WhatsApp Inc. v. NSO Grp. Techs. Ltd.

Citation17 F.4th 930
Decision Date08 November 2021
Docket NumberNo. 20-16408,20-16408
Parties WHATSAPP INC., a Delaware corporation; Facebook, Inc., a Delaware corporation, Plaintiffs-Appellees, v. NSO GROUP TECHNOLOGIES LIMITED ; Q Cyber Technologies Limited, Defendants-Appellants.
CourtUnited States Courts of Appeals. United States Court of Appeals (9th Circuit)

Jeffrey S. Bucholtz (argued), King and Spalding LLP, Washington, D.C.; Matthew V.H. Noller, King and Spalding LLP, Sacramento, California; Joseph N. Akrotirianakis, King and Spalding LLP, Los Angeles, California; for Defendants-Appellants.

Michael R. Dreeben (argued), O'Melveny & Myers LLP, Washington, D.C.; Yaira Dubin, O'Melveny & Myers LLP, New York, New York; for Plaintiffs-Appellees.

Mark Parris, Carolyn Frantz, Paul Rugani, and Alyssa Barnard-Yanni, Orrick Herrington & Sutcliffe LLP, Seattle, Washington; for Amici Curiae Microsoft Corp., Cicsco Systems Inc., Github Inc., LinkedIn Corporation, VMWare Inc., and Internet Association.

Michael Trinh, Google LLC, Mountain View, California, for Amicus Curiae Google LLC.

Sophia Cope and Andrew Crocker, Electronic Frontier Foundation, San Francisco, California, for Amicus Curiae Electronic Frontier Foundation.

Elaine Goldenberg, Munger Tolles & Olson LLP, Washington, D.C.; Marianna Mao, Munger Tolles & Olson LLP, San Francisco, California; David Kaye, Irvine, California; for Amicus Curiae David Kaye.

Kyle A. McLorg, Stephanie Skaff, and Deepak Gupta, Farella Braun & Martel LLP, San Francisco, California, for Amici Curiae Access Now, Amnesty International, Committee to Protect Journalists, Internet Freedom Foundation, Paradigm Initiative, Privacy International, Red en Defensa de los Derechos Digitales, and Reporters Without Borders.

Geoffrey M. Klineberg and Bethan R. Jones, Kellogg Hansen Todd Figel & Frederick PLLC, Washington, D.C., for Amicus Curiae Foreign Sovereign Immunity Scholars.

Before: Mary H. Murguia, Ryan D. Nelson, and Danielle J. Forrest, Circuit Judges.

FORREST, Circuit Judge

The question presented is whether foreign sovereign immunity protects private companies. The law governing this question has roots extending back to our earliest history as a nation, and it leads to a simple answer—no. Indeed, the title of the legal doctrine itself—foreign sovereign immunity—suggests the outcome.

Plaintiffs-Appellees WhatsApp Inc. and Facebook, Inc. (collectively WhatsApp) sued Defendants-Appellants NSO Group Technologies Ltd. and Q Cyber Technologies Ltd. (collectively NSO), alleging that NSO, a privately owned and operated Israeli corporation, sent malware through WhatsApp's server system to approximately 1,400 mobile devices, breaking both state and federal law. NSO argues foreign sovereign immunity protects it from suit and, therefore, the court lacks subject matter jurisdiction. Specifically, NSO contends that even if WhatsApp's allegations are true, NSO was acting as an agent of a foreign state, entitling it to "conduct-based immunity"—a common-law doctrine that protects foreign officials acting in their official capacity.

The district court rejected NSO's argument, concluding that common-law foreign official immunity does not protect NSO from suit in this case. We agree that NSO is not entitled to immunity in this case, but we reach this conclusion for a different reason than did the district court. We hold that the Foreign Sovereign Immunity Act (FSIA or Act) occupies the field of foreign sovereign immunity as applied to entities and categorically forecloses extending immunity to any entity that falls outside the FSIA's broad definition of "foreign state." And we reject NSO's argument that it can claim foreign sovereign immunity under common-law immunity doctrines that apply to foreign officials—i.e., natural persons. See Samantar v. Yousuf , 560 U.S. 305, 315–16, 130 S.Ct. 2278, 176 L.Ed.2d 1047 (2010). There is no indication that the Supreme Court intended to extend foreign official immunity to entities. Moreover, the FSIA's text, purpose, and history demonstrate that Congress displaced common-law sovereign immunity doctrine as it relates to entities. See Native Vill. of Kivalina v. ExxonMobil Corp. , 696 F.3d 849, 856 (9th Cir. 2012) ("Federal common law is subject to the paramount authority of Congress.").

