... That's exactly what they did?

From the complaint:

>Count One

>Violations of Computer Fraud and Abuse Act

https://www.apple.com/newsroom/pdfs/Apple_v_NSO_Complaint_11...

The EULA is used to establish jurisdiction, and for the separate breach of contract claim. Apple has servers around the world, without the EULA the jurisdiction isn't necessarily obvious.

I believe the CFAA is a criminal law, and charges would have to be brought by an AG. This is a civil case.

This is not correct, civil suits over CFAA violations are common.

They are throwing the CFAA at then. However, the CFAA is an American law, which would be challenging to apply in a foreign court. So they are using the EULA to sue in California. It’s all in the article.

Does the CFAA apply to an Isreali firm sending a text message from Isreal?

Yes, it can. You can find Apple's lawyers explanation in the complaint under the "JURISDICTION AND VENUE" heading https://www.apple.com/newsroom/pdfs/Apple_v_NSO_Complaint_11...

Could be used for attempting to find metadata on users then, etc. there’s a few things I could guess.