PENTESTY · EDITORIAL ANALYSIS · · 4 min read
WhatsApp and NSO: connecting a control's scope to its evidence
A written restriction and an investigation's conclusion each need criteria. Connect the action examined, the available evidence and the questions still open.
By Pentesty
The October ruling addresses a specific motion
On October 16, 2026, Judge Phyllis Hamilton denied WhatsApp's motion concerning alleged noncompliance with an order against NSO. Document 884 found insufficient detail to attribute new accounts and URLs to the company, alongside ambiguity concerning preexisting accounts. The ruling addresses that specific motion without reversing the earlier judgment.
The following workflow is Pentesty's editorial proposal for checking business controls. It does not transfer the evidentiary standard in this proceeding to other investigations.
A restriction needs to identify different actions
Consider ending a consultancy's access. Preventing user creation, suspending existing users and preventing actions through a delegated integration are different outcomes. Record the approved outcome, where and from when. Include who may authorize exceptions and how they will be reviewed.
Build a simple matrix: action, identity, resource, owner and expected result. A statement such as access terminated should refer to this matrix. Our analysis of linked devices in WhatsApp and Signal complements this work by examining which computers still participate in an account.
A statement and a record answer different questions
A supplier confirmation documents what the supplier declared. An administrative event may show that a change was performed. An authorized test operation helps observe its effect. Preserve the relationship between these elements instead of using one document to substantiate every expected outcome.
Record the origin, time, environment and limitations of the data examined. Before interpreting missing events, check whether the source recorded the relevant action and covered the required period. Our discussion of data provenance in corporate investigations expands the origin review; here, the focus is the link between a restriction and its observed outcome.
Provide a protected layer for evidence review
Briefing management need not involve distributing personal identifiers, conversation content or detection details to every recipient. Prepare a restricted record available to authorized reviewers, alongside a summary that lets decision makers follow progress without unnecessary disclosure.
Agree who inspects original material, which portions will be redacted and how questions will be answered. Record when a review could not reach a source. A high-confidence classification needs to state its scope; the label alone does not explain which hypotheses were examined.
Exercise different outcomes before accepting the control
In an authorized environment, use synthetic identities and data to exercise access termination. Compare permitted actions with those that should be denied. Include only the paths defined in the scope, preserving continuity for people who still need to work.
Ask someone else to review the outcome using the prepared records. If that person must rely entirely on the operator's memory, improve documentation before acceptance. The proposed exercise evaluates the observed procedure without demonstrating that no other access paths exist.
- Creation: attempt the test operation that should be blocked and record its response.
- Continuity: check the state of previous identities included in the review.
- Exception: validate an operation that remains authorized and identify its accountable owner.
Keep the conclusion within what was observed
At closure, describe which actions were verified, which depend on a statement and which remain pending. A discrepancy requires investigation; a correct sample supports only the assertion matching its scope.
Assign an owner and deadline to each gap. If the material may be used in a dispute or to meet an external order, refer those requirements to the appropriate teams. The security procedure should preserve useful evidence without anticipating legal conclusions.
Frequently asked questions
Where should control definition begin?
Describe the action to prevent, the identity involved, the resource and when the restriction begins. Identify who owns the outcome and its exceptions.
Is a statement of compliance sufficient?
It records an assertion. Connect that assertion to performed changes and available authorized checks, recording what could not be observed.
Must every detection detail be disclosed?
Plan restricted review and minimization. A management summary can protect details while authorized reviewers inspect the basis for the conclusion.
Does the test demonstrate that all access has ended?
The conclusion should reflect the sample and examined paths. Record limitations and next steps rather than asserting coverage that the exercise did not provide.
Sources and references
- U.S. District Court, Northern District of California: October 16, 2026 order, document 884
- Cyber Security Brazil: editorial news reference
Original Pentesty analysis, published October 22, 2026. The proposed scenarios are editorial guidance, with scope and validation to be defined for each environment.