Did Citizen Lab's sysadminning contribute to the outcome of this legal case to impose financial penalty on a vendor of state-purchased spyware? Or is the penalty considered insignificant to future deterrence?