US Sours on Israeli Spyware Vendor NSO Group

This studio photographic illustration shows a smartphone with the website of Israel's NSO Group which features Pegasus spyware, on display in Paris on July 21, 2021. Joel Saget/AFP via Getty Images

Israeli spyware vendor NSO Group was handed a major loss on Nov. 8, just days after being placed on a U.S. sanctions list, when a federal appeals court denied the company’s sovereign immunity claims—paving the way for the firm to face legal liability in the United States.

NSO Group faces legal and regulatory actions in numerous jurisdictions over what’s been dubbed the Pegasus scandal—where the company allegedly allowed authoritarian governments to use its Pegasus software to spy on journalists, human rights activists, and dissidents.

Developed by former members of the elite Israeli Unit 8200—comparable to the U.S. National Security Agency—the Pegasus software allegedly infects iPhones and Androids, enabling operators to extract messages, photos, and emails; record calls; and activate microphones in secret.

Facebook initially sued NSO Group in 2019 for allegedly hacking WhatsApp, sending malicious code to about 1,400 of its users for the purpose of surveilling their phones and devices. According to Facebook, the users included attorneys, journalists, human rights activists, and diplomats.

NSO moved to have the lawsuit dismissed on sovereign immunity grounds, arguing that its product was used by foreign governments. The case made its way up to the Court of Appeals for the 9th Circuit, which denied NSO’s motion in a Nov. 8 decision—ruling that U.S. sovereign immunity laws apply to foreign state entities, but not to individuals or private companies.

“An entity must be a sovereign or must have a sufficient relationship to a sovereign to claim sovereign-based immunity,” the 9th Circuit said. “Without such status or relationship, there is no justification for granting sovereign immunity.”

The 9th Circuit ruling means Facebook can move its lawsuit against NSO forward to the discovery stage, where potentially more damning information about the Israeli spyware firm may be revealed.

NSO has continued to deny any wrongdoing, although the company faced another round of negative publicity over the past week.

On Nov. 3, the Department of Commerce added NSO to its list of entities engaged in activities contrary to U.S. national security interests, citing many of the same allegations contained in media reports about the Pegasus scandal.

“[NSO Group] has enabled foreign governments to conduct transnational repression, which is the practice of authoritarian governments targeting dissidents, journalists and activists outside of their sovereign borders to silence dissent,” the department said in a statement. “Such practices threaten the rules-based international order.”