Oh so NOW it’s okay to talk about Pegasus?

I’m about to drop a lot of files and by the 4th tweet it will all make sense.
In my industry it’s known as a “reach back” don’t conflate with “claw back”

It’s also worth noting FSBook sued NSO https://twitter.com/AASchapiro/status/1246084083349946369
Pegasus and MbS-Bone-Saw supplemental thread https://twitter.com/File411/status/1219733751137275905?s=20
the unholy matrimony of TilTok, UAE, & NSO -tying PAX AI - your supplemental thread https://twitter.com/File411/status/1210239184084119554?s=20
This UN & (former) Twitter employee indictment landed me in Twitmo
Your “other” supplemental thread of Bezos, MbS-Bone-Saw and Pegasus https://twitter.com/File411/status/1220002781806911488?s=20
You’re File-y is an ahole tweet or File-y might be telling you to pay close attention to the “scattered” dots
Given enough time those dots do tend to connect https://twitter.com/File411/status/1220356038156636168?s=20
Also belated ht to @Kitten0409 - I saw the gantry gate open and I took off like a pissed off race horse. Apologies I am typically fastidious in my attributions.
Me lurves you
And you guys thought I was completely wrong about Amazon & WhatsApp & NSO
One has to wonder how many of our “elected leaders” use WhatsApp https://twitter.com/jsrailton/status/1253526716460535808?s=20
You should read the whole thread https://twitter.com/jsrailton/status/1253502213353361412?s=20
Understanding the nodes in the context of the infrastructure
Which then brings up a really (unanswerable) question;
If WhatsApp & NSO are riding the same light & cloud - seems like a pretty probable criminal implications re domestic tell infrastructure👇🏻 https://twitter.com/ushadrons/status/1254279520577826816?s=20
Get that?
“Amended Administrative Motion to File Under Seal Confidential Material in WhatsApp's Motion to Disqualify Defense Counsel and Supporting Documents filed by Facebook Inc., WhatsApp Inc..”
cc @ushadrons @jsrailton
Uploading filings not under seal - here we go (try to keep up, I chugged a Red Bull about 71 minutes ago)
In short King & Spaulding repped WhatsApp on another (quasi) related matter


Here I pulled it down saving you $.50

Declaration of Grooms Amended Administrative Motion to Seal
To be candid you are NOT going to glean very much from the Declarations bc as you can see heavily redacted
Here I saved you $.40- it’s arguably pretty narrow sealing
NSO is really threading a tight needle with their Oppo to disqualify <thread>

“...there is no dispute the alleged use of Pegasus to message 1400 foreign WhatsApp users in April and May 2019 was done by sovereign governments in foreign countries..”

NSO asserting that WhatsApp;

“To the extent Plaintiffs make new assertions of fact, they may not amend their Complaint through unsupported statements in their Opposition; they must file an amended complaint...”
Which is interesting - assumption is it’s what’s redacted.
I could be wrong but my sense is NSO is laying a predicate for their “Foreign Government Clients” pursuant to;

Foreign Sovereign Immunities Act (FSIA) 28 USC §§ 1330, 1332, 1391(f), 1441(d), & 1602–1611
This is likely undergirding their “court doesn’t have jurisdiction” argument
Here’s the quagmire (for both parties) unquestionably “NSO traffic” traversed WhatsApp “network”...it also traversed our “domestic” telco infrastructure(s)
That would be a logical jurisdiction argument.
But WhatsApp “retroactively” changing their TOS actually gave NSO an opening
I could be wrong (so it’s okay to be skeptical)
WhatsApp changing ToS to “better their argument” it’s a bad look - one way changed two way

NSO - “we don’t have a contract” also bad look
Bottom line;
Can WhatsApp “show” injury, concrete & particularized?
Both are parsing words
You see what NSO is building here, right?
They are “off boarding” NSO & Pegasus to the individual user(s) and/or customers (to include foreign Govts) that NSO isn’t “responsible” for traffic that “may have” crossed WhatsApp servers in CA & NSO doesn’t have a contract
Wow just wow
Well did any of you have Broidy v Qatar on your WhatsApp v NSO v Pegasus (MbS say what) bingo card?
The footnote is interesting - self explanatory.
For now I say - let’s wait & see WhatsApp’s responses and/or the Court’s ruling
Here I saved you $2.70
It’s a good time to remind you about Pegasus
See Jan 2020 thread and yes of course it’s sourced

