NSO falters in bid to shut down suit over hacking of WhatsApp
The Israeli technology firm, NSO Group, appears unlikely to prevail in its bid to shut down a lawsuit Facebook filed two years ago alleging that NSO marketed and maintained spyware used to compromise the accounts of journalists, human rights activists and dissidents around the world.
During arguments on Monday before the 9th U.S. Circuit Court of Appeals, all three judges on the panel seemed to be leaning against granting NSO’s request to force dismissal of the suit over the firm’s Pegasus snooping software.
Two judges on the panel suggested it would be premature or mistaken for the courts to dismiss the case based on the doctrine of sovereign immunity without the U.S. government declaring that such action was needed to protect foreign countries relying on NSO’s software.
“I find the argument that your clients are making in this case remarkable,” Judge Danielle Hunsaker said.
“Shouldn’t we have some sort of a signal from the State Department, from the executive branch, about — to guide those considerations instead of just as a court sort of leaping out into a whole brand new area that from that perspective nobody’s ever gone … without any lead from the executive branch?” asked Hunsaker, who was appointed by President Donald Trump.
Judge Mary Murguia, an appointee of President Barack Obama, pressed NSO’s lawyer Jeffrey Bucholtz about whether the firm ever asked the State Department to weigh in against the suit. He didn’t say definitively whether the company did so, declaring that there was no such evidence in the record and that he was unaware of the firm doing so “in any formal way.”
Pegasus spyware was first discovered on Apple iPhones in 2016, exploiting a vulnerability activated by clicking on a missed-call link from WhatsApp. That downloaded a virus that allowed a hacker to control the phone’s microphone and camera, collect passwords and rummage through email messages. Apple released an update in August 2016 aimed at closing the vulnerabilities. Similar issues were discovered with Android devices.
At Monday’s 45-minute argument session conducted via video, Bucholtz said that any grievance Facebook had really lay with the foreign governments who bought NSO’s software, and that Facebook was trying to make “an end run” around the immunity from litigation that those governments enjoy in U.S. courts. The attorney also said the kinds of official decisions at issue were ones that courts are typically loath to question.
“We’re talking about the use of technology to conduct counterterrorism investigations at the core of a state’s discretion,” Bucholtz said. “The injury that the plaintiffs claim is from the use of the software by the foreign states. … All that’s caused by the use, which NSO didn’t do.”
Facebook’s attorney, Michael Dreeben, said NSO’s position in the suit was undercut by the lack of any government speaking up for the firm. “We have no foreign state that’s come forward on NSO’s behalf. We don’t even know who those states are,” he said.
Dreeben acknowledged that private individuals have sometimes been granted protection under sovereign immunity principles, but that involved informal envoys doing unofficial diplomatic work. He said there were good reasons to treat businesses differently.
“It’s a private multinational company that’s selling spyware around the globe,” Dreeben said.
Bucholtz disagreed.
“There’s no principled reason to categorically exclude agents that are entities,” he said.
The third member of the panel, Judge Ryan Nelson, said that NSO might have “pretty good defenses” for some of the claims Facebook is making, but that it was hard to say before any fact-finding in the case that all of Facebook’s claims are meritless.
“We’re sort of being asked to put the cart before the horse,” said Nelson, a Trump appointee. “That seems like that should be developed after discovery and further litigation.”
However, Bucholtz said courts had recognized the importance of sovereign immunity being deployed to prevent discovery that can intrude on governments’ decisions related to national security. He also said that the harms Facebook faced were from actions taken by those governments, not by NSO’s research on vulnerabilities in WhatsApp.
“The conduct that injured them had to be done by the state actors,” Bucholtz said.
The significance of the case was underscored by the two legal heavyweights the companies leaned on for Monday’s arguments. Dreeben is a former deputy solicitor general who was a top adviser to special counsel Robert Mueller’s investigation of Russian interference in the 2016 presidential election. Bucholtz is the former acting head of the Justice Department’s Civil Division.
If NSO comes up on the losing end of the appeal, it could ask for review by a larger set of 9th Circuit judges or by the Supreme Court.
Even if the firm’s effort to head off the suit fails, it could continue to fight the case in the trial court, but will likely be forced to turn over documents about its development of Pegasus and make executives available for depositions.
