Ninth Circuit Tells NSO Group It Isn't A Government, Has No Immunity From WhatApp's Lawsuit

from the law-harder! dept

Long before its current run of Very Bad News, Israeli malware purveyor NSO Group was already controversial. Investigations had shown its exploits were being used to target journalists and activists and its customer list included governments known mostly for their human rights abuses.

Facebook and WhatsApp sued NSO in November 2019, alleging -- among other things -- that NSO had violated WhatsApp's terms of use by deploying malware via the chat service. The arguments made by Facebook/WhatsApp aren't the best and they could allow the CFAA to be abused even more by expanding the definition of "unauthorized access."

Then there's the question of standing, which NSO raised in one motion to dismiss. The alleged harms were to users of the service, not to the service itself. While suing on behalf of violated users is a nice gesture, it's pretty difficult to talk a court into granting your requests for injunctions or damages if you're not the target of the alleged abuse.

NSO also pointed out it didn't actually violate anyone's terms of service. Its customers did when they used WhatApp to deliver malware to targets. NSO said WhatsApp was welcome to sue any of its customers, but was unlikely to get anywhere with that either, given the immunity from lawsuits generally handed to foreign governments.

Then NSO made a ridiculous claim of its own: it said it was immune from lawsuits since it provided this malware to foreign governments. By extension, it argued, the same immunity protecting foreign sovereigns (i.e., its customers) should be extended to the private company that sold them phone exploits. That argument was rejected by the district court. And the Ninth Circuit Appeals Court has just affirmed [PDF] that rejection, which means NSO will have to continue to fight what is now one of several damaging fires.

The Appeals Court says no reasonable reading of the Foreign Sovereign Immunities Act (FSIA) supports NSO's argument in favor of it taking no responsibility for its actions or the actions of its customers.

Whether such entity can sidestep the FSIA hinges on whether the Act took the entire field of foreign sovereign immunity as applied to entities, or whether it took the field only as applied to foreign state entities, as NSO suggests. The answer lies in the question. The idea that foreign sovereign immunity could apply to non-state entities is contrary to the originating and foundational premise of this immunity doctrine.

[...]

Thus, we hold that an entity is entitled to foreign sovereign immunity, if at all, only under the FSIA. If an entity does not fall within the Act’s definition of “foreign state,” it cannot claim foreign sovereign immunity. Period.

NSO isn't a "foreign state." It is not operated by a foreign state. It simply sells products to foreign states, which legally makes it no different than the company that supplies toilet paper to the White House. Just because the product is used almost exclusively by governments, that fact does not make NSO a state actor or a foreign state proxy.

NSO does not contend that it meets the FSIA’s definition of “foreign state,” and, of course, it cannot. It is not itself a sovereign. 28 U.S.C. § 1603(a). It is not “an organ . . . or political subdivision” of a sovereign. Id. § 1603(b)(2). Nor is a foreign sovereign its majority owner. NSO is a private corporation that provides products and services to sovereigns—several of them. NSO claims that it should enjoy the immunity extended to sovereigns because it provides technology used for law-enforcement purposes and law enforcement is an inherently sovereign function. Whatever NSO’s government customers do with its technology and services does not render NSO an “agency or instrumentality of a foreign state,” as Congress has defined that term. Thus, NSO is not entitled to the protection of foreign sovereign immunity. And that is the end of our task.

This heads back to the district court -- the court where NSO first argued that the court had no jurisdiction to handle the lawsuit since it was pretty much just a foreign government d/b/a a private malware manufacturer. It will have to continue facing WhatsApp's lawsuit over its alleged terms of service violations. And the longer the suit runs, the greater the chance NSO might have to divulge some more details on its dirty work and its even dirtier customers.

Hide this

Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.

Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.

While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.

–The Techdirt Team

Filed Under: 9th circuit, immunity, malware, spyware
Companies: facebook, nso group, whatsapp


Reader Comments

Subscribe: RSS

View by: Time | Thread


  1. icon
    That One Guy (profile), 16 Nov 2021 @ 1:18pm

    Trying to have it both ways

    Gotta love their gross dishonesty here, on one hand they want to claim that the blame is all on their customers and they have no hand it how those people use their products while at the same time they argue that since those customers are governments then NSO should be considered tied so closely to them that they also enjoy governmental immunity.

    Either you're involved with your product and customers or you're not NSO, pick one.

    link to this | view in thread ]

  2. identicon
    Pixelation, 16 Nov 2021 @ 6:27pm

    Sure would be awful if these assholes went under...

    link to this | view in thread ]

  3. icon
    Bergman (profile), 16 Nov 2021 @ 10:37pm

    I don’t get why companies want to be wholly sovereign

    After all, non-sovereign entities can’t have wars declared upon them.

    If two companies are both wholly sovereign, the nations hosting them would have no say in the matter if one sent in a drone strike loaded with a few hellfire missiles on the other. Some companies might be able to afford having their own militaries, but for most it would be a ruinous expense.

    link to this | view in thread ]

  4. icon
    Vikarti Anatra (profile), 17 Nov 2021 @ 4:20am

    I don't undertstood why they were sued under CFAA in first place.
    They don't USE their tools after all.
    Only logical way this can be legal is suing them for illegally distributing something which should require export licenses. But hack tools doesn't require licenses. Yet.

    link to this | view in thread ]

  5. icon
    Ed (profile), 17 Nov 2021 @ 7:39am

    Could it be?

    Perhaps NSO doesn't want it finally revealed plainly that they really ARE a part of the Israeli government, operating out of the Mossad?

    link to this | view in thread ]

  6. identicon
    Anonymous Coward, 17 Nov 2021 @ 4:55pm

    Re:

    If they DO go under, I fully expect a new set of shell companies to register in Israel, and get more than enough startup funding. The executives for these companies will look VERY familiar, and all have ties to Unit 8200.

    link to this | view in thread ]

  7. identicon
    Anonymous Coward, 17 Nov 2021 @ 4:57pm

    Re:

    The way they sell their product, it only functions in conjunction with their services. If they shut down, all their customers' hack tools would stop working. They run the back end.

    link to this | view in thread ]

  8. icon
    Lostinlodos (profile), 20 Nov 2021 @ 11:06am

    Question on location

    Do they actually have any physical presence in the United States?
    If not it would appear to me to be yet another attempt to extend US law to foreign operators in other jurisdictions.

    Thus Facebook should be filing in Israeli from their office there.

    link to this | view in thread ]


Follow Techdirt
Essential Reading
Techdirt Deals
Report this ad  |  Hide Techdirt ads
Techdirt Insider Discord

The latest chatter on the Techdirt Insider Discord channel...

Loading...
Recent Stories

This site, like most other sites on the web, uses cookies. For more information, see our privacy policy. Got it
Close

Email This

This feature is only available to registered users. Register or sign in to use it.