I. BACKGROUND

NSO is an Israeli company that designs and licenses surveillance technology to governments and government agencies for national security and law enforcement purposes. One of NSO's products—a program named Pegasus—"enables law enforcement and intelligence agencies to remotely and covertly extract valuable intelligence from virtually any mobile device." Pegasus users may intercept messages, take screenshots, or exfiltrate a device's contacts or history. NSO claims that it markets and licenses Pegasus to its customers,1 which then operate the technology themselves. According to NSO, its role "is limited to ... providing advice and technical support to assist customers in setting up—not operating—the Pegasus technology."

WhatsApp provides an encrypted communication service to the users of its application. Because of its encryption technology, every type of communication (telephone calls, video calls, chats, group chats, images, videos, voice messages, and file transfers) sent using WhatsApp on a mobile device can be viewed only by the intended recipient. WhatsApp asserts that NSO used WhatsApp's servers without authorization to send "malicious code" to approximately 1,400 WhatsApp users. The malicious code was allegedly designed to infect the targeted devices for the purpose of surveilling the device users.

In October 2019, WhatsApp sued NSO in federal district court. WhatsApp asserted claims under the Computer Fraud and Abuse Act, 18 U.S.C. § 1030, and the California Comprehensive Computer Data Access and Fraud Act, Cal. Penal Code § 502, as well as claims for breach of contract and trespass to chattels. WhatsApp alleged that NSO intentionally accessed WhatsApp servers without authorization to figure out how to place Pegasus on WhatsApp users' devices without detection. WhatsApp sought an injunction restraining NSO from accessing WhatsApp's servers, violating WhatsApp's terms, and impairing WhatsApp's service. WhatsApp also sought compensatory, statutory, and punitive damages.

NSO moved to dismiss the complaint. As relevant here, NSO asserted that the court lacked subject matter jurisdiction because NSO was acting at the direction of its foreign government customers and is protected from suit under foreign sovereign immunity. The district court denied NSO's motion. Relying on the Restatement (Second) of Foreign Relations Law § 66, the district court concluded that NSO was not entitled to common-law conduct-based foreign sovereign immunity because it failed to show that exercising jurisdiction over NSO would serve to enforce a rule of law against a foreign state. This interlocutory appeal followed.

II. DISCUSSION
A. Interlocutory Jurisdiction

As a threshold matter, WhatsApp argues that we lack jurisdiction over this interlocutory appeal because the district court's order is not a final appealable order. "We review questions of our own jurisdiction de novo. " Hunt v. Imperial Merch. Servs., Inc. , 560 F.3d 1137, 1140 (9th Cir. 2009) (citation omitted).

We have jurisdiction over "final decisions of the district courts." 28 U.S.C. § 1291. Under the collateral-order doctrine, a small class of interlocutory orders qualifies as "final decisions." See Cohen v. Beneficial Indus. Loan Corp. , 337 U.S. 541, 545–46, 69 S.Ct. 1221, 93 L.Ed. 1528 (1949). To be an appealable collateral order, the decision must "[1] conclusively determine the disputed question, [2] resolve an important issue completely separate from the merits of the action, and [3] be effectively unreviewable on appeal from a final judgment." P.R. Aqueduct & Sewer Auth. v. Metcalf & Eddy, Inc. , 506 U.S. 139, 144, 113 S.Ct. 684, 121 L.Ed.2d 605 (1993) (citation omitted). WhatsApp contests only the third element—that the order is effectively unreviewable after final judgment.

