Unreported / Non-Citable
Background
After plaintiffs prevailed at trial on Computer Fraud and Abuse Act, California Comprehensive Computer Data Access and Fraud Act, and breach of contract claims, the court entered a permanent injunction against defendants (NSO). Paragraph 3(a) bars using, developing, selling, or distributing technology that interacts with or emulates the WhatsApp Platform without plaintiffs' written permission. Paragraph 3(d) bars creating WhatsApp accounts without permission. Paragraph 4 requires deleting platform-dependent code and data and disabling customer access to such technologies.
Plaintiffs moved for civil contempt, supported only by a declaration from Andrew Blaich, a Meta threat-intelligence investigator. They alleged defendants created at least 23 new accounts, operated pre-existing accounts, and deployed one-click malicious URLs over WhatsApp in February and April 2026. Defendants argued the evidence was not clear and convincing, that the injunction does not bar use of pre-existing accounts, and that it does not reach sovereign customers' independent decisions to send URLs. Plaintiffs urged a ruling on the papers under Peterson and Hoffman or, alternatively, an order to show cause on a 'sufficient preliminary showing.' After an August 20, 2026 hearing, the court ordered supplemental briefing on procedure.
The Court’s Holding
The court denied the motion in full. It held plaintiffs must show a violation of a specific and definite order by clear and convincing evidence before the burden shifts to defendants, and it found no lower preliminary standard for issuing an order to show cause. It read the cited Epic Games and other district court decisions as applying the clear and convincing standard and ordering further proceedings only after finding it met. Because plaintiffs' showing fell short, the court declined to issue an order to show cause and distinguished Peterson and Hoffman.
On account creation, the declaration gave no account names, phone numbers, or other identifiers and described 'technical and behavioral signatures' only generally. The court said plaintiffs took a calculated risk by limiting detail to protect their tracking methods and would not simply accept Blaich's assurance. On pre-existing accounts, the court called the question close but found paragraph 3(a) ambiguous at best in prohibiting all such uses, resolving the ambiguity against plaintiffs, who drafted the language at the court's request. On malicious URLs, the five attribution factors (URL infrastructure, redirect behavior, lure design, targeting profile, and continuity with past conduct) were not enough, and the court rejected any 'placeholder' showing to be supplemented later. It declined defendants' request for a blanket ruling that a customer's independent decision to send a URL is outside the injunction, because the record did not show how responsibility is divided between defendants and customers.
Key Takeaways
- A civil contempt movant must carry the clear and convincing burden with its initial showing before any burden shifts to the alleged contemnor.
- The court found no lower 'preliminary showing' standard for issuing an order to show cause, so a movant cannot count on later supplementation to cure a thin record.
- A declaration that asserts high-confidence attribution but withholds account identifiers and specific technical markers may be insufficient, even when the withholding is meant to protect investigative methods.
- Ambiguity in injunction terms was resolved against plaintiffs, who drafted the language at the court's request.
- The order does not decide whether conduct by sovereign customers falls within the injunction, because that depends on facts about defendants' technical involvement that were not before the court.
Why It Matters
The order shows how demanding the clear and convincing standard is in a technical dispute over spyware and platform abuse, and it pushes movants to decide at the outset how much sensitive detail to disclose. It also warns drafters of technology injunctions that broad phrases such as 'any technology that interacts with' a platform may be read narrowly in contempt proceedings.
This is a district court order denying contempt, not a ruling on the merits of the underlying claims, and the injunction remains in force. The order does not say whether the denial is with or without prejudice or whether plaintiffs may renew the motion with more detailed evidence. The question of defendants' role in post-click operations and customer-deployed URLs was left unresolved on this record.