Case 4:19-cv-07123-PJH Document 45-11 Filed 04/02/20 Page 1 of 6
`
`
`
`JOSEPH N. AKROTIRIANAKIS (Bar No. 197971)
` jakro@kslaw.com
`AARON S. CRAIG (Bar No. 204741)
` acraig@kslaw.com
`KING & SPALDING LLP
`633 West Fifth Street, Suite 1700
`Los Angeles, CA 90071
`Telephone:
`(213) 443-4355
`Facsimile:
`(213) 443-4310
`
`Attorneys for Defendants NSO GROUP TECHNOLOGIES
`LIMITED and Q CYBER TECHNOLOGIES LIMITED
`
`
`
`UNITED STATES DISTRICT COURT
`
`NORTHERN DISTRICT OF CALIFORNIA
`
`OAKLAND DIVISION
`
`
`WHATSAPP INC., a Delaware corporation,
`and FACEBOOK, INC., a Delaware
`corporation,
`
`Plaintiffs,
`
`v.
`
`NSO GROUP TECHNOLOGIES LIMITED
`and Q CYBER TECHNOLOGIES LIMITED,
`
`Defendants.
`
`
`
`
`
`
`
` Case No. 4:19-cv-07123-PJH
`
`DECLARATION OF SHALEV HULIO IN
`SUPPORT OF DEFENDANTS’ MOTION
`TO DISMISS UNDER RULES 12(B)(1),
`12(B)(2), 12(B)(6), AND 12(B)(7)
`
`Date: May 13, 2020
`Time: 9:00 a.m.
`Ctrm: 3
`
`
`Action Filed: 10/29/2019
`
`
`
`DECLARATION OF SHALEV HULIO
`IN SUPPORT OF MOTION TO DISMISS
`
`
`
`
`Case No. 4:19-cv-07123-PJH
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`

`

`Case 4:19-cv-07123-PJH Document 45-11 Filed 04/02/20 Page 2 of 6
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`I, Shalev Hulio, declare as follows:
`
`1.
`
`I am a citizen and resident of Israel. I am the CEO and a co-founder of Defendant
`
`NSO Group Technologies Limited (“NSO”). Defendant Q Cyber Technologies Limited (“Q
`
`Cyber” and, collectively with NSO, “Defendants”) is NSO’s sole director and majority
`
`shareholder.
`
`2.
`
`I have personal knowledge of the facts set forth herein and, except as otherwise
`
`stated, could testify competently to each fact averred herein.
`
`3.
`
`NSO is a technology company that designs and licenses technology to
`
`governments and government agencies for national security and law enforcement purposes.
`
`4.
`
`Defendants are incorporated and have their principal places of business in Israel.
`
`As Israeli corporations, Defendants are subject to service of process in Israel. Defendants have
`
`no presence in any other country. Defendants do no business in California and have no offices or
`
`employees in California or elsewhere in the United States. Defendants have not performed any
`
`actions relevant to Plaintiffs’ lawsuit in California, and they have not targeted any activities
`
`relevant to the lawsuit at California. All of Defendants’ employees with knowledge relevant to
`
`this lawsuit reside in Israel, and any documentary evidence relevant to the case is located in
`
`17
`
`Israel.
`
`18
`
`19
`
`20
`
`5.
`
`Sales of NSO’s Pegasus technology are strictly monitored and regulated by the
`
`Government of Israel. The export of NSO’s Pegasus technology is regulated under Israel’s
`
`Defense Export Control Law (“ECL”), with which I am very familiar as NSO’s CEO. A copy of
`
`21
`
`the ECL is attached as Exhibit A.
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`6.
`
`To export its Pegasus technology, NSO is required to register with the Israeli
`
`Ministry of Defense (“MoD”). Under the ECL, the MoD is empowered to investigate NSO and
`
`its business, refuse or cancel NSO’s registration, or deny NSO’s license, taking into account
`
`several factors, including the intended use of NSO’s Pegasus technology and the identity of
`
`NSO’s customers. The MoD can and does ask NSO to provide documentation about its
`
`customers and prospective customers and the intended uses of NSO’s Pegasus technology by
`
`NSO’s customers and potential customers. The MoD requires this documentation from NSO for
`
`
`
`DECLARATION OF SHALEV HULIO
`IN SUPPORT OF MOTION TO DISMISS
`
`
`1
`
`Case No. 4:19-cv-07123-PJH
`
`

