In October 2019, WhatsApp – an online messaging platform owned by Facebook Inc. – filed a lawsuit against NSO Group (NSO) before the District Court for the Northern District of California. NSO is an Israeli-based technology company best known for its Pegasus spyware, which can be used to gain access to confidential information stored on computer networks and systems. WhatsApp claims that, by exploiting a vulnerability in its operating system, NSO implanted this spyware on the mobile phones of its customers, including human rights activists, lawyers, and religious figures. According to WhatsApp’s complaint, NSO’s spying activities violate U.S. law on computer fraud as well as WhatsApp’s user agreement. WhatsApp has applied for a permanent injunction to prevent NSO from accessing its platform.
NSO denies WhatsApp’s allegations and, on April 4, 2020, it filed a motion to dismiss the case, which was accompanied by a declaration by NSO CEO Shalev Hulio. NSO claims its activities are limited to licensing software to government law enforcement and intelligence agencies, and that it does not operate the technology. This is consistent with a previous statement in which NSO maintained that it only sells its software to human rights-respecting governments that use it to fight terrorism and serious crime. Yet, media outlets cite NSO sources who suggest that NSO is directly involved in surveillance operations because either foreign governments lack the technological expertise to carry out the operations themselves or their national law prohibits them from doing so.
Whether WhatsApp can establish NSO’s direct involvement in the surveillance operations will be an important factual matter to be resolved at trial. However, it is not necessarily the case that this dispute will end with a consideration of its merits. NSO argues that, even if the court accepts WhatsApp’s allegations as true (p. 8), U.S. courts lack both personal and subject-matter jurisdiction to hear the case. While personal jurisdiction raises the question of whether the company has sufficient connections with the United States for the case to be decided by U.S. courts, this article focuses on NSO’s arguments concerning subject-matter jurisdiction. In this regard, NSO relies entirely on the doctrine of foreign sovereign immunity, and this poses a difficult and novel question in international law: can a private company assert state immunity in legal proceedings to which the state is not a party? To answer this, NSO’s arguments will be tested against the United States’ foreign sovereign immunity jurisprudence under the 1976 Foreign Sovereign Immunities Act (FSIA) and the relevant rules of international law.
The Doctrine of State Immunity
Customary international law recognizes that, as sovereign entities, states are entitled to some degree of immunity from suit before foreign courts (ICJ, Germany v Italy, para 78). While the precise boundaries of the rules governing state immunity are contested, most states now follow a “restrictive approach”. According to this view, state immunity applies exclusively to acts carried out by foreign states in the exercise of sovereign functions (acta jure imperii) and cannot be asserted with regard to acts that do not involve the exercise of such functions (acta jure gestionis). This trend, which Italian and Belgian courts initiated at the turn of the 20th century, was endorsed by the United States with the 1952 Tate Letter. In 1976, FSIA confirmed the restrictive doctrine by providing a number of exceptions to state immunity for non-sovereign activities.
Under U.S. law, in Amerada Hess the Supreme Court held that FSIA is “the sole basis for obtaining jurisdiction over a foreign state” (p. 434). A “foreign state” is defined at § 1603(a) of FSIA as the state as well as “a political subdivision of a foreign state or an agency or instrumentality of a foreign state.” States can of course assert immunity before U.S. courts when proceedings are instituted against them in their own name. Yet, in the WhatsApp dispute the parties to the case are two private companies. Under § 1603(b) of FSIA, a separate legal person is considered “an agency or instrumentality of a foreign State” when it is “an organ of a foreign State or a political subdivision thereof, or a majority of [its] shares or other ownership interest is owned by a foreign State or political subdivision thereof.” It is clear that NSO meets none of these requirements: NSO is a privately owned company and there is no indication that it acted as the organ of a particular government.
Derivative State Immunity as Indirect Impleading
NSO argues that, “[t]o the extent [it has] any role in sovereign governments’ use of NSO’s technology,” it is “entitled to derivative sovereign immunity” (pp. 9-10). “Derivative sovereign immunity” is not a term of art in international law, and the FSIA is silent on this issue. In support of its claim, NSO relies principally on the 2000 judgment in Butters v. Vance Intern., Inc., in which a U.S. company was deemed to be entitled to “derivative immunity under the FSIA” for acts carried out following Saudi Arabia’s orders (p. 466). However, it is unclear how this judgment can be reconciled with the 2010 Supreme Court’s decision in Samantar v. Yousef, which clearly states that Congress’ purpose in enacting FSIA was exclusively to codify state immunity, not other sovereign immunities such as the immunity of state officials, which continue to be governed by the common law incorporating international law (p. 322). Indeed, the Samantar ruling looms large given that in the 2014 Republic of Argentina v. NML case, the Supreme Court found that “any sort of immunity defense made by a foreign sovereign in an American court must stand on the [FSIA] text” (pp. 141-142).
