Facebook can proceed with claims that the Israeli company NSO Group hacked WhatsApp, a federal appellate court ruled Monday.
In a 20-page opinion a three-judge panel of the 9th Circuit Court of Appeals rejected NSO Group's claims that it couldn't be sued in the U.S. because it was acting at the direction of its foreign government customers.
The ruling stemmed from reports that NSO installed the “Pegasus” malware on the phones of approximately 1,400 WhatsApp users, including human rights leaders, journalists, government officials, and diplomats.
Facebook sued NSO in October of 2019, claiming that the company violated federal and California anti-hacking laws, and violated WhatsApp's terms of service.
Facebook alleged in its complaint that the malware accessed WhatsApp messages after they were decrypted by the recipients.
NSO, which denied wrongdoing, argued it was protected from suit by the Foreign Sovereign Immunity Act. That law generally immunizes foreign governments from lawsuits in the U.S., except for some lawsuits related to terrorism.
U.S. District Court Judge Phyllis Hamilton ruled against NSO, allowing Facebook's suit to move forward. NSO then appealed to the 9th Circuit Court of Appeals.
On Monday, that court also sided against NSO, ruling that the Foreign Sovereign Immunity Act protects entities that are considered “foreign states,” but not private companies that license technology to the government.
“Whatever NSO’s government customers do with its technology and services does not render NSO an 'agency or instrumentality of a foreign state,' as Congress has defined that term,” Circuit Judge Danielle Forrest wrote in an opinion joined by Judges Mary Murguia and Ryan Nelson. “Thus, NSO is not entitled to the protection of foreign sovereign immunity.”