WhatsApp Secures Appellate Win Against NSO Group in Phone Hacking Case

On Monday, the Ninth Circuit Court of Appeals panel sided with the messaging app and its parent company over whether the privately held Israeli corporation could invoke sovereign immunity as a basis for dismissal of the civil suit. The decision comes shortly after WhatsApp Inc. and Facebook Inc. (together, WhatsApp) notified the court of NSO Group Limited’s new status as an entity on a U.S. Department of Commerce restricted list.

WhatsApp filed suit against NSO and Q Cyber Technologies Limited after the defendants allegedly sent malware through WhatsApp to around 1,400 mobile phones with the intent to spy on users. The complaint alleged Computer Fraud and Abuse Act, California Comprehensive Computer Data Access and Fraud Act, breach of contract, and trespass to chattels causes of action.

In July 2020, the Northern District of California concluded that that common-law foreign official immunity does not protect NSO from suit in this case. The defendants then filed an interlocutory appeal.

This week’s 20-page opinion authored by Circuit Judge Danielle J. Forrest explained that “[t]he law governing this question has roots extending back to our earliest history as a nation, and it leads to a simple answer—no.” The court first discussed origins of the FSIA and recited its twofold purpose: to endorse and codify a definition of sovereign immunity and shift the primary responsibility of deciding foreign states’ immunity claims from the U.S. Department of State to the courts.

The opinion noted that neither the Supreme Court nor the Ninth Circuit has decided whether an entity that does not qualify as a “foreign state” can claim foreign sovereign immunity under the common law. The court rejected that possibility, holding that FSIA “occupies the field of foreign sovereign immunity as applied to entities and categorically forecloses extending immunity to any entity that falls outside the FSIA’s broad definition of ‘foreign state.’”

The panel also declined NSO’s argument claiming foreign sovereign immunity under common law immunity doctrines that apply to individual foreign officials. “There is no indication that the Supreme Court intended to extend foreign official immunity to entities,” the opinion said. The case will now proceed in Oakland, Calif. with Judge Phyllis J. Hamilton presiding.

WhatsApp and Facebook are represented by O’Melveny Myers LLP. NSO Group and Q Cyber Technologies are represented by King & Spalding LLP.