Whatsapp Inc. v. Nso Group Technologies Ltd.

FOR PUBLICATION

UNITED STATES COURT OF APPEALS

FOR THE NINTH CIRCUIT

WHATSAPP INC., a Delaware No. 20-16408

corporation; FACEBOOK, INC., a

Delaware corporation, D.C. No.

Plaintiffs-Appellees, 4:19-cv-07123-

PJH

v.

NSO GROUP TECHNOLOGIES OPINION

LIMITED; Q CYBER TECHNOLOGIES

LIMITED,

Defendants-Appellants.

Appeal from the United States District Court

for the Northern District of California

Phyllis J. Hamilton, District Judge, Presiding

Argued and Submitted April 12, 2021

San Francisco, California

Filed November 8, 2021

Before: Mary H. Murguia, Ryan D. Nelson, and

Danielle J. Forrest, Circuit Judges.

Opinion by Judge Forrest

2 WHATSAPP V. NSO GROUP TECHNOLOGIES

SUMMARY *

Foreign Sovereign Immunity

The panel affirmed the district court’s order denying a

private Israeli corporation’s motion to dismiss, based on

foreign sovereign immunity, an action brought under the

Computer Fraud and Abuse Act and California state law.

WhatsApp Inc. and Facebook, Inc., alleged that

defendant, a privately owned and operated Israeli

corporation, sent malware through WhatsApp’s server

system to mobile devices.

The panel held that it had jurisdiction under the collateral

order doctrine to review the district court’s order denying

defendant’s motion to dismiss based on a claim of immunity

from suit.

The panel held that the Foreign Sovereign Immunity Act

occupies the field of foreign sovereign immunity and

categorically forecloses extending immunity to any entity

that falls outside the Act’s broad definition of “foreign

state.” The panel rejected defendant’s argument that it could

claim foreign sovereign immunity under common-law

immunity doctrines that apply to foreign officials. The panel

stated that there was no indication that the Supreme Court in

Samantar v. Yousuf, 560 U.S. 305 (2010), intended to extend

foreign official immunity to entities. Moreover, the FSIA’s

text, purpose, and history demonstrate that Congress

*

This summary constitutes no part of the opinion of the court. It

has been prepared by court staff for the convenience of the reader.

WHATSAPP V. NSO GROUP TECHNOLOGIES 3

displaced common-law sovereign immunity as it relates to

entities. The panel therefore affirmed the district court’s

order.

COUNSEL

Jeffrey S. Bucholtz (argued), King and Spalding LLP,

Washington, D.C.; Matthew V.H. Noller, King and Spalding

LLP, Sacramento, California; Joseph N. Akrotirianakis,

King and Spalding LLP, Los Angeles, California; for

Defendants-Appellants.

Michael R. Dreeben (argued), O’Melveny & Myers LLP,

Washington, D.C.; Yaira Dubin, O’Melveny & Myers LLP,

New York, New York; for Plaintiffs-Appellees.

Mark Parris, Carolyn Frantz, Paul Rugani, and Alyssa

Barnard-Yanni, Orrick Herrington & Sutcliffe LLP, Seattle,

Washington; for Amici Curiae Microsoft Corp., Cicsco

Systems Inc., Github Inc., LinkedIn Corporation, VMWare

Inc., and Internet Association.

Michael Trinh, Google LLC, Mountain View, California, for

Amicus Curiae Google LLC.

Sophia Cope and Andrew Crocker, Electronic Frontier

Foundation, San Francisco, California, for Amicus Curiae

Electronic Frontier Foundation.

Elaine Goldenberg, Munger Tolles & Olson LLP,

Washington, D.C.; Marianna Mao, Munger Tolles & Olson

LLP, San Francisco, California; David Kaye, Irvine,

California; for Amicus Curiae David Kaye.

4 WHATSAPP V. NSO GROUP TECHNOLOGIES

Kyle A. McLorg, Stephanie Skaff, and Deepak Gupta,

Farella Braun & Martel LLP, San Francisco, California, for

Amici Curiae Access Now, Amnesty International,

Committee to Protect Journalists, Internet Freedom

Foundation, Paradigm Initiative, Privacy International, Red

en Defensa de los Derechos Digitales, and Reporters

Without Borders.

Geoffrey M. Klineberg and Bethan R. Jones, Kellogg

Hansen Todd Figel & Frederick PLLC, Washington, D.C.,

for Amicus Curiae Foreign Sovereign Immunity Scholars.

