abusesaffiliationarrow-downarrow-leftarrow-rightarrow-upattack-typeburgerchevron-downchevron-leftchevron-rightchevron-upClock iconclosedeletedevelopment-povertydiscriminationdollardownloademailenvironmentexternal-linkfacebookfiltergenderglobegroupshealthC4067174-3DD9-4B9E-AD64-284FDAAE6338@1xinformation-outlineinformationinstagraminvestment-trade-globalisationissueslabourlanguagesShapeCombined Shapeline, chart, up, arrow, graphLinkedInlocationmap-pinminusnewsorganisationotheroverviewpluspreviewArtboard 185profilerefreshIconnewssearchsecurityPathStock downStock steadyStock uptagticktooltiptwitteruniversalityweb
Lawsuit

29 Oct 2019

NSO Group lawsuit (re hacking WhatsApp users)

Status: ONGOING

Date lawsuit was filed
29 Oct 2019
Unknown
Company
Location of Filing: United States of America
Location of Incident: Israel
Type of Litigation: Transnational

Companies

Blackstone United States of America Finance & banking
Cisco Systems United States of America Technology, telecom & electronics
Meta (formerly Facebook) United States of America Internet & social media, Advertising & marketing, Technology: General
Google (part of Alphabet) United States of America Technology: General, Advertising & marketing, Artificial Intelligence (AI), Finance & banking, Entertainment, Internet & social media
Microsoft United States of America Technology: General, Internet & social media
LinkedIn (part of Microsoft) United States of America Internet & social media
GitHub United States of America Technology, telecom & electronics
WhatsApp (part of Meta) United States of America Software & Services
NSO Group Israel Technology, telecom & electronics, Security companies, Military/weapons/security equipment: General
VMware United States of America Technology, telecom & electronics

Sources

Snapshot: In 2019, WhatsApp filed suit in California state court against NSO Group, an Israeli spyware vendor, alleging that the company had hacked the WhatsApp server to plant Pegasus spyware on 1,400 user devices worldwide, targeting journalists, lawyers, religious leaders, and political dissidents. Plaintiffs argue that this is in violation of the U.S. Computer Fraud and Abuse Act (CFAA) and California Comprehensive Data Access and Fraud Act and seek damages as well as an injunction to prevent NSO Group from accessing WhatsApp computer system. The case is ongoing. 

Factual Background

On 29 October 2019, WhatsApp, which is owned by Facebook, released a statement alleging spyware, known as Pegasus produced by the Israeli company NSO Group was used to hack the phone systems of 1,400 users between April 2019 and May 2019 in 20 different countries. Of the 1,400 users at least 100 were human rights defenders, journalists, and other members of civil society across the globe.

Legal Argument

WhatsApp is demanding a permanent injunction blocking NSO from attempting to access its computer system and those of its parent company, Facebook. Additionally, they have asked that the court rule that NSO’s alleged hacking of user’s data violated the federal Computer Fraud and Abuse Act as well as the  California Comprehensive Computer Data Access and Fraud Act, breached their contracts with WhatsApp and “wrongfully trespassed” on Facebook’s property.

NSO Group disputes these allegations. They argue the sole purpose of NSO is to provide governments and law enforcement agencies with technologies to help them fight terrorism and serious crimes. 

Legal Proceedings

On 29 October 2019 WhatsApp filed suit against NSO Group in California court in the US.

On 2 March 2020, NSO Group failed to appear in the California court, resulting in a notice of default entered. NSO responded that WhatsApp had prematurely moved for a default judgment before properly serving NSO with the lawsuit, allegedly violating international laws regarding service of process. Service of process is a legal term referring to the acceptable possible avenues with which plaintiffs can notify defendants a lawsuit has been filed against them and allow them ample opportunity to respond. WhatsApp argued they made several good faith attempts to serve the company.   

On 6 March 2020, defendants filed an application with the California state court to set aside the default judgment and raised the issue of incomplete service under the Hague Convention, which details acceptable service of process for international disputes. Additionally, defendants request sanctions be entered against the Plaintiffs for falsely representing to the Court that they had properly served defendants under the Hague Convention. Additionally, defendants argue that plaintiffs had a duty to correct the false statements.

On 13 April 2020, the Court ruled WhatsApp had not intentionally made false statements to the court and given the short time frame, did not usurp their duty to correct the statements to the court.