A common example of an immediately appealable collateral order that is effectively unreviewable after final judgment is an interlocutory denial of certain immunities from suit. SolarCity Corp. v. Salt River Project Agric. Improvement & Power Dist. , 859 F.3d 720, 725 (9th Cir. 2017) (noting that the "Supreme Court has allowed immediate appeals from" interlocutory denials of Eleventh Amendment immunity, absolute and qualified immunity, foreign sovereign immunity, and tribal sovereign immunity). In contrast, denials of a "defense to liability" are not immediately appealable final orders. Id. at 725–26 (explaining that "[u]nlike immunity from suit, immunity from liability can be protected by a post-judgment appeal" and "therefore do[es] not meet the requirements for immediate appeal under the collateral-order doctrine").

The parties dispute whether common-law conduct-based foreign official immunity is an immunity from suit, entitling it to an interlocutory appeal, or a defense to liability that can only be appealed post-judgment. But all agree that foreign state sovereign immunity, now codified in the FSIA, is an immunity from suit and that an order denying a foreign state's claim of sovereign immunity is immediately appealable.

Compania Mexicana de Aviacion, S.A. v. U.S. Dist. Ct. , 859 F.2d 1354, 1358 (9th Cir. 1988). Because we conclude that the FSIA governs NSO's claim of immunity, we have jurisdiction over this appeal under the collateral-order doctrine.

B. Foreign Sovereign Immunity
1. Origins of the Doctrine

Chief Justice John Marshall's opinion in Schooner Exchange v. McFaddon , 11 U.S. 116, 7 Cranch 116, 3 L. Ed. 287 (1812), is credited with establishing foreign sovereign immunity in American law. See Opati v. Republic of Sudan , ––– U.S. ––––, 140 S. Ct. 1601, 1605, 206 L.Ed.2d 904 (2020) ; see also Schooner Exchange , 7 Cranch at 136 (noting the Court was "exploring an unbeaten...

To continue reading

Request your trial
7 cases
  • In re ZF-TRW Airbag Control Units Prods. Liab. Litig.
    • United States
    • U.S. District Court — Central District of California
    • 9 Febrero 2022
    ...NSO Grp. Techs. Ltd. , 472 F. Supp. 3d 649, 678 (N.D. Cal. 2020) (citing Action Embroidery , 368 F.3d at 1180 ), aff'd on other grounds , 17 F.4th 930 (9th Cir. 2021) ; In re Chrysler-Dodge-Jeep Ecodiesel Mktg., Sales Pracs., & Prod. Liab. Litig. ("Chrysler-Dodge-Jeep Ecodiesel "), 295 F. S......
  • Mont. Green Party v. Jacobsen
    • United States
    • U.S. Court of Appeals — Ninth Circuit
    • 8 Noviembre 2021
    ... ... See Chapman v. Pier 1 Imps. (U.S.) Inc. , 631 F.3d 939, 954 (9th Cir. 2011) (en banc). At least ... ...
  • Yang v. ICS Protective Serv.
    • United States
    • U.S. District Court — District of Columbia
    • 28 Agosto 2023
    ... ... against China Construction America of South Carolina, Inc., ... and the Department of State for their alleged ... See Brown v. Whole Foods Mkt ... Grp., Inc., 789 F.3d 146, 152 (D.C. Cir. 2015) ... [3] ... Court precedent. See WhatsApp ... Court precedent. See WhatsApp Inc. v. NSO Techs ... See WhatsApp Inc. v. NSO Techs ... Ltd ... ...
  • Jones v. PGA Tour, Inc.
    • United States
    • U.S. District Court — Northern District of California
    • 3 Abril 2023
    ... ... the parties agree otherwise.” CPC Pat. Techs. Pty ... Ltd. v. Apple, Inc. , 34 F.4th 801, 803-04 (9th Cir ... immunity.” WhatsApp Inc. v. NSO Grp. Techs ... Ltd. , 472 F.Supp.3d 649, 664 (N.D. Cal ... ...
  • Request a trial to view additional results

VLEX uses login cookies to provide you with a better browsing experience. If you click on 'Accept' or continue browsing this site we consider that you accept our cookie policy. ACCEPT