The US Supreme Court has allowed Meta Platforms Inc.’s WhatsApp to file a lawsuit accusing the Israeli NSO Group of exploiting a flaw in its WhatsApp messaging app to install spyware designed to monitor people 1,400 people, including journalists, human rights activists and dissidents.
The judges denied NSO’s appeal over a lower court’s decision that the lawsuit could proceed. NSO has argued that it is immune from a lawsuit because it was acting as an agent for unidentified foreign governments when it installed the Pegasus spyware.
The Joe Biden administration had asked judges to dismiss NSO’s appeal, noting that the US State Department had never before granted a right to immunity to a private entity acting as a representative of a foreign state.
Meta, the parent company of WhatsApp and Facebook, welcomed the court’s move to dismiss NSO’s “unfounded” appeal in a statement.
“NSO’s spyware has enabled cyberattacks on human rights defenders, journalists and government officials,” Meta said. “We firmly believe their operations violate US law and they must be held accountable for their unlawful operations.”
A lawyer for NSO did not immediately respond to a request for comment.
WhatsApp sued NSO in 2019 for injunctive relief and damages, accusing it of accessing WhatsApp servers without permission six months earlier to install Pegasus software on victims’ mobile devices.
NSO has argued that Pegasus helps law enforcement and intelligence agencies fight crime and protect national security, and that its technology is designed to catch terrorists, child molesters and criminals.
In court filings, NSO said WhatsApp’s notification to users derailed a foreign government’s investigation into an Islamic State militant that was using the app to plan an attack.
In one notorious case, NSO spyware was used – allegedly by the Saudi government – to target the inner circle of Washington Post journalist Jamal Khashoggi just before he was assassinated at the Saudi consulate in Istanbul.
NSO appealed a trial judge’s 2020 refusal to grant him “conduct-based immunity,” a common-law doctrine that protects foreign officials acting in their official capacity.
The San Francisco-based 9th U.S. Circuit Court of Appeals upheld that ruling in 2021, calling it a “simple case” because NSO’s mere licensing of Pegasus and offering technical support does not exempt it from liability under a federal law called Foreign Sovereign Immunities Act (FSIA), which took precedence over common law.
WhatsApp’s lawyers said private entities like NSO “are categorically ineligible” for foreign sovereign immunity.
Alex Hern’s weekly dive into how technology is shaping our lives
Data protection: Newsletters may contain information about charities, online advertisements and content sponsored by third parties. You can find more information in our data protection declaration. We use Google reCaptcha to protect our website and the Google Privacy Policy and Terms of Service apply.
The Biden administration said in a filing in November that the 9th Circuit got the correct finding, though the government was unwilling to support the circuit court’s conclusion that the FSIA completely barred any form of common-law immunity.
According to court documents, Pegasus tracking software was used to access the accounts of 1,400 WhatsApp users who secretly used their smartphones as surveillance devices.
An investigation released in 2021 by 17 media organizations led by the Paris-based non-profit journalist group Forbidden Stories found that the spyware was involved in attempted and successful hacks of smartphones by journalists, government officials and human rights activists on a global scale.
The US government blacklisted NSO and Israel’s Candiru in November 2021, accusing them of supplying spyware to governments that used it to “maliciously target” journalists, activists and others.
NSO is also being sued by iPhone maker Apple, which is accused of violating its terms of service and service agreement.