UNHCR Investigative report✔️
Bezos Pegasus injection via WhatsApp✔️
Filey got sent to Twitmo for this thread, I assume something in this thread👇🏻 https://twitter.com/File411/status/1219733751137275905?s=20
FWIW I don’t think it was my BoneSaw comment - I think it may have been drilling down on the actual UNHCR special report which was/is unambiguous https://twitter.com/File411/status/1220002781806911488?s=20
Note that “on papers” so a hearing for oral arguments isn’t off the table as evident by the last sentence. If required the Court will do it telephonically bc the GO of NDCA has the Courthouse closed to the public until June 1, 2020
I converted to a pdf👇🏻
So NSO Group shape shifted Pegasus and it’s now selling it as “Phantom” - this Mother Board article is


Given just a few days ago NSO Group had an “open” server that contained Covid-19 tracking & tracing info.. https://twitter.com/motherboard/status/1260224511087083520?s=20
Really wish we knew what the DOJ matter is...
Parties..granted 2 previous time modifications

“1) Plaintiffs’ request to reschedule a Case Management Conference prior to service of the summons and complaint on Defendants; and
2) a Joint Stipulation to Enlarge Time for Plaintiffs to Oppose Defendants’ Motion to Dismiss”
Proposed stipulation Order - again the Court hasn’t signed off hence “proposed”
Ugg - this is like the equivalent to “a death by a thousand paper cuts” or the “Chinese water torture”
I certainly expect by the end of June the Court to make a determination to either disqualify or not. Yes that binary
Mother of biscuit-eaters no sooner did I tweet the Order the docket then updated with a NEW order;

changed date FROM June 12 TO June 5th

I DID NOT have this on my NSO Bingo Card, it was rumored tonight’s filing makes it FACT

OSY Tech—> Q Cyber Tech—> NSO
@GenFlynn OGE Financial Discloses received $40K advisory board member for OSY Technologies
cc @911CORLEBRA777 @LouiseMensch @xtrixcyclex
Flynn signed his OGE Financial Disclosure on 2/11/17, a few days before he was fired
Moreover it’s curious that this late in the FB v NSO case they are NOW disclosing OSY Tech shareholder of Q Cyber Tech
Flynn OGE
NSO Filing
I should say - remember in the Facebook v NSO the DOJ made the parties stop “because of an ongoing matter”. And thereafter a bunch of “sealed” filings. It could be a random coincidence that OSY paid Flynn -but that’s pure speculation on my end. Nonetheless it is very curious
Gawd why can’t I keep my threads straight - so at about 3AM DC local time Facebook-WhatsApp and NSO-Pegasus-Phantom filed a:


Filing will cost you $1.80 or you can wait on me to upload
https://ecf.cand.uscourts.gov/doc1/035019297509?caseid=350613 https://twitter.com/File411/status/1263863458438746114?s=20
so @Facebook & @WhatsApp going THERE - gulp

“around April 2019 and May 2019, Defendants used WhatsApp servers..to send their Spyware to approximately 1,400 mobile phones and devices belonging to attorneys, journalists, human rights activists, government officials, and others”
so I think most of us knew about the FBI investigating NSO
(See next tweet/thread I’ve been over this repeatedly & I pulled down the UN special report re Bezos & MbS-Bone-Saw)
But I personally was unaware of the Kingdom using NSO on a NYTs Reporter’s phone. It DOES makes sense
In this January 21, 2020 thread;
Bezos hack✔️
UN Special Report✔️
Subthread of 2 Twitter employees acting on behalf of Saudi Arabia✔️
It’s a lot but it’s interesting to see some of the previous reporting in today’s filing https://mobile.twitter.com/File411/status/1219733751137275905
NSO thanks for clearing that up:

“...export of NSO’s Pegasus technology is regulated under IDECL.. Defendants’ customers are exclusively government agencies....anyone installed Pegasus on any WhatsApp user’s devices.. It would have been an agency of a sovereign government”
The discovery status is intriguing. But I say let’s what and see what the Court does.

