Sunday, March 26, 2023 | Back issues
Courthouse News Service Courthouse News Service

Israeli spyware firm hits high court roadblock in case brought by WhatsApp

The Supreme Court rejected a petition from the maker of a hacking tool for government clients who want to spy on criminals, leaving in place a ruling that the company is not immune from suit.

WASHINGTON (CN) — On the question of whether the Foreign Sovereign Immunities Act protects private companies, the Supreme Court made its opinion clear Monday morning by refusing to hear an Israeli spyware company's bid to dismiss a lawsuit brought by WhatsApp. 

“This petition offers the court an excellent vehicle to decide an important question that has divided the federal courts of appeals: whether private entities may ever seek common-law sovereign immunity in U.S. courts,” NSO Group's petition to the high court states. 

WhatsApp, an encrypted communication app owned by Facebook's parent company Meta Platforms that boasts over 2 billion users around the world, brought the case over NSO’s Pegasus cyber surveillance tool after the privacy of 1,400 activists, journalists and diplomats was reportedly compromised via WhatsApp servers by use of the Pegasus spyware.  

NSO – which stands for the first names of its founders, Niv Karmi, Shalev Hulio and Omri Lavie – claims it sells its spyware to government clients to help them track and spy on criminals and terrorists. 

After the Ninth Circuit sided with WhatsApp in 2021, NSO sought to have the U.S. Supreme Court hear its arguments that it is immune from being sued because it was acting as an agent of its foreign sovereign customers when it installed the spyware.

The justices rejected the company's appeal Monday morning without comment, leaving in place the appeals court's finding that NSO is not shielded from liability by the Foreign Sovereign Immunities Act.

Originally designed as a tool for government law enforcement and intelligence agencies, Pegasus spyware allows the user to observe a cellphone’s location data and gain control over the device's microphone and camera. NSO describes itself as a designer of highly regulated technology for governments to investigate terrorism, child exploitation and other serious crimes. To embed the spyware into someone’s phone, Pegasus clients send a coded text message via WhatsApp.

The list of Pegasus clients includes India, Morocco, Saudi Arabia and the United Arab Emirates.

NSO argued that it acted on a country’s behalf within its official capacity and thus is entitled to “conduct-based immunity." The Ninth Circuit disagreed, ruling the Foreign Sovereign Immunities Act does not apply to private entities. 

“Neither the Supreme Court nor this court has answered whether an entity that does not qualify as a 'foreign state' can claim foreign sovereign immunity under the common law,” U.S. Circuit Judge Danielle J. Forrest, a Donald Trump appointee, wrote in her November 2021 opinion. “It is clear under the existing precedent that such an entity cannot seek immunity under the FSIA.” 

Forrest said whatever NSO's customers do with Pegasus " does not render NSO an ‘agency or instrumentality of a foreign state,’ as Congress has defined that term."

“Thus, NSO is not entitled to the protection of foreign sovereign immunity. And that is the end of our task," she wrote.

The federal government has since said the “United States is not prepared at this time to endorse that categorical holding.”

WhatsApp argues the reason for the government not backing the Ninth Circuit ruling is not because the feds disagree with the decision, but rather because this case is unique. NSO sees the government’s unwillingness to endorse the holding as a sign that it does not agree with the appeals court.

In its petition to the Supreme Court, NSO cited Butters v. Vance International, in which the Fourth Circuit held that a private security firm was immune for employment decisions it made while providing security services to Saudi Arabia. The ruling was partially based on a Fifth Circuit decision that found private agents of a Saudi prince were immune for actions they took at the prince’s direction.

In Butters, Richmond, Virginia-based appeals court applied a test for conduct-based immunity, holding that private agents are immune “when following the commands of a foreign sovereign employer.”

The Ninth Circuit’s decision that the Foreign Sovereign Immunities Act categorically bars private entities from seeking sovereign immunity conflicts with Butters, according to NSO. The company argued the San Francisco-based appeals court's ruling would negatively affect foreign relations. 

“Numerous countries, including the United States, frequently rely on private contractors to perform or assist with core governmental activities," the petition states. “If such contractors can never seek immunity in U.S. courts, then the floodgates will open to foreign suits against U.S. contractors designed to interfere with the United States’ most sensitive intelligence and military operations.”

WhatsApp responded to the petition with a brief that said NSO has refused to list the nation it was acting as an agent for and that no nation has stepped up to say NSO was acting as its agent. 

Read the Top 8

Sign up for the Top 8, a roundup of the day's top stories delivered directly to your inbox Monday through Friday.