WhatsApp Inc. v. NSO Grp. Techs. Ltd., 20-16408

CourtUnited States Courts of Appeals. United States Court of Appeals (9th Circuit)
Writing for the CourtFORREST, Circuit Judge
Citation17 F.4th 930
Parties WHATSAPP INC., a Delaware corporation; Facebook, Inc., a Delaware corporation, Plaintiffs-Appellees, v. NSO GROUP TECHNOLOGIES LIMITED ; Q Cyber Technologies Limited, Defendants-Appellants.
Docket NumberNo. 20-16408,20-16408
Decision Date08 November 2021

17 F.4th 930

WHATSAPP INC., a Delaware corporation; Facebook, Inc., a Delaware corporation, Plaintiffs-Appellees,
v.
NSO GROUP TECHNOLOGIES LIMITED ; Q Cyber Technologies Limited, Defendants-Appellants.

No. 20-16408

United States Court of Appeals, Ninth Circuit.

Argued and Submitted April 12, 2021 San Francisco, California
Filed November 8, 2021


Jeffrey S. Bucholtz (argued), King and Spalding LLP, Washington, D.C.; Matthew V.H. Noller, King and Spalding LLP, Sacramento, California; Joseph N. Akrotirianakis, King and Spalding LLP, Los Angeles, California; for Defendants-Appellants.

Michael R. Dreeben (argued), O'Melveny & Myers LLP, Washington, D.C.; Yaira Dubin, O'Melveny & Myers LLP, New York, New York; for Plaintiffs-Appellees.

Mark Parris, Carolyn Frantz, Paul Rugani, and Alyssa Barnard-Yanni, Orrick Herrington & Sutcliffe LLP, Seattle, Washington; for Amici Curiae Microsoft Corp., Cicsco Systems Inc., Github Inc., LinkedIn Corporation, VMWare Inc., and Internet Association.

Michael Trinh, Google LLC, Mountain View, California, for Amicus Curiae Google LLC.

Sophia Cope and Andrew Crocker, Electronic Frontier Foundation, San Francisco, California, for Amicus Curiae Electronic Frontier Foundation.

Elaine Goldenberg, Munger Tolles & Olson LLP, Washington, D.C.; Marianna Mao, Munger Tolles & Olson LLP, San Francisco, California; David Kaye, Irvine, California; for Amicus Curiae David Kaye.

Kyle A. McLorg, Stephanie Skaff, and Deepak Gupta, Farella Braun & Martel LLP, San Francisco, California, for Amici Curiae Access Now, Amnesty International, Committee to Protect Journalists, Internet Freedom Foundation, Paradigm Initiative, Privacy International, Red en Defensa de los Derechos Digitales, and Reporters Without Borders.

Geoffrey M. Klineberg and Bethan R. Jones, Kellogg Hansen Todd Figel & Frederick PLLC, Washington, D.C., for Amicus Curiae Foreign Sovereign Immunity Scholars.

Before: Mary H. Murguia, Ryan D. Nelson, and Danielle J. Forrest, Circuit Judges.

FORREST, Circuit Judge

The question presented is whether foreign sovereign immunity protects private companies. The law governing this question has roots extending back to our earliest history as a nation, and it leads to a simple answer—no. Indeed, the title of the legal doctrine itself—foreign sovereign immunity—suggests the outcome.

Plaintiffs-Appellees WhatsApp Inc. and Facebook, Inc. (collectively WhatsApp) sued Defendants-Appellants NSO Group Technologies Ltd. and Q Cyber Technologies

17 F.4th 933

Ltd. (collectively NSO), alleging that NSO, a privately owned and operated Israeli corporation, sent malware through WhatsApp's server system to approximately 1,400 mobile devices, breaking both state and federal law. NSO argues foreign sovereign immunity protects it from suit and, therefore, the court lacks subject matter jurisdiction. Specifically, NSO contends that even if WhatsApp's allegations are true, NSO was acting as an agent of a foreign state, entitling it to "conduct-based immunity"—a common-law doctrine that protects foreign officials acting in their official capacity.

