The Supreme Court cleared the way Monday for a lawsuit in Bay Area federal court accusing the Israeli spyware company NSO Group of illicitly providing software to foreign governments to gather information on dissidents and journalists.
The suit was filed in 2019 by the WhatsApp messaging system and its parent company, Facebook, which said governments had used WhatsApp to install NSO malware on about 1,400 mobile units in different nations. NSO’s Pegasus software extracts information from virtually any mobile device, allowing the user to take screenshots and intercept messages from others. In 2021, multiple media organizations reported that foreign governments had used Pegasus to track messages of more than 50,000 people in the U.S. and other nations since 2016, including political activists and more than 180 journalists, as well as religious leaders and government officials.
NSO argued that the suit should be dismissed because its relationship to Israel’s government entitled the company to “sovereign immunity,” which shields foreign governments and companies they own from most types of civil suits in U.S. courts. U.S. District Judge Phyllis Hamilton of Oakland disagreed in 2020, and her ruling was upheld by the Ninth U.S. Circuit Court of Appeals in San Francisco.
“Foreign sovereign immunity does not protect domestic private companies,” Judge Danielle Forrest said in a 3-0 ruling in November 2021. “We give foreign sovereign immunity to other nations… so they will do the same for us.”
Forrest said a 1976 federal law, the Foreign Sovereign Immunities Act, shields foreign governments, their official agencies and individual government agents from lawsuits, but not companies like NSO. Israel licenses NSO to export the company’s products, though Israel’s government has denied that it approved any of the company’s conduct or is responsible for its actions.
In an appeal to the Supreme Court, NSO’s lawyer argued that the company, because of its role in aiding other governments, should be entitled to legal protection.
“Pegasus is marketed only to and used only by governments and government agencies,” which use it “to investigate terrorism, child exploitation, and other serious crimes,” attorney Jeffrey Bucholtz said in a court filing. “Numerous countries, including the United States, frequently rely on private contractors to perform or assist with core governmental activities. If such contractors can never seek immunity in U.S. courts, then the floodgates will open to foreign suits against U.S. contractors designed to interfere with the United States’ most sensitive intelligence and military operations.”
He asked the court to seek the Biden administration’s view of the case. But the administration, in a Justice Department filing last November, said the suit should be allowed to proceed.
“There is no established practice — or even a single prior instance — of the State Department suggesting an immunity for a private entity acting as an agent of a foreign state,” Justice Department lawyers told the court. They noted that the Biden administration, in November 2021, had added NSO to a list of organizations that are believed to have acted against U.S. interests, based on information that it “developed and supplied spyware to foreign governments that used this tool to maliciously target government officials, journalists, business people, activists, academics, and embassy workers.” The administration then barred U.S. companies from selling technology to NSO.
The court denied review of NSO’s appeal without comment Monday.
“We’re grateful to see the Supreme Court rejected NSO’s baseless petition,” said Carl Woog, a spokesperson for WhatsApp. “NSO’s spyware has enabled cyberattacks targeting human rights activists, journalists and government officials. We firmly believe that their operations violate U.S. law and they must be held to account for their unlawful operations.”
Lawyers for the company did not respond to a request for comment.
The case is NSO Group v. WhatsApp, 21-1338.