Here I saved you $1.70 & uploaded the JCMS to a public drive.
I have got to get back to my actual job (that doesn’t include tweeting)

So the fact that NSO “amended” their March 6, 2020 Certificate of Interested Entities...and they still got it wrong.
Good LORD but the question remains why didn’t they disclose in their initial filing & why wait until 5/21/20?
That seems oddly significant
The filing I want to see is Doc 79-3
5 page motion

Doc 79-3 it is largely redacted and it’s quasi reiterative of NSO’s previous filings.
Reminder King & Spaulding (K&S) represented @WhatsApp “Dec 2015 – July 2016 representation of WhatsApp in unrelated litigation”
MAIN arguments
“..information protected by the sealing order in the Sealed Matter” & privileged, attorney client & work product
IMPORTANT there is a sealed matter pending in a District Court
Again remember a few months back the DOJ intervened and essentially pulled the emergency brake. I have no idea what the case is or what district and NOPE I’m not going to guess
Saved ya $0.50👇🏻
King & Spaulding (K&S) LLC’s Opposition to Motion to Disqualify
Think this is first time that K&S names the former K&S partner;
Now FBI Dir & represented WhatsApp in the “sealed matter”
I’m NOT saying K&S or Dir Wray did anything wrong
cc @911CORLEBRA777
In 2015/16 WhatsApp retained K & S - attorneys Chris Wray & Cathy O’Neil to...to provide the Company with legal advice...[sealed matter] and redacted..Wray left K&S after being nominated and then appointed as Director of the FBI (a fact WhatsApp failed to mention in its motion)”
WhatsApp & NSO are engaged in a tit-for-tat & the lawyers hear the cash register.
“K&S billed WhatsApp for 93.6 hours of work, of which 77.9 hours was recorded by Ms. O’Neil & Mr. Wray”
DC hourly rate for a partner $1450 x 93.6 hours = $135,720.00
MRR $33+K
K&S stored WhatsApp client files offsite but now they are in the K&S GC Office - who boy - NSO then goes on to disclose their Digitized File Folders, subfolder and partial contents.
Sorry I fell asleep as I was typing.
See next tweet
All kidding aside I did tell you this was redacted.

Tomorrow I plan on cross referencing a couple of data-points. I have a hunch due to tiny tiny details add up like a ravenous gam
I don’t want to put it in the public domain absent significant receipts
Oh my
Oh my oh my...
I’m only tangentially familiar with Mr Shapiro and only in a good & respectable way, his addition to plaintiffs - interesting
You don’t have to agree with me - IMO (and no I am NOT defending King & Spaulding) they are making a reasonable request. Like it or not the fact is WhatsApp is asking for an extraordinary motion to disqualify K&S

I did NOT have this on my BINGO CARD
WhatsApp Motion to Disqualify King & Spaulding
It’s a pretty meaning Opinion/Order but one take away is WhatsApp overreached with their motion to disqualify

Simply put the Court concluded the matters were not related therefore WhatsApp argument sans merit

“if the two matters are not substantially related...Rule 1.9’s prohibition does not apply and there is no basis to disqualify K&S...”
Here I saved you $1.90
Smalls you are freaking KILLING ME
And right on queue NSO be like:

STAY DISCOVERY ALL OF IT because we want a ruling on our MTD - it’s 22 pages & it’ll cost you $2.20 because I’m tired and don’t feel like dissecting it. A file has their limits
NSO argues that discovery should be stayed until the Court Rules on their Motion to Dismiss.
Now I’m going to start tweeting kitten gifs & other non substantive shit. Those seem to go viral whereas legal filings & facts get ignored.
What's the point?
Position Summary
(before we dive in to the ruling)

WhatApp🚩NSO/Q Cyber impermissibly loaded Pegasus & infected >1,400 WhatsApp Users

NSO🚩 we’re immune, court has no jurisdiction over us & you can‘t prove we did anything
The Court: split the baby
4/29/19 thru 5/10/19

“defendants caused their malicious code to be transmitted over WhatsApp’s servers reaching approximately 1,400 devices used by “attorneys, journalists, human rights activists, political dissidents, diplomats, and other senior foreign government officials”
the Court spent a significant addressing the Rules, Scrutiny, important to remember the “why”?
“While the court is to accept as true all the factual allegations in the complaint, legally conclusory statements, not supported by actual factual allegations, need not be accepted“
NSO/Q Cyber Pegasus bet the farm that they were/are entitled to immunity pursuant to;
Foreign Sovereign Immunity Act 28 USC §§ 1602–11
The Court addresses the doctrines:
foreign official immunity & derivative sovereign immunity
Spoiler FSIA not applicable
So one thing I repeatedly say is you have to read the footnotes.
Would you like to know why?
Page 21 - re Judicial Notice QuadraNet which will be crucial when FB/WhatsApp files an amended complaint

equipoise<— that’s not used very often but it is absolutely correct as it relates to;
Plaintiffs move case to Israel
Defendants answering a complaint in CA
in short it’s a “wash” for both parties, as the Court correctly states. Think of it as a see-saw
This is why the Court drilled down on Jurisdiction
Defendants MTD based on lack of Jurisdiction etc
Court found their arguments unavailing
“..defendants’ motion to dismiss the complaint for lack of
personal jurisdiction is DENIED..failure to join necessary parties is DENIED“
Defendants MTD Failure to state a claim, the Court found their arguments unavailing as well:

