WhatsApp messaging app is shown on an iPhone.
The U.S. Supreme Court denied certiorari Monday in NSO Group Technologies Limited v. WhatsApp Inc., a case challenging an Israeli tech company’s use of WhatsApp technology to deploy its Pegasus surveillance spyware. The ruling means the foreign company can no longer claim immunity in WhatsApp’s case, and also allows a group of investigative journalists to pursue a related case against the spyware company.
The WhatsApp lawsuit, which was filed in 2019, alleges that Israeli tech company NSO Group and its parent company Q Cyber Technologies Limited infected 1,400 mobile phones with Pegasus technology by using WhatsApp accounts to deliver “malicious code” without authorization. WhatsApp claimed that NSO’s actions violated the Computer Fraud and Abuse Act , California’s Comprehensive Computer Data Access and Fraud Act, and constituted breach of contract and trespass. The lawsuit asked for unspecified damages.
NSO argued that it is immune from the lawsuit under the Foreign Services Immunity Act (FSIA), because NSO is an agent of a foreign government. FSIA is a 1976 federal law that codifies the concept of foreign sovereign immunity, which had been at work for many years prior to the enacting of the statue. Typically, under FSIA, U.S. federal courts are not permitted to hear any lawsuits against foreign nations.
A panel of the U.S. Court of Appeals for the Ninth Circuit disagreed with NSO’s argument and ruled that the Israeli company was not immune, because it is not a “foreign state” as defined by the FSIA. On appeal, the Ninth Circuit declined to conduct an en banc rehearing – NSO then asked the Supreme Court to step in and shield it from answering WhatsApp’s lawsuit.
The high court’s denial of certiorari Monday means that the lower ruling on immunity will remain in place.
The related case, Dada v. NSO Group, was filed by the Knight First Amendment Institute at Columbia University on behalf of a group of journalists (some who are U.S. citizens and others who currently live in the U.S.) who contribute to and publish El Faro, a digital newspaper based in El Salvador that they say, “has become one of the foremost sources of independent news in Central America” and “a paragon of investigative journalism” with a substantial readership around the world and particularly in the United States.
The pleadings in the Dada case describe just how Pegasus is used:
“Defendants and their clients can install Pegasus on a target’s smartphone remotely and surreptitiously, without any action by the target. Once installed, Pegasus gives its operators essentially full control of the device. They can covertly extract contact lists, calendar entries, text and instant messages, notes, emails, search histories, and GPS locations. They can turn on the smartphone’s microphone to record surrounding sounds. They can activate the smartphone’s camera to take photographs. They can also copy authentication keys to gain access to cloud-based accounts.”
The complaint asserted that the defendant companies allowed authoritarian governments to “surveil journalists, human rights advocates, and political opponents, often in the service of broader campaigns of political intimidation and persecution,” and said attacks intensified whenever El Faro published major stories.
Law&Crime spoke with WhatsApp spokesperson Carl Woog Monday via email. Woog reacted to the Court’s denial with the following statement:
We’re grateful to see the Supreme Court rejected NSO’s baseless petition. NSO’s spyware has enabled cyberattacks targeting human rights activists, journalists, and government officials. We firmly believe that their operations violate U.S. law and they must be held to account for their unlawful operations.
“We’re pleased that the Supreme Court rejected NSO Group’s petition,” Knight Institute Senior staff attorney Carrie DeCell said in a statement Monday. “Today’s decision clears the path for lawsuits brought by the tech companies, as well as for suits brought by journalists and human rights advocates who have been victims of spyware attacks.” DeCell called the use of spyware to intimidate journalists “one of the most urgent threats to press freedom and democracy today.”
Counsel for NSO Group did not immediately respond to Law&Crime’s request for comment.
Editor’s Note: This piece was updated from its original version to include comment from WhatsApp.
Follow Law&Crime:
