NSO fails once again to claim foreign sovereign immunity in WhatsApp spying lawsuit
(2021/11/09)
- Reference: 1636419181
- News link: https://www.theregister.co.uk/2021/11/09/nso_foreign_immunity_whatsapp_decision/
- Source link:
Spyware maker NSO Group cannot use its government clients to shield itself from litigation, a US appeals court ruled on Monday, a decision that allows WhatsApp's lawsuit against the Israel-based firm to resume.
In 2019, Facebook and its WhatsApp subsidiary [1]sued NSO claiming the firm's intrusion software, known as Pegasus, was used to unlawfully [2]compromise the accounts of WhatsApp customers.
NSO denies any wrongdoing. While WhatsApp claimed members of civil society had their phones infiltrated by Pegasus, NSO insisted it only sold its software to "licensed government intelligence and law enforcement agencies to help them fight terrorism and serious crime," and that using its software to surveil political opponents, advocacy groups, and journalists is contractually prohibited.
[3]
Despite such assertions, human-rights groups, such as [4]Amnesty International and [5]Citizen Lab , have said thin-skinned regimes still use Pegasus for political oppression. Pegasus spyware was reportedly found [6]on the phone of Hatice Cengiz, fiancée of murdered journalist Jamal Khashoggi. The software has been implicated in the surveillance of [7]a phone belonging to Amazon founder and Washington Post owner Jeff Bezos. On Monday, an Ireland-based advocacy group called Front Line Defenders [8]said Pegasus spyware was found on the phones of six Palestinian human-rights advocates.
[9]
[10]
NSO tried last year to be excused from the WhatsApp lawsuit by claiming, among other things, it cannot be sued because it acted at the behest of foreign sovereign governments and thus inherits governmental immunity from prosecution.
In July, 2020, US District Judge Phyllis Hamilton [11]mostly rejected NSO's arguments and indicated that the snoopware maker could be challenged in court. In October that year, NSO tried to appeal to a higher court, the US Ninth Circuit Court of Appeals.
[12]
Well, a year later, the US Ninth Circuit Court of Appeals has concluded that NSO is wrong. It was, as the appellate judges put it, "an easy case."
[13]Uncle Sam to clip wings of Pegasus-like spyware – sorry, 'intrusion software' – with proposed export controls
[14]US Dept of Commerce sanctions NSO Group, Positive Technologies, other makers of snoopware
[15]NSO Group's Pegasus malware was used to spy on Dubai princess's lawyers during child custody dispute
[16]That 'anti-NSO Pegasus spyware' download is actually a Trojan – so don't touch it
The appeals panel upheld the lower court decision
"Whatever NSO’s government customers do with its technology and services does not render NSO an 'agency or instrumentality of a foreign state,' as Congress has defined that term," the appeals panel said. "Thus, NSO is not entitled to the protection of foreign sovereign immunity."
The decision compounds the problems of the beleaguered spyware firm: last week, the US Department of Commerce [18]sanctioned NSO , along with three other companies, for trafficking in intrusion software.
WhatsApp CEO Will Cathcart welcomed the ruling.
[19]
"We're grateful for the court’s decision today," he said, [20]via Twitter . "This ruling is an important step in holding NSO accountable for its attacks against journalists, human rights defenders, and government leaders. Huge thanks to all the privacy NGOs and tech companies that have supported us in this."
NSO Group did not immediately respond to a request for comment. ®
Get our [21]Tech Resources
[1] https://www.theregister.com/2019/10/29/whatsapp_sue_nso_group/
[2] https://www.theregister.com/2019/05/14/whatsapp_zero_day/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YYoAhp4Po4aSZOlChvP8MAAAAM8&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://www.theregister.com/2021/07/19/mass_misuse_of_nso_pegasus_spyware_alleged/
[5] https://citizenlab.ca/2021/09/forcedentry-nso-group-imessage-zero-click-exploit-captured-in-the-wild/
[6] https://www.pbs.org/wgbh/frontline/article/how-nso-group-pegasus-spyware-found-jamal-khashoggi-fiancee-phone/
[7] https://www.theregister.com/2020/01/22/saudi_bezos_phone_hack/
[8] https://www.frontlinedefenders.org/press-release-front-line-defenders-investigation-finds-pegasus-spyware-6-palestinian-hrd-phones
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YYoAhp4Po4aSZOlChvP8MAAAAM8&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YYoAhp4Po4aSZOlChvP8MAAAAM8&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[11] https://www.theregister.com/2020/07/17/facebook_whatsapp_nsa/
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YYoAhp4Po4aSZOlChvP8MAAAAM8&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[13] https://www.theregister.com/2021/10/20/us_intrusion_software_rules/
[14] https://www.theregister.com/2021/11/03/us_sanctions_spyware/
[15] https://www.theregister.com/2021/10/07/pegasus_malware_princess_haya/
[16] https://www.theregister.com/2021/10/01/amnesty_website_impersonator_trojan_pegasus/
[17] https://cdn.ca9.uscourts.gov/datastore/opinions/2021/11/08/20-16408.pdf
[18] https://www.theregister.com/2021/11/03/us_sanctions_spyware/
[19] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YYoAhp4Po4aSZOlChvP8MAAAAM8&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[20] https://twitter.com/wcathcart/status/1457770944450072578?s=20
[21] https://whitepapers.theregister.com/
In 2019, Facebook and its WhatsApp subsidiary [1]sued NSO claiming the firm's intrusion software, known as Pegasus, was used to unlawfully [2]compromise the accounts of WhatsApp customers.
