Litigation Details for WhatsApp Inc. v. NSO Group Technologies Limited (N.D. Cal. 2019)

WhatsApp Inc. v. NSO Group Technologies Limited (N.D. Cal. 2019)

Docket		Date Filed	2019-10-29
Court	District Court, N.D. California	Date Terminated
Cause	28:1331 Fed. Question	Assigned To	Phyllis Jean Hamilton
Jury Demand	Plaintiff	Referred To	Sallie Kim
Patents	6,147,103; 6,166,213; 6,191,148; 6,369,085; 6,428,810; 6,875,872; 7,411,070
Link to Docket	External link to docket

Details for WhatsApp Inc. v. NSO Group Technologies Limited (N.D. Cal. 2019)

Date Filed	Document No.	Description	Snippet	Link To Document
2019-10-29				External link to document
2019-10-29	29	Exhibit 3 to Declaration of Joseph D. Mornin	quot;the `070 atent") U.S. Patent No. 6,147,103 October• 9, 2018 (&…960 patent, the `424 patent, the `103 patent, the `213 patent, the `148 patent, or the `810 patent -- …230 patent, Che `960 patent, the `424 patent, the `103 patent, the `213 patent, the `1~8 patent, the `810…872 patent; the `810 patent; the `085 patent; and U.S. Patent No. 5,948,789("the `789 patent"…the `960 patent, the `424 patent, the `103 patent, the `213 patent, and the `148 patent. Thus, these	External link to document

WhatsApp Inc. v. NSO Group Technologies Limited, 4:19-cv-07123: Litigation Summary and Analysis

Last updated: February 19, 2026

What is the core allegation in the litigation?

WhatsApp Inc. alleges that NSO Group Technologies Limited, its Israeli parent entities (NSO Parent), and its U.S. subsidiary (NSO US), unlawfully accessed WhatsApp's servers and exploited vulnerabilities in its platform to deploy its Pegasus spyware. This unauthorized access and deployment allegedly violated the U.S. Computer Fraud and Abuse Act (CFAA) and California's Computer Data Access and Fraud Act (CDAFA). WhatsApp claims NSO Group acted as an agent of foreign governments to conduct surveillance on individuals through WhatsApp's encrypted messaging service. The complaint asserts that NSO Group's actions circumvented WhatsApp's security measures, including its end-to-end encryption, to enable unauthorized access to user data and communications.

What is NSO Group's primary defense strategy?

NSO Group's primary defense centers on the assertion of sovereign immunity. The company argues that its actions were undertaken as an agent of foreign governments and that it is therefore immune from suit in U.S. courts under the Foreign Sovereign Immunities Act (FSIA). NSO Group contends that its software, Pegasus, is a tool used by sovereign nations for legitimate national security and law enforcement purposes. It argues that the U.S. government, by its contract with WhatsApp, implicitly recognized and permitted such activities. NSO Group also disputes the characterization of its activities as "unauthorized access," asserting that it obtained access through means not prohibited by law when directed by sovereign states.

What has been the procedural history of the case?

The lawsuit was filed on October 29, 2019, in the U.S. District Court for the Northern District of California. NSO Group and its related entities moved to dismiss the case, arguing sovereign immunity and other procedural grounds. The District Court denied NSO Group's motion to dismiss in July 2020, ruling that NSO Group was not entitled to sovereign immunity and that the CFAA claims were plausible. NSO Group appealed this decision to the U.S. Court of Appeals for the Ninth Circuit. In January 2023, the Ninth Circuit affirmed the District Court's denial of NSO Group's motion to dismiss. NSO Group subsequently petitioned the U.S. Supreme Court for a writ of certiorari, which was denied in October 2023. The case has now returned to the District Court for further proceedings.

What are the key legal arguments regarding CFAA and CDAFA violations?

WhatsApp's claims under the Computer Fraud and Abuse Act (CFAA) and California's Computer Data Access and Fraud Act (CDAFA) hinge on demonstrating that NSO Group exceeded authorized access to WhatsApp's servers. WhatsApp argues that NSO Group's conduct involved scraping data and circumventing technical access controls, constituting unauthorized access under these statutes. NSO Group counters that its access was authorized by the foreign governments for whom it acted, and that FSIA preempts these domestic statutes. The interpretation of "exceeds authorized access" under the CFAA is a critical point of contention, particularly when the alleged access is facilitated by a foreign state entity.

How does the Foreign Sovereign Immunities Act (FSIA) factor into this litigation?

The Foreign Sovereign Immunities Act (FSIA) is central to NSO Group's defense. FSIA generally grants foreign states immunity from the jurisdiction of U.S. courts. However, there are exceptions, including the "commercial activity" exception. NSO Group argues that its activities were governmental, not commercial, and that it acted as an agent of sovereign states. WhatsApp, conversely, contends that NSO Group's development and sale of its spyware technology constitute commercial activity, thereby stripping NSO Group of sovereign immunity. The courts have grappled with whether NSO Group, as a private company, can claim derivative sovereign immunity through its alleged agency relationship with foreign states.

What is the status of the case and what are the next anticipated steps?

As of October 2023, the case has been remanded to the District Court following the U.S. Supreme Court's denial of NSO Group's certiorari petition. The litigation is expected to proceed with discovery and potential summary judgment motions. The parties will likely re-engage in arguments regarding the scope of the CFAA and CDAFA in light of the Ninth Circuit's and Supreme Court's decisions on immunity. The District Court will need to adjudicate whether NSO Group's activities fall within any exceptions to sovereign immunity, or if the case can proceed on its merits concerning alleged statutory violations.

What are the implications of this litigation for cybersecurity and government surveillance?

This litigation has significant implications for the intersection of cybersecurity, government surveillance, and the liability of technology providers. It raises questions about the extent to which private companies can be held liable for the actions of their clients, particularly when those clients are foreign governments. The outcome could influence how governments conduct digital surveillance and how cybersecurity firms are regulated. It also highlights the challenges of protecting user data and privacy in an era of sophisticated state-sponsored hacking tools. The case tests the boundaries of sovereign immunity in the context of technological innovation and alleged human rights abuses.

What is the alleged impact on WhatsApp users and data?

WhatsApp alleges that NSO Group's actions enabled the compromise of its users' communications and data. By exploiting vulnerabilities, Pegasus spyware could allegedly access call logs, messages, emails, location data, and microphone/camera feeds from compromised devices. This unauthorized access represents a profound breach of user privacy and security, undermining the trust users place in encrypted communication platforms. WhatsApp asserts that NSO Group's activities directly harmed its users by facilitating surreptitious surveillance.

How do NSO Group's activities relate to potential human rights concerns?

Reports from human rights organizations and investigative journalists have linked NSO Group's Pegasus spyware to the surveillance of journalists, activists, lawyers, and political dissidents in various countries. Critics argue that the sale and use of Pegasus by authoritarian regimes facilitate human rights abuses by enabling the suppression of dissent and the targeting of vulnerable populations. This aspect, while not directly a cause of action in the WhatsApp Inc. v. NSO Group case, informs the broader context and ethical considerations surrounding the litigation.

What are the financial stakes involved in this case?

The direct financial stakes in this litigation are primarily related to damages, legal costs, and potential reputational harm. WhatsApp is seeking injunctive relief to prevent further unauthorized access and monetary damages for losses incurred. For NSO Group, a judgment against it could result in substantial financial penalties, further restrict its business operations, and diminish its market value. The protracted legal battle also entails significant expenditure on legal defense for both parties.

What is the significance of the Ninth Circuit's ruling?