On 16 July 2020, a US district court judge in California ruled that WhatsApp's lawsuit could proceed. In its ruling, the judge explained not being convinced by NSO's argument that it had no role in the targeting of WhatsApp's users and only followed the directions of its customers. He also ruled that NSO cannot be protected by sovereign immunity as a private company even if it acts as an agent of its foreign sovereign clients.

Based on an appeal filed on 12 April 2021, the US appeals court for the ninth circuit issued its decision on 8 November 2021 rejecting NSO's claim of protection under sovereign immunity laws and allowing the lawsuit to proceed.

On 6 April 2022, NSO Group asked the US Supreme Court to review the decision of the appeals court for the ninth circuit. It asks to be recognised as a foreign government agent and therefore be entitled to sovereign immunity.

In June 2022, the US Supreme Court asked the Justice Department to provide its view on whether NSO Group has sovereign immunity to decide if the lawsuit can proceed.

On 9 January 2023, the US Supreme Court found that NSO Group lacked sovereign immunity and allowed the lawsuit to proceed in the US District Court for the Northern District of California.

Lawsuit filed by NSO Group Employees against Facebook in Israel

On 26 November 2019, employees from NSO Group filed a separate lawsuit in Israel against Facebook Inc (which owns WhatsApp), alleging the social media giant had blocked their private accounts when it sued NSO in October 2019. They petitioned the Tel Aviv district court to order Facebook to unblock the accounts. Facebook responded that they had disabled relevant accounts after the cyber-attack and that the restrictions continue to be necessary for security reasons. 

News Items

Supreme Court allows WhatsApp lawsuit over 'Pegasus' spyware to move forward, NBC News, 9 Jan 2023

U.S. Supreme Court seeks Biden views on WhatsApp 'Pegasus' spyware dispute, Reuters, 6 Jun 2022

NSO turns to US Supreme Court for immunity in WhatsApp suit, Associated Press, 11 Apr 2022

USA: Legal woes mount for NSO after court rules WhatsApp lawsuit can proceed, Stephanie Kirchgaessner, Guardian, 8 Nov 2021

Litigation against or implicating NSO Group, Citizen Lab

Israeli Spyware Company Begs Ninth Circuit for Immunity From WhatsApp Suit, CourtHouse News Service, 12 Apr 2021

US judge: Whatsapp lawsuit against Isreali spyware firm NSO can proceed, Guardian, 17 Jul 2020

In Court, NSO Group accuses Facebook of lying, disregarding international law, Times of Israel, 12 Mar 2020

The Israeli spyware firm accused of hacking WhatsApp is now claiming Facebook disregarded international law as the legal battle between the 2 companies heats up, Business Insider, 10 Mar 2020

Will WhatsApp win its lawsuit against NSO?, Al Jazeera, 5 Mar 2020

WhatsApp takes step toward winning spyware lawsuit after Israeli company no-show, Reuters, 4 Mar 2020

NSO Group points finger at state clients in WhatsApp spying case, The Guardian, 7 Apr 2020

Works at Israeli surveillance firm NSO sue Facebook for blocking private accounts, Reuters, 26 Nov 2019

How NSO Group helps countries hack targets, Vice, 31 Oct 2019

WhatsApp sues Israeli firm, accusing it of hacking activists’ phones, Guardian, 29 Oct 2019

NSO Group/Q Cyber Lab Technologies, Citizen Lab, 29 Oct 2019

Court Documents

NSO Group's petition to US Supreme Court for a writ of certiorari to review the judgment of the Ninth Circuit, 6 Apr 2022

WhatsApp v. NSO Group, US court for the ninth circuit [rejecting NSO's claim of protection under sovereign immunity laws and allowing the lawsuit to proceed], 8 Nov 2021

WhatsApp v. NSO Group, US District Court Northern District of California, 16 Jul 2020

NSO Group objection to joint amicus brief in support of WhatsApp, 4 Jan 2021

Amicus brief of Access Now, Amnesty International, Committee to Protect Journalists, Internet Freedom Foundation, Paradigm Initiative, Privacy International, Red En Defensa de los Derechos Digitales, and Reporters without Borders in support of WhatsApp's request for affirmance, 22 Dec 2020

Complaint for WhatsApp Inc. v. NSO Group Technologies Limited, U.S. District Court for the Northern District of California, 29 Oct 2019

Timeline