`

`Case 4:19-cv-07123-PJH Document 45-11 Filed 04/02/20 Page 3 of 6
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`each export of NSO’s Pegasus technology.
`
`7.
`
`NSO’s contracts require Pegasus end-user customers to demonstrate that they are
`
`a government or an authorized agency for national security and law enforcement purposes of a
`
`government and to provide any other necessary documentation for approval by the MoD.
`
`8.
`
`The MoD requires the NSO provide it with signed certificates from the end-users
`
`of NSO’s Pegasus technology in which the end-users declare that NSO’s Pegasus technology
`
`will be used only for prevention and investigation of terrorism and criminal activity.
`
`9.
`
`NSO markets and licenses its Pegasus technology exclusively to sovereign
`
`governments and authorized agencies for national security and law enforcement purposes of
`
`governments and does so only after receiving the necessary export control licenses from the
`
`MoD. NSO does not market or sell its Pegasus technology for use by any private entities, and
`
`12
`
`Plaintiffs’ allegation to the contrary is false.
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`10.
`
`In October 2017, NSO was approached by two Facebook representatives who
`
`asked to purchase the right to use certain capabilities of Pegasus, the same NSO software
`
`discussed in Plaintiffs’ Complaint. From Facebook’s communications with NSO at that time, I
`
`understand that Facebook had purchased a web analytics company called Onavo in October
`
`2013. Onavo had created a virtual private network (“VPN”) application called Onavo Protect,
`
`which analyzed web traffic sent through the VPN to provide statistics on the usage of other
`
`applications. Onavo Protect, which has frequently been categorized as “spyware,” allowed
`
`Facebook to gather information about Onavo Protect users, including the applications installed
`
`on those users’ mobile devices and the amount of time the users spent on each application. The
`
`Facebook representatives stated that Facebook was concerned that its method for gathering user
`
`data through Onavo Protect was less effective on Apple devices than on Android devices. The
`
`Facebook representatives also stated that Facebook wanted to use purported capabilities of
`
`Pegasus to monitor users on Apple devices and were willing to pay for the ability to monitor
`
`Onavo Protect users. Facebook proposed to pay NSO a monthly fee for each Onavo Protect user.
`
`Facebook is a private entity and not a sovereign government or government agency for national
`
`security and law enforcement purposes and therefore does not meet NSO’s customer criteria.
`
`
`
`DECLARATION OF SHALEV HULIO
`IN SUPPORT OF MOTION TO DISMISS
`
`
`2
`
`Case No. 4:19-cv-07123-PJH
`
`

`

`Case 4:19-cv-07123-PJH Document 45-11 Filed 04/02/20 Page 4 of 6
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`NSO declined the sale and informed Facebook that NSO only licenses its Pegasus technology to
`
`governments.
`
`1
`
`11.
`
`NSO takes into account U.S. and European Union export control restrictions.
`
`NSO conducts due diligence of potential customers, including examining publicly available
`
`information, evaluating questionnaires, and considering the potential customer’s record of
`
`respecting rule-of-law concerns. Government customers must provide due diligence materials
`
`before receiving NSO’s Pegasus technology. (See Compl. Exh. 11, Sec. 2.2.)
`
`12.
`
`NSO requires, as a condition of use, that its government customers agree that they
`
`(1) will use NSO’s Pegasus technology “only for the prevention or investigation of crimes and
`
`terrorism and ensure that the [technology] will not be used for human rights violations” and (2)
`
`will immediately notify NSO of any potential misuse. (See Compl. Exh. 11, Sec. 2.1.) NSO
`
`contractually can suspend or terminate service to customers engaged in any improper use of its
`
`Pegasus technology outside these parameters. (See Compl. Exh. 11, Sec. 7.) And, NSO has
`
`done so in the past. Moreover, the State of Israel may deny or revoke export licenses if it
`
`becomes aware the terms of the export license have been violated, including, for example, that
`
`the Pegasus technology is being used to violate human rights.
`
`13.
`
`NSO’s Pegasus technology also has technical safeguards, such as general and
`
`customer-specific geographic limitations. (See Compl. Exh. A.) One of the limitations relevant to
`
`this case is that NSO’s Pegasus technology cannot be used against U.S. mobile phone numbers.
`
`(See Compl. Exh. D.) Another such limitation is that the Pegasus technology cannot be used
`
`against a device within the geographic bounds of the United States.
`
`14.
`
`Contrary to Plaintiffs’ false allegations, Defendants do not operate NSO’s
`
`Pegasus technology. Instead, NSO markets and licenses the Pegasus technology to its sovereign
`
`customers, which then operate the Pegasus technology themselves, to advance their own
`
`
`1
`
` Facebook thereafter used Onavo Protect to monitor users on Apple devices until August 2018,
`when Apple banned the application for violating its rules on data collection. See Nick Statt,
`Facebook Will Pull Its Data-Collecting VPN App from the App Store Over Privacy Concerns,
`The Verge (Aug. 22, 2018, 6:46 pm), https://bit.ly/2w8LwYU.
`
`
`
`DECLARATION OF SHALEV HULIO
`IN SUPPORT OF MOTION TO DISMISS
`
`
`3
`
`Case No. 4:19-cv-07123-PJH
`
`

