US Supreme Court allows Meta, WhatsApp to sue NSO for installing Pegasus spyware on devices

The Supreme Court of the United States has decided to allow Meta and WhatsApp to pursue a lawsuit against Israel’s NSO Group for exploiting a bug in WhatsApp and installing spyware on the devices of over 1400 people across the world. The Israel-based security firm has also been accused of facilitating the illegaly spying of journalists, human rights activists, politicians and political dissidents across the world.

The WhatsApp-NSA lawsuit explainedWhatsApp in 2019 sued NSO seeking an injunction and damages, accusing it of accessing WhatsApp servers without permission six months earlier to install the Pegasus software on victims’ mobile devices.

NSO has argued that Pegasus helps law enforcement and intelligence agencies fight crime and protect national security and that its technology is intended to help catch terrorists, paedophiles and hardened criminals.

However, an investigation published in 2021 by 17 media organizations, led by the Paris-based non-profit journalism group Forbidden Stories, found that NSA’s spyware had been used in attempted and successful hacks of smartphones of journalists, government officials and human rights activists on a global scale, rather than targeting criminals. Certain governments were using the spyware to snoop on journalists, human rights activists, opposing politicians or political opponents as well as dissidents.

In one notorious case, NSO spyware was used – allegedly by the Saudi government – to target the inner circle of Washington Post journalist Jamal Khashoggi shortly before he was murdered at the Saudi consulate in Istanbul.

NSO’s seeking immunityEver since Meta announced that they will be going after NSO to the extent that the law permits, the Israel-based cybersecurity firm has argued that it is immune from being sued because it was acting as an agent for unidentified foreign governments when it installed the “Pegasus” spyware.

Apart from continued arguments claiming that Pegasus helps law enforcement and intelligence agencies fight crime and protect national security, NSO is also arguing that they are protected by “conduct-based immunity,” a common law doctrine protecting foreign officials acting in their official capacity.

“NSO’s spyware has enabled cyberattacks targeting human rights activists, journalists and government officials,” Meta said. “We firmly believe that their operations violate US law and they must be held to account for their unlawful operations.”

Meta, the parent company of both WhatsApp and Facebook, in a statement, welcomed the court’s move to turn away NSO’s “baseless” appeal.

The Biden administration jumps inThe US government in November 2021 blacklisted NSO and Israel’s Candiru, accusing them of providing spyware to governments that used it to “maliciously target” journalists, activists and others.

President Joe Biden’s administration had urged the justices to reject NSO’s appeal, noting that the US State Department had never before recognized a private entity acting as an agent of a foreign state as being entitled to immunity.

Soon after this, the 9th US Circuit Court of Appeals rejected NSO’s appeal. The Biden administration in a filing in November said the 9th Circuit reached the right result, even though the government was not ready to endorse the circuit court’s conclusion that FSIA entirely forecloses any form of immunity under common law.

What’s next?In 2020, a trial Judge refused to award NSO the “conduct-based immunity” it was looking for. NSO appealed the ruling, and in 2021, the San Francisco-based 9th US Circuit Court of Appeals upheld the ruling, calling it an “easy case” because NSO’s mere licensing of Pegasus and offering technical support did not shield it from liability under a federal law called the Foreign Sovereign Immunities Act, which took precedence over common law.

Now that the Supreme Court has also declined to give NSO the “conduct-based immunity” it was seeking, and instead has allowed Meta and WhatsApp to sue NSO, we can expect the trial to finally get going.

Interestingly, NSO also is being sued by iPhone maker Apple, who have accused of NSO of violating its user terms and services agreement. It will be interesting to see if Apple and Twitter join forces and pursue a common trial, or if both of these companies would like to keep their cases separate.