A U.S. appeals court said Monday that Facebook can pursue a lawsuit accusing the Israeli spyware firm NSO Group of exploiting a bug in its WhatsApp messaging app to install malware, allowing the surveillance of 1,400 people – including journalists, human rights activists and dissidents.
In a 3-0 decision on Monday, the 9th U.S. Circuit Court of Appeals rejected NSO's claim that it was immune from being sued because it had acted as a foreign government agent.
Facebook, now known as Meta Platforms Inc., sued NSO for an injunction and damages in October 2019, accusing it of accessing WhatsApp servers without permission six months earlier in order to install its Pegasus malware on victims' mobile devices.
NSO has argued that Pegasus helps law enforcement and intelligence agencies fight crime and protect national security.
It was appealing a trial judge's July 2020 refusal to award it "conduct-based immunity," a common law doctrine protecting foreign officials acting in their official capacity.
Upholding that ruling, Circuit Judge Danielle Forrest said it was an "easy case" because NSO's mere licensing of Pegasus and offering technical support did not shield it from liability under federal law, which took precedence over common law.
"Whatever NSO's government customers do with its technology and services does not render NSO an 'agency or instrumentality of a foreign state,'" Forrest wrote. "Thus, NSO is not entitled to the protection of foreign sovereign immunity."
- NSO Spyware Used Against Palestinian Activists From NGOs Israel Outlawed, Report Say
- Founder of Notorious Israeli Spyware Firm NSO Steps Down as CEO
- NSO Blacklisting: Global Reckoning Begins for Spyware's Tools of Repression
The case will return to U.S. District Judge Phyllis Hamilton in Oakland, California.
Asked for comment on the decision, NSO said in an email that its technology helps defend the public against serious crime and terrorism, and that it "stands undeterred in its mission."
WhatsApp spokesman Joshua Breckman in an email called the decision "an important step in holding NSO accountable for its attacks against journalists, human rights defenders and government leaders."
Facebook's case drew support from Microsoft Corp, Google and Cisco, which in a court filing called surveillance technology such as Pegasus "powerful, and dangerous."
This comes only a few days after the U.S. Commerce Department added the Israeli spyware firms NSO group and Candiru, alongside companies from Russia and Singapore, to its Entity List for activities contrary to the United States' national security or foreign policy interests, a statement by the department said on Wednesday.
This morning another report emerged that NSO spyware has been used to monitor the cellphones of Palestinian activists and human rights workers. According to their report, three of the people whose phones were hacked with NSO's Pegasus software are members of social welfare organizations that were blacklisted for alleged terrorist ties by Defense Minister Benny Gantz last month.