the court first emphasizes that the punitive damages analysis does not the conduct which gave rise to liability in the case.” See Livingston v. ABB, Inc., 100 F.Supp.3d 894, 904 (C.D. Cal. 2015) (citing Medo v. Superior Court, 205 Cal.App.3d 64, 68 (1988)). In other words, the punitive damages analysis looks to defendants’ intent with respect to the conduct alleged in this case. At the pretrial conference, defendants’ counsel maintained that defendants are “unable to turn over” much of the evidence regarding which client(s) conducted the specific intrusions at issue in this case because they are “not items that we have possession of or ever did.” See Dkt. 684 at 49. In other words, defendants’ counsel argues that they have not refused to produce the discovery, they argue that they are unable to produce the discovery because it is not in their possession. Over the course of the pretrial conference, defendants’ counsel maintained that defendants do not have information about which of their client(s) were responsible for accessing the 1400 target devices at issue in this suit, or the client’s reason(s) for the access. See Dkt. 684 at 41 (“We would not know who are the specific customers who are targeting those 1400.”); id. at 65 (“what I think you're looking for is do you -- do you have evidence about what your customers did with the -- with your system and who they investigated and where those people are and what numbers of the target devices were being used, and so on. And the answer to that remains, as I've said earlier, Your Honor, that that is not information that NSO ever had.”). Defendants’ counsel reiterated that they do not have specific information about the attacks at issue in this case: To the extent that that was requested in discovery and ordered by the Court, we provided whatever we had. We do not have discovery about who our clients target, what their criminal investigations are. As you would expect, we don't know what client X is investigating. It would be totally inappropriate for a software provider to be exposed to what criminal investigations or what counterterrorism investigations are being conducted by a foreign nation state. They wouldn't want us to know that and we wouldn't want to know that. See Dkt. 684 at 66-67. defendants did have information that was not produced, any non-production was due to national security reasons. See Dkt. 684 at 15-16 (“generally speaking what the customers, you know, the details of their operations, to the extent it's known to NSO, Your Honor is correct that that has not -- that is not a subject that the witnesses were allowed to testify about or that we were allowed to produce evidence of for national security reasons.”) Defendants also point out, correctly, that the court previously concluded that they “need not disclose the identities of their third-party clients.” See Dkt. 292 at 5. However, the court simultaneously concluded that, while “plaintiffs need not discover the specific identities of the third parties, they were “permitted to discover information about what actions were taken by those third parties,” because “defendants have raised the actions of those third-party clients as a defense.” See id. (emphasis in original). Regardless of the reason, the fact remains that plaintiffs have not had a meaningful opportunity to review evidence regarding which of defendants’ clients were responsible for the alleged attacks. Defendants argue that plaintiffs’ own documents identify “at least four countries as NSO customers,” but it does not appear that defendants have confirmed that those countries are indeed their customers, nor – more importantly – have defendants confirmed that any of those countries were responsible for the attacks alleged in this suit. Defendants rely on generalized evidence about their business practices, stating that they have a practice of licensing Pegasus only for lawful purposes and terminating the license of any client found to be misusing Pegasus, but there is an absence of specific evidence tying those general business practices to the specific events of this case. The end-result of all of this discussion is that neither party has non-speculative evidence about the identities of which NSO customers were responsible for the attacks alleged in this case. As a result, it would be improper for the court to allow evidence of NSO’s other customers and their supposed intent, entirely unrelated to the events of this provide relevant discovery, the pretrial conference clarified defendants’ position that they are not in possession of the discovery at issue in this motion in limine, as can be seen in the transcript quotations above. Accordingly, any ruling by the court is based purely on the absence of evidence, not on alleged discovery misconduct. Defendants cite a number of cases broadly allowing intent-related evidence for reasons of “background” or “context.” But the reasoning of those cases cannot be directly applied here, because those cases did not involve the same sort of discovery limitations due to the necessity of applying the Richmark analysis. See Richmark Corp. v. Timber Falling Consultants, 959 F.2d 1468 (9th Cir. 1992). The Richmark court noted that “we are not unmindful of the difficulties foreign corporations face in doing business in the United States, nor of the rather delicate nature of relations between sovereign states,” but that “international business requires the accommodation of different legal climates.” Id. at 1478-79. The Ninth Circuit made clear that, “just as United States companies doing business in” a foreign country must expect to abide by that country’s laws, when a foreign company “availed itself of business opportunities in this country, it undertook an obligation to comply with the lawful orders of United States courts.” Id. at 1479. Like the Richmark court, this court does “not minimize the difficult situation in which” defendants have been placed due to their competing legal obligations, but the fact remains that, in this case, plaintiffs have not had a full opportunity to test and scrutinize evidence regarding which of defendants’ clients were responsible, or the actions taken or motivations for the attacks at issue, thus distinguishing this case from more-typical punitive damages cases in which discovery is unfettered by Richmark considerations. Importantly, even if the evidentiary record did establish which of defendants’ client(s) were responsible for the attacks at issue, defendants would not be permitted to impute the law enforcement/military purposes of those clients to defendants themselves.1 1 Because defendants argue that both the identity of their clients, as well as their clients’ purpose

Free access — add to your briefcase to read the full text and ask questions with AI

WhatsApp Inc. v. NSO Group Technologies Limited, (N.D. Cal. 2025).

WhatsApp Inc. v. NSO Group Technologies Limited (WhatsApp Inc. v. NSO Group Technologies Limited) — published by Counsel Stack Legal Research, free access to 12M+ legal documents.

Related

Ratzlaf v. United States
510 U.S. 135 (Supreme Court, 1994)
Medo v. Superior Court
205 Cal. App. 3d 64 (California Court of Appeal, 1988)
William Stephens v. Union Pacific Railroad Company
935 F.3d 852 (Ninth Circuit, 2019)
Ticknor v. Rouse's Enterprises, LLC
2 F. Supp. 3d 882 (E.D. Louisiana, 2014)
Richmark Corp. v. Timber Falling Consultants
959 F.2d 1468 (Ninth Circuit, 1992)