There are only two routes by which the existence of a doctrine of “derivative immunity” might be argued before U.S. courts, and in both cases customary international law plays a crucial role in determining the content of this doctrine. The first option is to maintain that, despite the dicta of the Supreme Court, the FSIA implicitly allows private entities to claim immunity on behalf of foreign states. In this case, international law continues to inform the interpretation of this doctrine pursuant to the Charming Betsey canon (“an act of Congress ought never to be construed to violate the law of nations if any other possible construction remains”; p. 118). Alternatively, as the Supreme Court acknowledged, “[e]ven if a suit is not governed by the [FSIA], it may still be barred by foreign sovereign immunity under the common law” (Samantar, p. 324). Thus, if the question of derivative state immunity is deemed to fall outside of the scope of FSIA (the most plausible interpretation), derivative state immunity may still be found in the common law. In this regard, federal common law is deemed to incorporate customary international law and, moreover, respect for customary law on sovereign immunity is arguably required by the Constitution itself (Bellia and Clark, p. 170). However, even if one does not share this view, it has been convincingly demonstrated that “it is likely that CIL will influence judicial assessments of common law immunity claims” (Bradley and Helfer, p. 272).
Looking at customary international law, the concept of “derivative state immunity” invoked by NSO seems to refer to what is known as the “indirect impleading” of foreign states. Under certain circumstances, customary international law permits state immunity to be asserted before a foreign court when the state is not a party to the case but its sovereign rights are nevertheless implicated. Historically, indirect impleading occurred in those situations when state-owned property (usually vessels) was subject to proceedings before a foreign court (UNCSI Commentary, p. 25). In these cases, U.K. and U.S. courts found that state immunity constituted a bar to judicial proceedings because foreign states should not have to choose “between being deprived of property or else submitting to the jurisdiction of the Court” (UNCSI Commentary, p. 25).
That said, customary international law as evidenced by state practice and opinio juris on indirect impleading makes it very difficult for NSO to successfully invoke the doctrine of state immunity.
First, for NSO to claim some form of derivative immunity, at the very least it must identify the state(s) impleaded by the proceedings and to substantiate how their sovereign interests are affected. NSO’s claim that it acts “entirely at the direction of their government customers” does not meet this requirement (p. 10). A court cannot be expected to accept these claims at face value, considering that foreign states remain free to waive their immunity and must be reasonably put in a position to do so (§ 1605(a)(1) FSIA). This places NSO in a difficult position because one of the reasons it is resisting proceedings before U.S. courts is to avoid “revealing national security secrets of foreign countries”.
Second, state practice on indirect impleading largely consists of cases in which sovereign property is affected by foreign court proceedings. This is important in the WhatsApp case because NSO seems to be suggesting that it is intelligence collection as an activity that implicates the sovereign authority of a state – in other words, NSO’s claim does not pertain to a state’s sovereign property.
The International Law Commission attempted to codify indirect impleading in Article (6)(2)(b) of the United Nations Convention on State Immunity 2004 (UNCSI), which reads:
A proceeding before a court of a State shall be considered to have been instituted against another State if that other State:
. . .
(b) is not named as a party to the proceeding but the proceeding in effect seeks to affect the property, rights, interests or activities of that other State.
Ostensibly, Article 6(2)(b) expands the circumstances in which state immunity can be indirectly impleaded before foreign courts – state immunity can be asserted where proceedings affect not just the property of the state but also their “rights, interests or activities”. If indirect impleading is available when proceedings affect the sovereign activities of a state, there is no reason why it cannot in principle apply to intelligence operations. However, UNCSI is not yet in force and there is controversy as to the whether all of its provisions codify customary international law. In fact, in 2017 the UK Supreme Court confirmed that, beyond cases affecting the property interests of foreign states, indirect impleading remains exceptional and is difficult to conceive (Belhaj v Straw; case note by Franchini). This decision was followed in the same year by the High Court of South Africa (“NM Cherry Blossom”), which reached the same conclusion.
Third, even if indirect impleading is available in relation to state activities, this rule applies only when legal proceedings affect the sovereign activities of a foreign state. This conclusion is sound because a private party cannot benefit from state immunity through indirect impleading with regard to activities for which the state itself would not enjoy immunity.
