WhatsApp Inc. v. NSO Group Technologies Ltd., 17 F.4th 930 (9th Cir. 2021) was decided by the United States Court of Appeals for the Ninth Circuit on November 8, 2021 (No. 20-16408). The Ninth Circuit affirmed the denial of NSO's motion to dismiss. Because the FSIA supplies the comprehensive framework for any entity's claim of foreign sovereign immunity, and NSO falls outside the Act's definition of a foreign state, NSO is categorically ineligible for that immunity — whatever its government customers do with Pegasus. The court held that no separate common-law inquiry was needed, and the case proceeded on the CFAA and state-law claims.
The question before the court
May a privately owned foreign corporation that builds and licenses intrusion software to foreign governments invoke common-law conduct-based foreign sovereign immunity for operations its state customers direct, when it does not meet the Foreign Sovereign Immunities Act's definition of a "foreign state"?
The governing rule
The FSIA provides that "a foreign state shall be immune from the jurisdiction of the courts of the United States and of the States" except as the Act provides, 28 U.S.C. § 1604, and is "the sole basis for obtaining jurisdiction" over a party that qualifies as a foreign state. Samantar v. Yousuf, 560 U.S. 305, 314 (2010). "Foreign state" reaches a body politic plus its political subdivisions, agencies, and instrumentalities, § 1603(a), and "agency or instrumentality" covers a separate legal person that is an organ of a foreign state or political subdivision or whose majority ownership interest is held by one, § 1603(b). Samantar held that the definition does not include individual foreign officials, whose immunity remains a matter of common law, but reaffirmed that the FSIA governs the immunity of foreign state entities. The Act is "a comprehensive framework for resolving any claim of sovereign immunity." Republic of Austria v. Altmann, 541 U.S. 677, 699 (2004). Where a federal statute answers the federal question, federal common law is displaced. Native Village of Kivalina v. ExxonMobil Corp., 696 F.3d 849, 856 (9th Cir. 2012).
How the court applied it
WhatsApp and Facebook alleged that NSO used WhatsApp's servers without authorization to deliver malicious code to roughly 1,400 mobile devices in order to install Pegasus, NSO's remote-intrusion product, and sued under the CFAA, California Penal Code section 502, breach of contract, and trespass to chattels. NSO moved to dismiss for want of subject matter jurisdiction, arguing it acted at the direction of foreign government customers and so enjoyed the conduct-based immunity available at common law to foreign officials. The panel took jurisdiction under the collateral order doctrine, since the FSIA governed the claim and denials of foreign state immunity are immediately appealable. On the merits it declined to follow the district court's Restatement analysis and instead resolved the case on preemption: the FSIA occupies the field for entities, so an entity outside section 1603's definition has no immunity to claim at all. NSO conceded it is not a foreign state; it is not a sovereign, not an organ or political subdivision, and no sovereign owns a majority interest in it. The panel found it incoherent to let a corporation less connected to a sovereign than a statutory instrumentality claim immunity through a doctrine that Samantar tied to natural persons, and noted that no court and no State Department suggestion has ever extended conduct-based immunity to a foreign private corporation.
What the court concluded
The Ninth Circuit affirmed the denial of NSO's motion to dismiss. Because the FSIA supplies the comprehensive framework for any entity's claim of foreign sovereign immunity, and NSO falls outside the Act's definition of a foreign state, NSO is categorically ineligible for that immunity — whatever its government customers do with Pegasus. The court held that no separate common-law inquiry was needed, and the case proceeded on the CFAA and state-law claims.
From the opinion
- “reflects a threshold determination about the availability of foreign sovereign immunity for such entities: they never qualify.” — Part II.B.3, concluding the field-preemption analysis
- “Whatever NSO’s government customers do with its technology and services does not render NSO an "agency or instrumentality of a foreign state"” — Part II.B.4, applying the FSIA definition to NSO
- “There is not a single documented instance of the State Department recommending conduct-based immunity for a foreign private corporation.” — Footnote 8, surveying the Digest of U.S. Practice in International Law for 2016 through 2020
Why it matters for cyber conflict
Offensive cyber capability is increasingly built and sold by private firms rather than state agencies, and this decision holds that the commercial vendor cannot borrow its customer's sovereignty to escape a United States court. It keeps a domestic forum open against the surveillance-tools industry even where the operation was chosen, targeted, and run by a foreign government.
Editorial note: this case note was drafted with AI assistance by the JLCW Research Desk, checked against the text of the opinion, and reviewed by a human editor before publication. Every quotation above is carried through from the opinion itself. See our editing policy.
Read the opinion: WhatsApp Inc. v. NSO Group Technologies Ltd. on CourtListener. This note is a summary prepared by the Journal, not legal advice, and not a substitute for the opinion itself.
The scholarship behind this: Salt Typhoon and the Law of Cyber Espionage: Sovereignty, Attribution, and the Limits of International Law
More on International Law · All case notes · Peer-reviewed scholarship