The district court rejected NSO's argument, concluding that common-law foreign official immunity does not protect NSO from suit in this case. We agree that NSO is not entitled to immunity in this case, but we reach this conclusion for a different reason than did the district court. We hold that the Foreign Sovereign Immunity Act (FSIA or Act) occupies the field of foreign sovereign immunity as applied to entities and categorically forecloses extending immunity to any entity that falls outside the FSIA's broad definition of "foreign state." And we reject NSO's argument that it can claim foreign sovereign immunity under common-law immunity doctrines that apply to foreign officials—i.e., natural persons. See Samantar v. Yousuf , 560 U.S. 305, 315–16, 130 S.Ct. 2278, 176 L.Ed.2d 1047 (2010). There is no indication that the Supreme Court intended to extend foreign official immunity to entities. Moreover, the FSIA's text, purpose, and history demonstrate that Congress displaced common-law sovereign immunity doctrine as it relates to entities. See Native Vill. of Kivalina v. ExxonMobil Corp. , 696 F.3d 849, 856 (9th Cir. 2012) ("Federal common law is subject to the paramount authority of Congress.").

I. BACKGROUND

NSO is an Israeli company that designs and licenses surveillance technology to governments and government agencies for national security and law enforcement purposes. One of NSO's products—a program named Pegasus—"enables law enforcement and intelligence agencies to remotely and covertly extract valuable intelligence from virtually any mobile device." Pegasus users may intercept messages, take screenshots, or exfiltrate a device's contacts or history. NSO claims that it markets and licenses Pegasus to its customers,1 which then operate the technology themselves. According to NSO, its role "is limited to ... providing advice and technical support to assist customers in setting up—not operating—the Pegasus technology."

WhatsApp provides an encrypted communication service to the users of its application. Because of its encryption technology, every type of communication (telephone calls, video calls, chats, group chats, images, videos, voice messages, and file transfers) sent using WhatsApp on a mobile device can be viewed only by the intended recipient. WhatsApp asserts that NSO used WhatsApp's servers without authorization to send "malicious code" to approximately 1,400 WhatsApp users. The malicious code was allegedly designed to infect the targeted devices for the purpose of surveilling the device users.

In October 2019, WhatsApp sued NSO in federal district court. WhatsApp asserted claims under the Computer Fraud and Abuse Act, 18 U.S.C. § 1030, and the California Comprehensive Computer Data Access

17 F.4th 934

and Fraud Act, Cal. Penal Code § 502, as well as claims for breach of contract and trespass to chattels. WhatsApp alleged that NSO intentionally accessed WhatsApp servers without authorization to figure out how to place Pegasus on WhatsApp users' devices without detection. WhatsApp sought an injunction restraining NSO from accessing WhatsApp's servers, violating WhatsApp's terms, and impairing WhatsApp's service. WhatsApp also sought compensatory, statutory, and punitive damages.

NSO moved to dismiss the complaint. As relevant here, NSO asserted that the court lacked subject matter jurisdiction because NSO was acting at the direction of its foreign government customers and is protected from suit under foreign sovereign immunity. The district court denied NSO's motion. Relying on the Restatement (Second) of Foreign Relations Law § 66, the district court concluded that NSO was not entitled to common-law conduct-based foreign sovereign immunity because it failed to show that exercising jurisdiction over NSO would serve to enforce a rule of law against a foreign state. This interlocutory appeal followed.

II. DISCUSSION

A. Interlocutory Jurisdiction

As a threshold matter, WhatsApp argues that we lack jurisdiction over this interlocutory appeal because the district court's order is not a final appealable order. "We review questions of our own jurisdiction de novo. " Hunt v. Imperial Merch. Servs., Inc. , 560 F.3d 1137, 1140 (9th Cir. 2009) (citation omitted).

