The U.S. Supreme Court on Monday let Meta Platforms Inc’s WhatsApp pursue a lawsuit accusing Israel’s NSO Group of exploiting a bug in its WhatsApp messaging app to install spy software allowing the surveillance of 1,400 people, including journalists, human rights activists and dissidents.
The justices turned away NSO’s appeal of a lower court’s decision that the lawsuit could move forward. NSO has argued that it is immune from being sued because it was acting as an agent for unidentified foreign governments when it installed the “Pegasus” spyware.
President Joe Biden’s administration had urged the justices to reject NSO’s appeal, noting that the U.S. State Department had never before recognized a private entity acting as an agent of a foreign state as being entitled to immunity.
WhatsApp in 2019 sued NSO seeking an injunction and damages, accusing it of accessing WhatsApp servers without permission six months earlier to install the Pegasus software on victims’ mobile devices.
NSO has argued that Pegasus helps law enforcement and intelligence agencies fight crime and protect national security and that its technology is intended to help catch terrorists, pedophiles and hardened criminals.
In court papers, NSO said that WhatsApp’s notification to users scuttled a foreign government’s investigation into an Islamic State militant who was using the app to plan an attack.
In one notorious case, NSO spyware was used – allegedly by the Saudi government – to target the inner circle of Washington Post journalist Jamal Khashoggi shortly before he was murdered at the Saudi consulate in Istanbul.
NSO appealed a trial judge’s 2020 refusal to award it “conduct-based immunity,” a common law doctrine protecting foreign officials acting in their official capacity.
Upholding that ruling in 2021, the San Francisco-based 9th U.S. Circuit Court of Appeals called it an “easy case” because NSO’s mere licensing of Pegasus and offering technical support did not shield it from liability under a federal law called the Foreign Sovereign Immunities Act, which took precedence over common law.
WhatsApp’s lawyers said that private entities like NSO are “categorically ineligible” for foreign sovereign immunity.
The Biden administration in a filing in November said the 9th Circuit reached the right result, even though the government was not ready to endorse the circuit court’s conclusion that FSIA entirely forecloses any form of immunity under common law.
According to court papers, the accounts of 1,400 WhatsApp users were accessed using the Pegasus tracking software, secretly using their smartphones as surveillance devices.
An investigation published in 2021 by 17 media organizations, led by the Paris-based non-profit journalism group Forbidden Stories, found that the spyware had been used in attempted and successful hacks of smartphones belonging to journalists, government officials and human rights activists on a global scale.
The U.S. government in November 2021 blacklisted NSO and Israel’s Candiru, accusing them of providing spyware to governments that used it to “maliciously target” journalists, activists and others.
NSO also is being sued by iPhone maker Apple Inc, accused of violating its user terms and services agreement.
Cyprus a hotspot for surveillance software
Sophie in’t Veld, the rapporteur of the first draft report for a European Parliament committee called PEGA, said during a visit to Cyprus in November that the country was an “attractive place” for selling surveillance technologies, adding that the “abuse of spyware in EU member states is a grave threat to democracy on the entire continent”.
The report cited Cypriot officials as saying ‘three to four’ companies produce spyware on the island.
“Its been confirmed that Cyprus is a greenhouse for companies which produce spyware … which has political backing,” said MP Aristos Damianou of the opposition AKEL party, which sought the parliamentary inquiry.
Cypriot President Nicos Anastasiades said any involvement of Cyprus in spyware surveillance in other countries was ‘imaginary’.
Members of his conservative Democratic Rally party have accused the opposition of attempting to sway public opinion ahead of a presidential election in early 2023.
One spyware developer, Israel’s NSO group, said in a June 2021 report that its products were “closely regulated by export control authorities in the countries from which we export our products: Israel, Bulgaria and Cyprus”.