On November 8, 2021, the U.S. Court of Appeals for the Ninth Circuit affirmed a lower court holding that NSO Group Technologies, Ltd., and Q Cyber Technologies Ltd. (collectively, “NSO”) are not entitled to claim foreign sovereign immunity. (WhatsApp Inc. v. NSO Group Tech. Ltd., No. 20-16408, slip op. (9th Cir. Nov. 8, 2021).)
Background to the Case
NSO is a private Israeli company that develops and licenses surveillance technology (spyware) to governments for national security and law enforcement purposes. One of NSO’s products, Pegasus, enables remote, covert extraction of data from mobile devices. The plaintiffs in the lawsuit, WhatsApp, Inc. and Facebook, Inc., have sued NSO, alleging that NSO accessed their servers without permission in order to learn how to put Pegasus on WhatsApp users’ devices without detection. NSO asserts that it was acting at the direction of its foreign government customers.
NSO moved to dismiss the lawsuit on the grounds that it was acting as an agent of a foreign state and thus entitled to immunity under the common-law doctrine that protects foreign officials acting in their official capacity. The trial court denied NSO’s motion, and NSO appealed.
Foreign Sovereign Immunity Law
Foreign sovereign immunity has been part of the American legal system since the early days of the nation. Originally, sovereign immunity was a common-law doctrine, and the State Department was the arbiter of foreign sovereigns’ and ministers’ entitlement to immunity. In 1976, Congress enacted the Foreign Sovereign Immunities Act (FSIA) and transferred responsibility for deciding claims of foreign sovereign immunity from the State Department to the judiciary. The United States Supreme Court has repeatedly affirmed that the FSIA is a “comprehensive framework” for resolving claims of sovereign immunity. (WhatsApp Inc., slip op. at 11.)
Under the FSIA, codified at 28 U.S.C. § 1602 et seq., a foreign state is presumptively immune from the jurisdiction of United States courts unless an exception applies. The term “foreign state” includes a “political subdivision of a foreign state or an agency or instrumentality of a foreign state[.]” (28 U.S.C. § 1603(a).) An “agency or instrumentality of a foreign state” must be a separate legal person or corporation that is an organ of, or majority owned by, a foreign state or political subdivision. (28 U.S.C. § 1603(b).)
Holding of the Court of Appeals
The present decision turned on the question of whether the FSIA applies to all foreign entities (state and non-state) or only foreign state entities. (WhatsApp Inc., slip op. at 13.) Under the FSIA, presumptive immunity from suit is available to an entity that qualifies as a “foreign state.” NSO agreed that it does not qualify as a “foreign state” under the FSIA, but argued that it could claim common-law immunity because the FSIA does not expressly address foreign private entities.
In its analysis, however, the Ninth Circuit found that the text, purpose, and history of the FSIA demonstrate that it occupies the entire field of foreign sovereign immunity with regard to all entities, both foreign state and non-state. None of the policy reasons favoring sovereign immunity are served by granting it to private entities outside of the FSIA. Further, noting the interpretive canon expressio unius exclusio alterius (the expression of one thing implies the exclusion of others), it would not have made sense for Congress to have restricted sovereign immunity under the FSIA to foreign state entities and have intended for non-foreign state entities to resort to a legal scheme outside the FSIA. “The most reasonable interpretation then is that the definition of ‘foreign state’ forecloses immunity for any entity falling outside such definition, particularly where ‘foreign state’ is defined broadly.” (WhatsApp Inc., slip op. at 16.) Finally, the omission of private entities from the FSIA’s definition of “foreign states” “reflects a threshold determination about the availability of foreign sovereign immunity for such entities: they never qualify.” (WhatsApp Inc., slip op. at 18.)
The Ninth Circuit concluded that “an entity is entitled to foreign sovereign immunity, if at all, only under the FSIA. If an entity does not fall within the Act’s definition of ‘foreign state,’ it cannot claim foreign sovereign immunity. Period.” (WhatsApp Inc., slip op. at 14.) Because NSO does not qualify as a “foreign state” under the FSIA, it is precluded from claiming sovereign immunity from suit.