NSO Group Asserts Derivate Immunity in WhatsApp Hacking Case

Israel’s NSO Group Technologies Ltd. moved to dismiss the ongoing cyber-espionage lawsuit brought against it by WhatsApp and Facebook. The motion was filed on April 2, exactly a month after NSO and its parent company and codefendant Q Cyber Technologies defaulted. The case is being held in the California Northern District Court before Judge Phyllis J. Hamilton.

Mercury Public Affairs, a firm representing NSO, listed several key arguments against the suit. “The conduct alleged by WhatsApp was not and could not have been conducted by NSO Group,” wrote Mercury in a document obtained by Law Street Media. “NSO Group simply licenses its Pegasus software to sovereign governments and their agencies for the purpose of preventing terrorism and other crimes.” They reiterated NSO’s claim of innocence, saying, “If anyone installed Pegasus on any alleged ‘Target Devices’ it was not NSO Group. It would have been an agency of a sovereign government.”

NSO’s Motion to Dismiss relies on similar arguments.  After purporting that NSO’s software is only used by foreign governments to prevent terrorism, they alleged that WhatsApp was used in the commission of terrorism.  They contested the court’s subject matter and personal jurisdiction, arguing that NSO is protected by derivative foreign sovereign immunity, relying on a Fourth Circuit decision which stated that “ private actors are derivatively immune for actions that they take at the direction of foreign sovereigns.” They also argued that their activities do not meet the standard to grant the court personal jurisdiction over them. 

In an attached exhibit, a statement from NSO Group CEO Shalev Hulio alleged that Facebook had attempted to use NSO’s Pegasus surveillance software to monitor users of a Facebook VPN product that was under development.  In a statement, Facebook countered that “NSO is trying to distract from the facts Facebook and WhatsApp filed in court over six months ago. Their attempt to avoid responsibility includes inaccurate representations about both their spyware and a discussion with people who work at Facebook…We look forward to proving our case against NSO in court and seeking accountability for their actions.”

In October 2019, Facebook and WhatsApp accused NSO Group of using its Pegasus spyware to exploit WhatsApp’s code and send malicious software to mobile devices, giving NSO backdoor access to thousands of cell phones, including those of humans rights activists and journalists. In its motion for dismissal, NSO Group claims that it takes extra steps to ensure that the Pegasus technology “is used responsibly by authorized public safety authorities.” NSO allegedly requires government agencies to agree to use Pegasus “only for the prevention or investigation of crimes and terrorism and ensure that the [technology] will not be used for human rights violations.”

A motion hearing for this case is scheduled for May 13 in Oakland.