A US appeals court said Facebook can pursue a lawsuit accusing Israel's NSO Group of exploiting a bug in its WhatsApp messaging app to install malware allowing the surveillance of 1,400 people, including journalists, human rights activists and dissidents.
In a 3-0 decision on Monday, the 9th US Circuit Court of Appeals in San Francisco rejected privately owned NSO's claim it was immune from being sued because it had acted as a foreign government agent.
NSO and its lawyers did not immediately respond to requests for comment.
Facebook, now known as Meta Platforms, sued NSO for an injunction and damages in October 2019, accusing it of accessing WhatsApp servers without permission six months earlier to install its Pegasus malware on victims' mobile devices.
NSO has argued that Pegasus helps law enforcement and intelligence agencies fight crime and protect national security.
It was appealing a trial judge's July 2020 refusal to award it "conduct-based immunity," a common law doctrine protecting foreign officials acting in their official capacity.
Upholding that ruling, Circuit Judge Danielle Forrest said it was an "easy case" because NSO's mere licensing of Pegasus and offering technical support did not shield it from liability under federal law, which took precedence over common law.
"Whatever NSO's government customers do with its technology and services does not render NSO an 'agency or instrumentality of a foreign state,'" Forrest wrote. "Thus, NSO is not entitled to the protection of foreign sovereign immunity."
The case will return to US District Judge Phyllis Hamilton in Oakland, California.
WhatsApp spokesman Joshua Breckman in an email called the decision "an important step in holding NSO accountable for its attacks against journalists, human rights defenders and government leaders."
Facebook's case drew support from Microsoft Corp, Alphabet Inc's Google and Cisco Systems Corp, which in a court filing called surveillance technology such as Pegasus "powerful, and dangerous."
On Nov. 3, the US government blacklisted NSO and Israel's Candiru for allegedly providing spyware to governments that used it to "maliciously target" journalists, activists and others.
The case is WhatsApp Inc et al v NSO Group Technologies Ltd et al, 9th US Circuit Court of Appeals, No. 20-16408.