“...defendants’ motion to dismiss plaintiffs’ first cause of
action for violation of the Computer Fraud and Abuse Act is DENIED“

It is kind of odd what WhatsApp argued & didn‘t
To be fair after following this case quasi closely, I didn’t think WhatsApp had solid ground re “Chattels” it seemed like a stretch to me but I was curious they didn‘t abandon that claim so the Court did it for them by granting NSO MTD that count.
So what does all of this mean? WhatsApp won some & so did NSO
The Court is allowing WhatsApp to file an amended complaint to address the deformities of their complaint.
It does strike me as odd how NSO argued hey we just licensed it not our issue /fin https://drive.google.com/file/d/1qHOf-GgbRfXjUj4iCK9pYGYpHxU3Qkwj/view?usp=drivesdk
So I had a free moment in between bean flicking & shoving bonbons in my calorie hole (and I was super bored waiting for other’s edits)
So I just ran a fresh docket report - so BOLO new filings by August 6, 2020
Well this is kind of interesting...as in:

what kind of “new” informatio does NSO have that they are now slagging it out with WhatsApp re a “tailored protective order”
zero idea of what it is .. so we wait...

I think there’s a typo see page 2 v 3

“..have recently obtained information that Defendants’ counsel believes is of great importance to the Court and Plaintiffs’ outside counsel in the orderly management of the case and the parties’ litigation of it“
I’m surprised because things have certainly been acrimonious between the parties.
It’ll cost you about $14.60 or you can give me a minute to wrap up my actual job and then uploaded to a public drive.
I don’t think the Court ruled on the 8/4 PO motion
In my industry it’s called the Triple D tactic;
Plaintiffs make a solid argument that NSO has essentially granted itself a “stay” of discovery. By means of subterfuge & a plethora of legal maneuvers -specifically interlocutory appeal
Again if my highlights bother you, feel free to pay for the filings yourself otherwise omertà with the complaints. Management Dept gives zero Fs <snort>
Exhibit B-2 hand to baby Cheesus the highlights are NOT mine - oh burn 😂
Uploaded to a public drive - the Plaintiff’s yellow highlights are referenced throughout their Motion to Compel, discovery
WhatsApp/Facebook & NSO/QTech akin to:
Thanksgiving dinner when Mom & Dad have too much to drink & start screaming at each other. Awkward
NSO/QTech (finally) filed a Motion to Stay “all proceedings in this matter until the 9thCCOAs” renders a determination
Pay attention to the relevant highlights in the footnotes. I have occasionally tweeted an explanation of why USCA “splits” can be hugely problematic, typically requires SCOTUS to sort it out.
NSO argues the 5th & 9th CCOAs “split”
IMO not a strong filing
“..new draft departs materially from this District’s model order, backtracks on numerous issues already resolved in the parties’ negotiations ...Plaintiffs declined to accept it ...enter its novel and one-sided protective order.. moved to shorten time for Plaintiffs to respond”
IMO NSO has not acted in good faith
Conversely neither have the plaintiffs
The only real winners here are the cadre of attorneys billing at least >$2K per hour (collectively)
The plaintiffs do make solid arguments “failed to show good cause” & shortening
Here I uploaded the Plaintiffs late night Oppo filing to a public drive - and if you give me a moment I’ll upload NSO’s response.
The issue is NSO essentially screamed fire but didn’t tell the Court or Plaintiffs “what new & urgent pressing info” https://drive.google.com/file/d/1x4qjlc56poNWtIxXKkp7W-qoY6bBMb8s/view?usp=drivesdk
Keep in mind that the Defendants have engaged in an incomprehensible amount of subterfuge.
I can actually see the Plaintiffs POV re NSO “self determined stay” of discovery.
And then using this “urgent info” as a dangle for a new & materially clawed back PO
ALWAYS know your local rules
Civ. L.R. 7-2(a) & Civ. L.R. 6-3(a)
“Defendants have not established.. they will face any substantial harm or prejudice.. The court agrees Defendants have failed to put forward a particularized showing of good cause“
In my line of work there’s a colloquiums that’s often used:
Silence is the refuge of the wise.
Here we can observe the Plaintiff’s embodiment of that colloquium...
What. The. ___ is NSO/QTech doing?
come on man - why are you suddenly withdrawing the Protective Order you vociferously fought for?
talk about wasting the Court’s time

I genuinely have so many questions and they are VERY uncomfortable questions...