NSO denies any wrongdoing. While WhatsApp claimed members of civil society had their phones infiltrated by Pegasus, NSO insisted it only sold its software to "licensed government intelligence and law enforcement agencies to help them fight terrorism and serious crime," and that using its software to surveil political opponents, advocacy groups, and journalists is contractually prohibited.
[3]
Despite such assertions, human-rights groups, such as [4]Amnesty International and [5]Citizen Lab , have said thin-skinned regimes still use Pegasus for political oppression. Pegasus spyware was reportedly found [6]on the phone of Hatice Cengiz, fiancée of murdered journalist Jamal Khashoggi. The software has been implicated in the surveillance of [7]a phone belonging to Amazon founder and Washington Post owner Jeff Bezos. On Monday, an Ireland-based advocacy group called Front Line Defenders [8]said Pegasus spyware was found on the phones of six Palestinian human-rights advocates.
[9]
[10]
NSO tried last year to be excused from the WhatsApp lawsuit by claiming, among other things, it cannot be sued because it acted at the behest of foreign sovereign governments and thus inherits governmental immunity from prosecution.
In July, 2020, US District Judge Phyllis Hamilton [11]mostly rejected NSO's arguments and indicated that the snoopware maker could be challenged in court. In October that year, NSO tried to appeal to a higher court, the US Ninth Circuit Court of Appeals.
[12]
Well, a year later, the US Ninth Circuit Court of Appeals has concluded that NSO is wrong. It was, as the appellate judges put it, "an easy case."
[13]Uncle Sam to clip wings of Pegasus-like spyware – sorry, 'intrusion software' – with proposed export controls
[14]US Dept of Commerce sanctions NSO Group, Positive Technologies, other makers of snoopware
[15]NSO Group's Pegasus malware was used to spy on Dubai princess's lawyers during child custody dispute
[16]That 'anti-NSO Pegasus spyware' download is actually a Trojan – so don't touch it
The appeals panel upheld the lower court decision
[17]PDF
, ruling that the Foreign Sovereign Immunity Act applies to entities defined under the law as foreign states and does not apply to foreign officials."Whatever NSO’s government customers do with its technology and services does not render NSO an 'agency or instrumentality of a foreign state,' as Congress has defined that term," the appeals panel said. "Thus, NSO is not entitled to the protection of foreign sovereign immunity."
The decision compounds the problems of the beleaguered spyware firm: last week, the US Department of Commerce [18]sanctioned NSO , along with three other companies, for trafficking in intrusion software.
WhatsApp CEO Will Cathcart welcomed the ruling.
[19]
"We're grateful for the court’s decision today," he said, [20]via Twitter . "This ruling is an important step in holding NSO accountable for its attacks against journalists, human rights defenders, and government leaders. Huge thanks to all the privacy NGOs and tech companies that have supported us in this."
NSO Group did not immediately respond to a request for comment. ®
Get our [21]Tech Resources
[1] https://www.theregister.com/2019/10/29/whatsapp_sue_nso_group/
[2] https://www.theregister.com/2019/05/14/whatsapp_zero_day/
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YYoAhp4Po4aSZOlChvP8MAAAAM8&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://www.theregister.com/2021/07/19/mass_misuse_of_nso_pegasus_spyware_alleged/
[5] https://citizenlab.ca/2021/09/forcedentry-nso-group-imessage-zero-click-exploit-captured-in-the-wild/
[6] https://www.pbs.org/wgbh/frontline/article/how-nso-group-pegasus-spyware-found-jamal-khashoggi-fiancee-phone/
[7] https://www.theregister.com/2020/01/22/saudi_bezos_phone_hack/
[8] https://www.frontlinedefenders.org/press-release-front-line-defenders-investigation-finds-pegasus-spyware-6-palestinian-hrd-phones
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YYoAhp4Po4aSZOlChvP8MAAAAM8&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YYoAhp4Po4aSZOlChvP8MAAAAM8&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[11] https://www.theregister.com/2020/07/17/facebook_whatsapp_nsa/
[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YYoAhp4Po4aSZOlChvP8MAAAAM8&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[13] https://www.theregister.com/2021/10/20/us_intrusion_software_rules/
[14] https://www.theregister.com/2021/11/03/us_sanctions_spyware/
[15] https://www.theregister.com/2021/10/07/pegasus_malware_princess_haya/
[16] https://www.theregister.com/2021/10/01/amnesty_website_impersonator_trojan_pegasus/
[17] https://cdn.ca9.uscourts.gov/datastore/opinions/2021/11/08/20-16408.pdf
[18] https://www.theregister.com/2021/11/03/us_sanctions_spyware/
[19] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YYoAhp4Po4aSZOlChvP8MAAAAM8&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[20] https://twitter.com/wcathcart/status/1457770944450072578?s=20
[21] https://whitepapers.theregister.com/
Re: "It's not our fault, honest Guv!
Clausewitz 4.0
So you don't like arms. Remember they are used to protect your country.
Re: "It's not our fault, honest Guv!
Jim Mitchell
Countries only protect their own arms manufacturers and dealers. NSO isn't ours.
"It's not our fault, honest Guv!
We only built that nuclear bomb, we didn't deploy it, so we shouldn't be accountable for the actions of the people that did."
"Oh, and we only sell nuclear bombs to legit third parties that pinky swear not to hurt anyone with them, so you can just let us go with a warning, right?"
Replace "nuclear bomb" with a "brick of firecrackers" & it starts sounding like the whinging of most adolescents caught after trying to blow up the neighbor's cat.
Take them out behind the barn, bend them over a hay bale, & take a stout stick to their behinds until you've run out of trees to turn into spanking switches.