We have jurisdiction over "final decisions of the district courts." 28 U.S.C. § 1291. Under the collateral-order doctrine, a small class of interlocutory orders qualifies as "final decisions." See Cohen v. Beneficial Indus. Loan Corp. , 337 U.S. 541, 545–46, 69 S.Ct. 1221, 93 L.Ed. 1528 (1949). To be an appealable collateral order, the decision must "[1] conclusively determine the disputed question, [2] resolve an important issue completely separate from the merits of the action, and [3] be effectively unreviewable on appeal from a final judgment." P.R. Aqueduct & Sewer Auth. v. Metcalf & Eddy, Inc. , 506 U.S. 139, 144, 113 S.Ct. 684, 121 L.Ed.2d 605 (1993) (citation omitted). WhatsApp contests only the third element—that the order is effectively unreviewable after final judgment.

A common example of an immediately appealable collateral order that is effectively unreviewable after final judgment is an interlocutory denial of certain immunities from suit. SolarCity Corp. v. Salt River Project Agric. Improvement & Power Dist. , 859 F.3d 720, 725 (9th Cir. 2017) (noting that the "Supreme Court has allowed immediate appeals from" interlocutory denials of Eleventh Amendment immunity, absolute and qualified immunity, foreign sovereign immunity, and tribal sovereign immunity). In contrast, denials of a "defense to liability" are not immediately appealable final orders. Id. at 725–26 (explaining that "[u]nlike immunity from suit, immunity from liability can be protected by a post-judgment appeal" and "therefore do[es] not meet the requirements for immediate appeal under the collateral-order doctrine").

The parties dispute whether common-law conduct-based foreign official immunity is an immunity from suit, entitling it to an interlocutory appeal, or a defense to liability that can only be appealed post-judgment. But all agree that...

To continue reading

Request your trial
2 practice notes
  • Mont. Green Party v. Jacobsen, 20-35340
    • United States
    • United States Courts of Appeals. United States Court of Appeals (9th Circuit)
    • November 8, 2021
    ...signatures from 2% of registered voters in each of Colorado's 35 senate districts. Both the total number of prior votes cast, as in 17 F.4th 930 Bond and Angle , and the total number of registered voters, as in Semple , are neutral criteria, unrelated to partisan considerations. Moreover, a......
  • Trendsettah USA, Inc. v. Swisher Int'l, Inc., 20-56016
    • United States
    • United States Courts of Appeals. United States Court of Appeals (9th Circuit)
    • April 15, 2022
    ...notice of appeal.II. STANDARDS OF REVIEW"We review questions of our own jurisdiction de novo. " WhatsApp Inc. v. NSO Grp. Techs. Ltd. , 17 F.4th 930, 934 (9th Cir. 2021) (citation omitted).We review the district court's rulings on Swisher's Rule 60 motion for an abuse of discretion. See Irv......
2 cases
  • Mont. Green Party v. Jacobsen, 20-35340
    • United States
    • United States Courts of Appeals. United States Court of Appeals (9th Circuit)
    • November 8, 2021
    ...signatures from 2% of registered voters in each of Colorado's 35 senate districts. Both the total number of prior votes cast, as in 17 F.4th 930 Bond and Angle , and the total number of registered voters, as in Semple , are neutral criteria, unrelated to partisan considerations. Moreover, a......
  • Trendsettah USA, Inc. v. Swisher Int'l, Inc., 20-56016
    • United States
    • United States Courts of Appeals. United States Court of Appeals (9th Circuit)
    • April 15, 2022
    ...notice of appeal.II. STANDARDS OF REVIEW"We review questions of our own jurisdiction de novo. " WhatsApp Inc. v. NSO Grp. Techs. Ltd. , 17 F.4th 930, 934 (9th Cir. 2021) (citation omitted).We review the district court's rulings on Swisher's Rule 60 motion for an abuse of discretion. See Irv......

VLEX uses login cookies to provide you with a better browsing experience. If you click on 'Accept' or continue browsing this site we consider that you accept our cookie policy. ACCEPT