Ninth Circuit Tells NSO Group It Isn't A Government, Has No Immunity From WhatApp's Lawsuit

from the law-harder! dept

Long before its current run of Very Bad News, Israeli malware purveyor NSO Group was already controversial. Investigations had shown its exploits were being used to target journalists and activists and its customer list included governments known mostly for their human rights abuses.

Facebook and WhatsApp sued NSO in November 2019, alleging — among other things — that NSO had violated WhatsApp’s terms of use by deploying malware via the chat service. The arguments made by Facebook/WhatsApp aren’t the best and they could allow the CFAA to be abused even more by expanding the definition of “unauthorized access.”

Then there’s the question of standing, which NSO raised in one motion to dismiss. The alleged harms were to users of the service, not to the service itself. While suing on behalf of violated users is a nice gesture, it’s pretty difficult to talk a court into granting your requests for injunctions or damages if you’re not the target of the alleged abuse.

NSO also pointed out it didn’t actually violate anyone’s terms of service. Its customers did when they used WhatApp to deliver malware to targets. NSO said WhatsApp was welcome to sue any of its customers, but was unlikely to get anywhere with that either, given the immunity from lawsuits generally handed to foreign governments.

Then NSO made a ridiculous claim of its own: it said it was immune from lawsuits since it provided this malware to foreign governments. By extension, it argued, the same immunity protecting foreign sovereigns (i.e., its customers) should be extended to the private company that sold them phone exploits. That argument was rejected by the district court. And the Ninth Circuit Appeals Court has just affirmed [PDF] that rejection, which means NSO will have to continue to fight what is now one of several damaging fires.

The Appeals Court says no reasonable reading of the Foreign Sovereign Immunities Act (FSIA) supports NSO’s argument in favor of it taking no responsibility for its actions or the actions of its customers.

Whether such entity can sidestep the FSIA hinges on whether the Act took the entire field of foreign sovereign immunity as applied to entities, or whether it took the field only as applied to foreign state entities, as NSO suggests. The answer lies in the question. The idea that foreign sovereign immunity could apply to non-state entities is contrary to the originating and foundational premise of this immunity doctrine.


Thus, we hold that an entity is entitled to foreign sovereign immunity, if at all, only under the FSIA. If an entity does not fall within the Act’s definition of “foreign state,” it cannot claim foreign sovereign immunity. Period.

NSO isn’t a “foreign state.” It is not operated by a foreign state. It simply sells products to foreign states, which legally makes it no different than the company that supplies toilet paper to the White House. Just because the product is used almost exclusively by governments, that fact does not make NSO a state actor or a foreign state proxy.

NSO does not contend that it meets the FSIA’s definition of “foreign state,” and, of course, it cannot. It is not itself a sovereign. 28 U.S.C. § 1603(a). It is not “an organ . . . or political subdivision” of a sovereign. Id. § 1603(b)(2). Nor is a foreign sovereign its majority owner. NSO is a private corporation that provides products and services to sovereigns—several of them. NSO claims that it should enjoy the immunity extended to sovereigns because it provides technology used for law-enforcement purposes and law enforcement is an inherently sovereign function. Whatever NSO’s government customers do with its technology and services does not render NSO an “agency or instrumentality of a foreign state,” as Congress has defined that term. Thus, NSO is not entitled to the protection of foreign sovereign immunity. And that is the end of our task.

This heads back to the district court — the court where NSO first argued that the court had no jurisdiction to handle the lawsuit since it was pretty much just a foreign government d/b/a a private malware manufacturer. It will have to continue facing WhatsApp’s lawsuit over its alleged terms of service violations. And the longer the suit runs, the greater the chance NSO might have to divulge some more details on its dirty work and its even dirtier customers.

Filed Under: , , ,
Companies: facebook, nso group, whatsapp

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Ninth Circuit Tells NSO Group It Isn't A Government, Has No Immunity From WhatApp's Lawsuit”

Subscribe: RSS Leave a comment
That One Guy (profile) says:

Trying to have it both ways

Gotta love their gross dishonesty here, on one hand they want to claim that the blame is all on their customers and they have no hand it how those people use their products while at the same time they argue that since those customers are governments then NSO should be considered tied so closely to them that they also enjoy governmental immunity.

Either you’re involved with your product and customers or you’re not NSO, pick one.

Bergman (profile) says:

I don’t get why companies want to be wholly sovereign

After all, non-sovereign entities can’t have wars declared upon them.

If two companies are both wholly sovereign, the nations hosting them would have no say in the matter if one sent in a drone strike loaded with a few hellfire missiles on the other. Some companies might be able to afford having their own militaries, but for most it would be a ruinous expense.

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...