OPINION

FORREST, Circuit Judge:

The question presented is whether foreign sovereign

immunity protects private companies. The law governing

this question has roots extending back to our earliest history

as a nation, and it leads to a simple answer—no. Indeed, the

title of the legal doctrine itself—foreign sovereign

immunity—suggests the outcome.

Plaintiffs-Appellees WhatsApp Inc. and Facebook, Inc.

(collectively WhatsApp) sued Defendants-Appellants NSO

Group Technologies Ltd. and Q Cyber Technologies Ltd.

(collectively NSO), alleging that NSO, a privately owned

and operated Israeli corporation, sent malware through

WhatsApp’s server system to approximately 1,400 mobile

devices, breaking both state and federal law. NSO argues

foreign sovereign immunity protects it from suit and,

therefore, the court lacks subject matter jurisdiction.

Specifically, NSO contends that even if WhatsApp’s

allegations are true, NSO was acting as an agent of a foreign

WHATSAPP V. NSO GROUP TECHNOLOGIES 5

state, entitling it to “conduct-based immunity”—a common-

law doctrine that protects foreign officials acting in their

official capacity.

The district court rejected NSO’s argument, concluding

that common-law foreign official immunity does not protect

NSO from suit in this case. We agree that NSO is not entitled

to immunity in this case, but we reach this conclusion for a

different reason than did the district court. We hold that the

Foreign Sovereign Immunity Act (FSIA or Act) occupies the

field of foreign sovereign immunity as applied to entities and

categorically forecloses extending immunity to any entity

that falls outside the FSIA’s broad definition of “foreign

state.” And we reject NSO’s argument that it can claim

foreign sovereign immunity under common-law immunity

doctrines that apply to foreign officials—i.e., natural

persons. See Samantar v. Yousuf, 560 U.S. 305, 315–16

(2010). There is no indication that the Supreme Court

intended to extend foreign official immunity to entities.

Moreover, the FSIA’s text, purpose, and history demonstrate

that Congress displaced common-law sovereign immunity

doctrine as it relates to entities. See Native Vill. of Kivalina

v. ExxonMobile Corp., 696 F.3d 849, 856 (9th Cir. 2012)

(“Federal common law is subject to the paramount authority

of Congress.”).

I. BACKGROUND

NSO is an Israeli company that designs and licenses

surveillance technology to governments and government

agencies for national security and law enforcement purposes.

One of NSO’s products—a program named Pegasus—

“enables law enforcement and intelligence agencies to

remotely and covertly extract valuable intelligence from

virtually any mobile device.” Pegasus users may intercept

messages, take screenshots, or exfiltrate a device’s contacts

6 WHATSAPP V. NSO GROUP TECHNOLOGIES

or history. NSO claims that it markets and licenses Pegasus

to its customers, 1 which then operate the technology

themselves. According to NSO, its role “is limited to . . .

providing advice and technical support to assist customers in

setting up—not operating—the Pegasus technology.”

WhatsApp provides an encrypted communication

service to the users of its application. Because of its

encryption technology, every type of communication

(telephone calls, video calls, chats, group chats, images,

videos, voice messages, and file transfers) sent using

WhatsApp on a mobile device can be viewed only by the

intended recipient. WhatsApp asserts that NSO used

WhatsApp’s servers without authorization to send

“malicious code” to approximately 1,400 WhatsApp users.

The malicious code was allegedly designed to infect the

targeted devices for the purpose of surveilling the device

users.

In October 2019, WhatsApp sued NSO in federal district

court. WhatsApp asserted claims under the Computer Fraud

and Abuse Act, 18 U.S.C. § 1030, and the California

Comprehensive Computer Data Access and Fraud Act, Cal.

Penal Code § 502, as well as claims for breach of contract

and trespass to chattels. WhatsApp alleged that NSO

intentionally accessed WhatsApp servers without

authorization to figure out how to place Pegasus on

WhatsApp users’ devices without detection. WhatsApp

sought an injunction restraining NSO from accessing

WhatsApp’s servers, violating WhatsApp’s terms, and

1

WhatsApp contends that NSO’s customers are not limited to

foreign governments. Whether this is true or not is immaterial to the

outcome of this case.

WHATSAPP V. NSO GROUP TECHNOLOGIES 7

impairing WhatsApp’s service. WhatsApp also sought

compensatory, statutory, and punitive damages.

