An Atlantic Council issue brief published on October 27, 2026, asks whether courts remain a safe venue for the most sensitive material in the digital age. Written by Lisandra Novo of the Council's Strategic Litigation Project, "Any means necessary: Are courts safe in the digital age?" starts from a blunt finding: threat actors have breached the U.S. federal court system multiple times and taken sealed materials. It then connects those intrusions to a quieter problem, the willingness of litigants and security researchers to bring spyware cases to court at all.

What the breaches exposed

The brief's account of the judiciary intrusions rests on 2025 press reporting. Since 2020, it says, there have been various reported hacks of the federal courts' case filing system. The stolen material reportedly included sealed items such as the identities of confidential informants or witnesses in cases against drug cartels. Citing the New York Times, the brief says state-affiliated hacking groups have done this more than once, though it names no group.

Contemporaneous coverage fills in the picture. Just Security's August 7, 2025 roundup, summarizing Politico, described intrusions believed to have exposed court data across several states, with officials fearing that informant identities at multiple district courts were compromised; the perpetrators were unconfirmed, though nation-state-affiliated actors were widely suspected. A Lawfare column by Tom Uren the following week added that the intruders reached both CM/ECF, the system lawyers use to file and manage documents, and PACER, the public-access system. According to anonymous sources cited by Politico, at least a dozen district courts were believed to be directly affected, and multiple nation-states and criminal groups were thought to have been inside CM/ECF simultaneously, some for years. Uren also noted that three foreign groups had attacked the filing system in 2020.

The judiciary's response and the critics

The Administrative Office of the U.S. Courts acknowledged in August 2025 that sealed documents "can be targets of interest to a range of threat actors," and pointed to steps already taken, including expanding multifactor authentication and limiting the use of personal devices to access sensitive information. Court officials described "recent escalated cyberattacks of a sophisticated and persistent nature on its case management system," per Lawfare.

Critics in Congress disagreed. Senator Ron Wyden's August 25, 2025 letter, as cited in the brief, used the words "Incompetence" and "Negligence," and the brief notes that critics such as Wyden say many of the adopted measures had been available for years before the judiciary adopted them. On June 2, 2026, Wyden and Senator John Kennedy reintroduced a bipartisan bill that, in the brief's description, would make efficiency and cybersecurity updates to federal court filing systems; the brief does not detail its provisions. Uren, for his part, reads the episode as part of a pattern in which agencies learn from breaches only after the fact, because sensitive but unclassified data attracts states, cartels, and criminals alike.

Why spyware litigation is the test case

The brief's title comes from Apple's September 2024 motion to voluntarily dismiss its suit against NSO Group. Apple argued that adversaries seek information about its user protections "using any means necessary," and that the risk of a spyware company obtaining discovery material outweighed the benefit of continuing, "even if it were sealed." WhatsApp's parallel case against NSO continued to judgment.

The ordinary tools, the brief notes, are protective orders under Federal Rule of Civil Procedure 26(c) and sealing. But public access is the starting presumption, and protective orders "are not absolute" and "are not permanent." Even an attorneys'-eyes-only designation does not keep material from opposing counsel. The brief calls these protections valuable but vulnerable to sophisticated threats, and warns that for spyware "even these measures might not be enough." It also notes that courts have recognized the chilling effect of litigation on non-party researchers. At the same time, it rejects expanding secret, one-sided review, arguing that this would neither solve the problem nor prevent unauthorized access.

Recommendations

The brief's prescriptions start with basics: policymakers should ensure judiciary systems follow basic cybersecurity practices and have clear data-access protocols. Beyond that, it argues that "technical measures cannot be the only solution," suggesting on-premises access to physical documents that are not entered into digital systems until a set date. It calls for statutory confidentiality protections for victims who work with security researchers, for a debate on what evidence can establish unauthorized access and attribution, and for judicial training on cases involving technical evidence. Its underlying point is that litigants can still meet the preponderance standard with material that is safe to disclose, provided the system does not force a choice between a courtroom and their own security.

Sources