An important question is whether it is an activity’s nature or purpose that determines its sovereign character (Crawford, p. 95). If it is an activity’s nature that is determinative, we must look to whether it relates to the exercise of public authority. By contrast, if the exercise of a sovereign function is identified by an activity’s purpose, we must consider its overall objective — potentially capturing a wider range of activities. The UNCSI provides that in order to determine whether an activity is “commercial” and thus non-sovereign, “its purpose should also be taken into account” (Article 2(2)). Yet, this approach runs counter to state practice, which suggests that “the predominant approach has been to focus upon the nature of the [activity] rather than the purpose” (Shaw, p. 532).
Intelligence operations are a quintessentially sovereign function. For example, espionage against hostile states is a matter of national security and, as such, it constitutes an acta jure imperii. However, there are some circumstances in which it is difficult to argue that intelligence operations possess the imprimatur of sovereign authority. For instance, intelligence operations against foreign companies – which are designed to acquire trade secrets that are then passed to domestic competitors – are activities that are likely to fall outside of the sovereign authority of a state, at least for most states. The United States for example insists that it never uses state apparatus to conduct commercial espionage, but the same may not be true for China. Thus, for NSO to persuade a court that its intelligence operations relate to the performance of a sovereign function, it will have to identify the nature of these operations. As we have already noted, it is unlikely that NSO will be prepared to discuss the specifics of these operations in open court.
Fourth, Article 6(2)(b) UNCSI explains that it is only when proceedings “affect” the sovereign property, rights, interests or activities of a state that the exercise of jurisdiction is precluded. The use of the term “affect” sets the bar low. To give this term its literal definition would mean that proceedings even marginally or tangentially touching upon the exercise of sovereign functions might be covered by state immunity. However, the rule of indirect impleading under customary law is likely to require a much greater impact on a sovereign function (Grant, Chapter 11). For example, the United States has previously pointed out that the terms used by Article 6(2)(b) are “sufficiently expansive to reach many other kinds of cases” and for this reason they required “further consideration” by states before finalizing the text (p. 30).
It stands to reason that, if state immunity applies in all proceeding that have an impact, however remote, on the activities of foreign states, this doctrine would lend itself to abuse as it would block courts from considering the legality of many corporate activities. An expansive reading of indirect impleading is also inconsistent with the current trajectory of state immunity, given that almost all states increasingly qualify this immunity with restrictions and exceptions to ensure an adequate balance between the protection of sovereignty and the individual right of access to a court (for further discussion on the immunity exceptions in FSIA see here and here). Indirect impleading should be therefore kept within strict and clear boundaries.
For the present authors, this doctrine should find application only when a determination of the legal rights and interests of a foreign state not party to the proceedings is a requirement for the court to reach a decision on the merits of the case. If a court is unable to decide a dispute “but for” judging on the rights and interests of foreign states, allowing the court to proceed to the merits would circumvent the rules of state immunity and undermine state sovereignty. However, when the rights and interests of foreign states do not form the subject-matter of the proceedings, the rationale behind state immunity is absent. The outcome of the proceedings do not involve the courts of one state passing judgment on the sovereign rights and interests of another state without its consent. Applying the doctrine of state immunity in this context would therefore unjustifiably deprive the court of its jurisdiction and amount to a denial of justice.
WhatsApp is suing NSO under U.S. law for hacking its customers’ accounts. Thus, it is the legality of these activities, not of the acts of foreign states that are doing business with NSO, that constitutes the subject-matter of the proceedings. To be clear, judicial findings on the legality of NSO’s surveillance operations may very well have implications for foreign states if they directed, profited from, or were otherwise involved in NSO’s activities. However, it is a far cry to say that the WhatsApp case affects the rights and interests of foreign states.
Conclusion
NSO is seeking to bar proceedings before U.S. courts by invoking the doctrine of derivative state immunity. This article has demonstrated that, even if this doctrine is available under U.S. law, when tested against the relevant rules of international law this claim is likely to fail for four main reasons: (i) NSO will not identify from which state(s) it is deriving state immunity, a pre-requisite for indirect impleading; (ii) indirect impleading is usually limited to protecting state property rather than state activities; (iii) the secrecy surrounding NSO’s links with its client-governments means it will be very difficult to persuade the court that the intelligence operations involved the exercise of a sovereign function; and (iv) WhatsApp’s focus on NSO’s intelligence operations means that the sovereign rights and interests of foreign states are not the subject-matter of the lawsuit.