Facebook Can Pursue Malware Lawsuit Against Pegasus Maker NSO Group: US Appeals Court

A US appeals court said Facebook can pursue a lawsuit accusing Israel's NSO Group of exploiting a bug in its WhatsApp messaging app to install malware allowing the surveillance of 1,400 people, including journalists, human rights activists and dissidents.

In a 3-0 decision on Monday, the 9th US Circuit Court of Appeals in San Francisco rejected privately owned NSO's claim it was immune from being sued because it had acted as a foreign government agent.

Facebook, now known as Meta, sued NSO for an injunction and damages in October 2019, accusing it of accessing WhatsApp servers without permission six months earlier to install its Pegasus malware on victims' mobile devices.

NSO has argued that Pegasus helps law enforcement and intelligence agencies fight crime and protect national security.

It was appealing a trial judge's July 2020 refusal to award it "conduct-based immunity," a common law doctrine protecting foreign officials acting in their official capacity.

Upholding that ruling, Circuit Judge Danielle Forrest said it was an "easy case" because NSO's mere licensing of Pegasus and offering technical support did not shield it from liability under federal law, which took precedence over common law.

"Whatever NSO's government customers do with its technology and services does not render NSO an 'agency or instrumentality of a foreign state,'" Forrest wrote. "Thus, NSO is not entitled to the protection of foreign sovereign immunity."

The case will return to US District Judge Phyllis Hamilton in Oakland, California.

Asked for comment on the decision, NSO said in an email that its technology helps defend the public against serious crime and terrorism, and that it "stands undeterred in its mission."

WhatsApp spokesman Joshua Breckman in an email called the decision "an important step in holding NSO accountable for its attacks against journalists, human rights defenders and government leaders."

Facebook's case drew support from Microsoft, Alphabet's Google, and Cisco, which in a court filing called surveillance technology such as Pegasus "powerful, and dangerous."

On November 3, the US government blacklisted NSO and Israel's Candiru for allegedly providing spyware to governments that used it to "maliciously target" journalists, activists and others.

The case is WhatsApp et al v NSO Group Technologies et al, 9th US Circuit Court of Appeals, No. 20-16408.

© Thomson Reuters 2021