`

`Case 4:19-cv-07123-PJH Document 45-11 Filed 04/02/20 Page 5 of 6
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`12
`
`sovereign interests of fighting terrorism and serious crime. Defendants’ role is limited to NSO
`
`providing advice and technical support to assist customers in setting up—not operating—the
`
`Pegasus technology.
`
`2 When Defendants provide those support services, they do so entirely at the
`
`direction of their government customers, and Defendants follow those directions completely.
`
`Defendants’ operation of the Pegasus technology NSO has licensed to sovereign governments
`
`and agencies for national security and law enforcement purposes is also prohibited under each
`
`export control license NSO has been granted. Each of the licenses NSO has been granted
`
`provides that operational use or ongoing operation of Pegasus by NSO employees (or their
`
`subcontractors) is prohibited, and that operation of Pegasus by NSO employees (or their
`
`subcontractors) is permitted only for demonstration purposes and on devices owned by NSO.
`
`Each export control license NSO has been granted further requires that NSO’s remote access to
`
`Pegasus technology licensed to a customer is permitted solely for purposes of maintenance
`
`13
`
`(which is not related to operation of Pegasus).
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`15.
`
`In the Complaint, Plaintiffs allege that between in and around April 2019 and
`
`May 2019, Defendants “sen[t] malware to approximately 1,400 mobile phones and devices
`
`(‘Target Devices’)” used by “Target Users,” and that Defendants did so “without the Target
`
`Users’ knowledge or consent.” (Complaint ¶¶ 1, 54.) Plaintiffs do not identify any “Target
`
`User.” But Defendants have never installed Pegasus on any device without the knowledge and
`
`consent of the device owner, and Defendants have never installed Pegasus on any device for any
`
`operational purpose. I do not have knowledge regarding the use of WhatsApp messages, by
`
`Defendants’ sovereign customers, to install Pegasus on any particular device. If one or more of
`
`Defendants’ sovereign customers did that, however, then that sovereign would have been acting
`
`on its own behalf to advance its own sovereign interests of fighting terrorism and serious crime,
`
`and it would have been without Defendants’ involvement.
`
`16.
`
`Defendants have no control over, or knowledge of, where Plaintiffs’ servers are
`
`
`2
`
` Defendants do not participate in any NSO customer’s installation of the Pegasus technology on
`any device.
`
`
`
`DECLARATION OF SHALEV HULIO
`IN SUPPORT OF MOTION TO DISMISS
`
`
`4
`
`Case No. 4:19-cv-07123-PJH
`
`

`

`Case 4:19-cv-07123-PJH Document 45-11 Filed 04/02/20 Page 6 of 6
`
`
`
`1
`
`2
`
`3
`
`4
`
`5
`
`6
`
`7
`
`8
`
`9
`
`10
`
`11
`
`located or of which server(s) would be used to send any message.
`
`17.
`
`Plaintiffs allege that Defendants used Pegasus to monitor journalists, human
`
`rights activists, political dissidents, diplomats, and other senior government officials. That is
`
`false. Defendants do not monitor anyone, and Defendants prohibit their customers from using the
`
`technology for purposes other than fighting terrorism and serious crime, by contractual
`
`prohibitions against such behavior and required end-user certificates signed by the customer. If a
`
`government ever misused NSO’s Pegasus technology to monitor WhatsApp users for purposes
`
`other than fighting terrorism and serious crime, Defendants have no knowledge of that misuse,
`
`which would be a violation of that government’s contract with NSO. If Defendants suspected
`
`any improper use of Defendants’ Pegasus technology outside these parameters, service to that
`
`customer would be suspended pending investigation. If investigation revealed such ongoing
`
`12
`
`misuse, that customer would be terminated.
`
`18.
`
`Because NSO’s government customers use Defendants’ technology to investigate
`
`and prevent terrorism and crime, discovery into Defendants’ customers’ use of the technology
`
`would require sovereign governments to reveal sensitive information about their national-
`
`security, intelligence, and law enforcement operations.
`
`19.
`
`If any of NSO’s government customers have witnesses or evidence relevant to
`
`this lawsuit, those witnesses and that evidence would be located outside of the United States.
`
`I declare under the penalty of perjury and the laws of the United States that the foregoing
`
`is true and correct this 2nd day of April 2020, at Tel Aviv, Israel.
`
`
`
`
`
`
`
`
`
`
`
`SHALEV HULIO
`
`13
`
`14
`
`15
`
`16
`
`17
`
`18
`
`19
`
`20
`
`21
`
`22
`
`23
`
`24
`
`25
`
`26
`
`27
`
`28
`
`
`
`DECLARATION OF SHALEV HULIO
`IN SUPPORT OF MOTION TO DISMISS
`
`
`5
`
`Case No. 4:19-cv-07123-PJH
`
`