The Ninth Circuit's January 2023 ruling was significant because it affirmed the District Court's decision that NSO Group is not entitled to sovereign immunity. The Ninth Circuit reasoned that NSO Group, as a private entity, could not claim derivative sovereign immunity for its alleged commercial activities, even if acting at the behest of foreign governments. The court found that NSO Group's business of developing and selling surveillance technology could be considered commercial activity, falling outside the scope of FSIA's grant of immunity. This ruling allowed the case to proceed on its merits in the District Court.

What does the Supreme Court's denial of certiorari mean for the case?

The U.S. Supreme Court's denial of certiorari in October 2023 means that the Ninth Circuit's decision stands. The Supreme Court did not take up the case for review, thereby allowing the lower court's ruling to remain in effect. This denial effectively ends NSO Group's attempt to resolve the sovereign immunity issue at the highest judicial level and compels the case to return to the District Court for further proceedings. It signifies that the arguments concerning NSO Group's potential liability under U.S. law will now be addressed at the trial court level.

Key Takeaways

• Sovereign Immunity is Central: NSO Group's primary defense rests on claiming derivative sovereign immunity as an agent of foreign governments.
• CFAA and CDAFA Claims Proceed: The Ninth Circuit has affirmed that WhatsApp's claims under the Computer Fraud and Abuse Act (CFAA) and California's Computer Data Access and Fraud Act (CDAFA) can proceed.
• Commercial Activity Exception: The core legal debate involves whether NSO Group's sale of surveillance technology constitutes "commercial activity" outside the scope of FSIA.
• Case Returns to District Court: Following the Supreme Court's denial of certiorari, the litigation is back in the U.S. District Court for further discovery and potential trial.
• Broader Implications for Tech and Surveillance: The case's outcome will impact the liability of technology providers and the legal framework governing government surveillance activities.

Frequently Asked Questions

1. What specific vulnerabilities in WhatsApp's platform were allegedly exploited by NSO Group? The lawsuit alleges that NSO Group exploited a previously unknown vulnerability in WhatsApp's Voice over IP (VoIP) calling feature. This vulnerability allowed NSO Group to remotely install its Pegasus spyware on targeted devices by making a call to the user's WhatsApp number, even if the call was not answered.
2. Can NSO Group continue to sell its technology to governments while this litigation is ongoing? While the U.S. litigation continues, NSO Group's ability to sell its technology is subject to export controls, sanctions, and the specific laws of the countries where it operates or sells its products. The ongoing litigation, particularly if it proceeds to a judgment against NSO Group, could significantly impact its future business operations and client base.
3. What damages is WhatsApp seeking in this lawsuit? WhatsApp is seeking monetary damages for losses incurred as a result of NSO Group's alleged actions, including costs associated with securing its platform and responding to the breach. It is also seeking injunctive relief to prevent further unauthorized access to its servers and services.
4. How does this case differ from other lawsuits involving NSO Group? This case is distinct due to its focus on WhatsApp's direct claims of CFAA and CDAFA violations and the specific allegations of exploiting vulnerabilities within the WhatsApp platform. While other cases have involved NSO Group, this lawsuit specifically targets the company's actions against a major global communication service provider.
5. What are the potential consequences if NSO Group is found liable? If NSO Group is found liable, it could face significant financial penalties, substantial damage awards to WhatsApp, and court orders prohibiting future unauthorized access. Such a judgment could also have a profound impact on NSO Group's reputation and its ability to conduct business globally, potentially leading to increased regulatory scrutiny and limitations on its operations.

Citations

[1] WhatsApp Inc. v. NSO Grp. Techs. Ltd., 4:19-cv-07123 (N.D. Cal. filed Oct. 29, 2019). [2] WhatsApp Inc. v. NSO Grp. Techs. Ltd., 57 F.4th 817 (9th Cir. 2023). [3] NSO Group Technologies Limited v. WhatsApp Inc., No. 22-1478 (U.S. Oct. 16, 2023) (denying certiorari). [4] Computer Fraud and Abuse Act, 18 U.S.C. § 1030. [5] California Penal Code § 502. [6] Foreign Sovereign Immunities Act, 28 U.S.C. § 1602 et seq.