...but I’m not looking to get suspended... so I’ll just leave this thread right H-E-R-E

ht @tonyserrata https://twitter.com/jsrailton/status/1339750718379581440?s=20
Hiya insomnia, I see we meet again
“Amici offer products and services, and rely on
systems, that may be targeted by malicious actors, both foreign and domestic”
As you’ll recall NSO/QTech repeatedly argued FISA...essentially that they are “immune” & out of reach of our Judicial System

“...amici explain how immunizing
uses of privately developed cyber-surveillance tools would dramatically increase systemic cybersecurity risk...”
If you read nothing else in this brief
Court must now decide whether to radically expand the risks these powerful tools pose by also immunizing private companies’ use of commercially developed cyber-surveillance
tools when they act on behalf of their foreign-government customers
“Expanding foreign sovereign immunity to private companies that use their own cyber-surveillance tools at the behest of their numerous foreign-government customers would dramatically increase the creation and use of cyber-surveillance tools globally..”
See footnote on page 12
That’s certainly an eye popping number. It’s like NSO/QTech might not be “ethical” & weird how some said I was wrong abt Pegasus
“proliferation of companies trying to replicate NSO’s success and compete in an estimated $12 billion market
for so-called lawful intercept spyware.”
Amici are drawing parallels that when vulnerabilities ARE discovered:
“responsible disclosure”
“Coordinated Vulnerability
Whereas NSO/QTech entire business model is to exploit vulnerabilities. Availing their “services” to foreign nations or the highest bidder
NSO/Qtech appeal specifically targets the DC holding that FISA
Title 28, §§ 1330, 1332,1391 (f),1441 (d), & 1602–1611
is applicable to them
Arguing their ”clients“ are foreign nations
Amici(s) argue NSO/Qtech sweeping interpretation is dangerous
Amnesty International
Committee to Protect Journalists
Internet Freedom Foundation
Paradigm Initiative
Privacy International
Red en Defensa de los Derechos Digitales
Reporters Without Borders
”...advocate for &endeavor to protect fundamental human rights and rule of law”
Remember the time Twitter said I was wrong about Pegasus
Yet once again the facts prove who was/is wrong & who was right of just how insidious NSO/QTech really are.
Or remember how some said I was completely wrong about FSIA?
I mean it’s so weird
“[J]ust one simple missed call on WhatsApp” allows Pegasus to “drop its payload” and access everything,
from email and messages to the phone’s microphone, camera, and GPS coordinates...”
Never forget @jaredkushner & @realDonaldTrump gave MbS cover https://twitter.com/File411/status/1220356038156636168?s=20
2016 - 2018
‘Pegasus had proliferated into 45 countries.. several that had either “previously been linked to abusive
use of spyware to target civil society” or had “dubious human rights records & histories of abusive behaviour by state security services“
The argument is:
NSO/Qtech’s Pegasus is almost exclusively used by some of the most oppressive regimes on the planet. Pegasus is a cyber-weapon and these barbaric regimes use Pegasus to silence “dissenters“ and in many cases permanently silence dissenters by killing them.
confirmed targets of Pegasus:
Placide Kayumba – In exile from Rwanda
Father Pierre Marie-Chanel Affognon – Togo
Fouad Abdelmoumni and Aboubakr Jamaï – Morocco

“threaten[s]” rights to “free expression” and “privacy,” which “international law recognizes as foundational“
The core of this briefs argument:
NSO’s government clients use Pegasus to violate international laws that protect the right to privacy and free expression“
NSO/QTech’s Pegasus is one of the most effective & most intrusive weaponization of information while eviscerating privacy
“NSO continues to supply surveillance technology to its clients.. knowing they use it to violate international law, failing to fulfill its responsibility to respect human rights”
Almost a year ago I was like HELLO anyone else read the UNHCR report?
Amici Curiae Access Now, Amnesty International, Committee to Protect Journalists, Internet Freedom Foundation, Paradigm Initiative, Privacy International, Red en Defensa de los Derechos Digitales, and Reporters Without Borders
BRIEF lined below /fin
You can follow @File411.
Tip: mention @twtextapp on a Twitter thread with the keyword “unroll” to get a link to it.

Latest Threads Unrolled:

By continuing to use the site, you are consenting to the use of cookies as explained in our Cookie Policy to improve your experience.