(CN) — A federal judge in California on Thursday refused to dismiss a suit brought by WhatsApp and Facebook against an Israeli software company that claims the company used WhatsApp to send surveillance malware to over 1,000 devices, including devices used by journalists, human rights activists and senior foreign government officials.
Last October, the messaging platform WhatsApp and its owner Facebook brought a lawsuit against NSO Group Technologies Limited, claiming that the software company used WhatsApp to send malware to roughly 1,400 devices used by lawyers, activists and diplomats.
The malware was designed to be a form of surveillance software that was used to spy on the users of the infected devices, according to the complaint.
WhatsApp claims that NSO accomplished this by using WhatsApp’s servers to initiate calls with the devices being targeted that could infect them with malware once the call was complete – even those being targeted who never picked up the phone.
“Disguising the malicious code as call settings enabled Defendants to deliver it to the Target Device and made the malicious code appear as if it originated from WhatsApp Signaling Servers,” the original complaint stated. “Once Defendants’ calls were delivered to the Target Device, they injected the malicious code into the memory of the Target Device—even when the Target User did not answer the call.”
Based on this, WhatsApp and Facebook requested in their complaint that NSO be ordered to stop their activities and pay the companies a series of compensatory, statutory and punitive damages.
NSO asked U.S. District Judge Phyllis Hamilton of the Northern District of California to dismiss the claims brought against the software company, but Hamilton, a Clinton appointee, largely denied the company’s request and allowed the lawsuit to continue.
One notable argument NSO sought to use in its dismissal request was that the court lacked subject matter jurisdiction. The company claims that the conduct that gave rise to the complaint was conducted by “foreign sovereigns” and that the Foreign Sovereign Immunity Act bars lawsuits on those grounds.
The company claims that they were contractors of the foreign sovereigns and these protections should therefore be afforded to them.
The judge, however, was not convinced.
Judge Hamilton said the company fails the content-based prong of the foreign official immunity test and are not entitled to any form of sovereign immunity.
NSO further claimed that the complaint should be dismissed for lack of personal jurisdiction, arguing several legal points regarding the exact language of the agreed upon terms of service for WhatsApp and the exact forum the alleged harm took place in.
That argument also failed to pass muster. Hamilton found that while some factors did tip slightly in favor of NSO, there was enough brought in WhatsApp’s complaint to show exactly who was targeted by the alleged conduct and that personal jurisdiction over the matter was well established.
NSO also attempted to argue that the case should be tossed for a simple failure to state a claim and that WhatsApp did not suffer an actual loss under the relevant law.
WhatsApp contends however, and the judge agreed, that one of their key losses in all of this was spending resources to identify and fix the problems caused by the malware in the first place.
WhatsApp also claims that had to spend time and money on upgrading the entire WhatsApp system in response to NSO’s alleged intrusions, spending resources that more than justify a legal claim for losses.
Judge Hamilton was not completely unsympathetic to NSO’s arguments, as she was persuaded by the software company on one key claim. WhatsApp brought trespass to chattels claims against NSO, which essentially says that NSO’s conduct damaged WhatsApp’s servers and property.
But the judge did not find this to be the case. Hamilton said that WhatsApp did not bring enough forward in their complaint to show that the alleged activity by NSO resulted in actual damage to WhatsApp’s property or caused any access damage to WhatsApp’s computers or servers.
As a result, she granted NSO’s request to have that claim dismissed – though WhatsApp has been given the opportunity to amend the complaint.
Attorneys for WhatsApp and NSO did not immediately respond to request for comment by press time Thursday evening.
Follow @@CarsonAndLloyd
Subscribe to Closing Arguments
Sign up for new weekly newsletter Closing Arguments to get the latest about ongoing trials, major litigation and hot cases and rulings in courthouses around the U.S. and the world.