NSO moved to dismiss the complaint. As relevant here,

NSO asserted that the court lacked subject matter

jurisdiction because NSO was acting at the direction of its

foreign government customers and is protected from suit

under foreign sovereign immunity. The district court denied

NSO’s motion. Relying on the Restatement (Second) of

Foreign Relations Law § 66, the district court concluded that

NSO was not entitled to common-law conduct-based foreign

sovereign immunity because it failed to show that exercising

jurisdiction over NSO would serve to enforce a rule of law

against a foreign state. This interlocutory appeal followed.

II. DISCUSSION

A. Interlocutory Jurisdiction

As a threshold matter, WhatsApp argues that we lack

jurisdiction over this interlocutory appeal because the

district court’s order is not a final appealable order. “We

review questions of our own jurisdiction de novo.” Hunt v.

Imperial Merch. Servs., Inc., 560 F.3d 1137, 1140 (9th Cir.

2009) (citation omitted).

We have jurisdiction over “final decisions of the district

courts.” 28 U.S.C. § 1291. Under the collateral-order

doctrine, a small class of interlocutory orders qualifies as

“final decisions.” See Cohen v. Beneficial Indus. Loan

Corp., 337 U.S. 541, 545–46 (1949). To be an appealable

collateral order, the decision must “[1] conclusively

determine the disputed question, [2] resolve an important

issue completely separate from the merits of the action, and

[3] be effectively unreviewable on appeal from a final

judgment.” P.R. Aqueduct & Sewer Auth. v. Metcalf & Eddy,

8 WHATSAPP V. NSO GROUP TECHNOLOGIES

Inc., 506 U.S. 139, 144 (1993) (citation omitted). WhatsApp

contests only the third element—that the order is effectively

unreviewable after final judgment.

A common example of an immediately appealable

collateral order that is effectively unreviewable after final

judgment is an interlocutory denial of certain immunities

from suit. SolarCity Corp. v. Salt River Project Agric.

Improvement & Power Dist., 859 F.3d 720, 725 (9th Cir.

2017) (noting that the “Supreme Court has allowed

immediate appeals from” interlocutory denials of Eleventh

Amendment immunity, absolute and qualified immunity,

foreign sovereign immunity, and tribal sovereign immunity).

In contrast, denials of a “defense to liability” are not

immediately appealable final orders. Id. at 725–26

(explaining that “[u]nlike immunity from suit, immunity

from liability can be protected by a post-judgment appeal”

and “therefore do[es] not meet the requirements for

immediate appeal under the collateral-order doctrine”).

The parties dispute whether common-law conduct-based

foreign official immunity is an immunity from suit, entitling

it to an interlocutory appeal, or a defense to liability that can

only be appealed post-judgment. But all agree that foreign

state sovereign immunity, now codified in the FSIA, is an

immunity from suit and that an order denying a foreign

state’s claim of sovereign immunity is immediately

appealable. Compania Mexicana de Aviacion, S.A. v. U.S.

Dist. Ct., 859 F.2d 1354, 1358 (9th Cir. 1988). Because we

conclude that the FSIA governs NSO’s claim of immunity,

we have jurisdiction over this appeal under the collateral-

order doctrine.

WHATSAPP V. NSO GROUP TECHNOLOGIES 9

B. Foreign Sovereign Immunity

1. Origins of the Doctrine

Chief Justice John Marshall’s opinion in Schooner

Exchange v. McFadden, 7 Cranch 116; 3 L. Ed. 287 (1812),

is credited with establishing foreign sovereign immunity in

American law. See Opati v. Republic of Sudan, 140 S. Ct.

1601, 1605 (2020); see also Schooner Exchange, 7 Cranch

at 136 (noting the Court was “exploring an unbeaten path,

with few, if any, aids from precedents or written law”).

Writing for the Court, he reasoned that a nation’s jurisdiction

within its own boundaries is “exclusive and absolute” and

any limitations on such jurisdiction “must be traced up to the

consent of the nation itself. They can flow from no other

legitimate source.” Schooner Exchange, 7 Cranch at 136.

Chief Justice Marshall further explained that respecting, and

claiming, the “perfect equality and absolute independence of

sovereigns,” the nations of the world have “wave[d] the

exercise of a part of that complete exclusive territorial

jurisdiction” in cases brought within their jurisdiction

against a foreign sovereign and ministers of a foreign

sovereign. Id. at 137–39; Republic of Austria v. Altmann,

541 U.S. 677, 688 & n.9 (2004).

From this origin—described as “the classical or virtually

absolute theory of sovereign immunity,” Permanent Mission

of India to the U.N. v. City of New York, 551 U.S. 193, 199

(2007) (internal quotation marks and citation omitted)—

“[t]he doctrine of foreign sovereign immunity developed as

a matter of common law.” Samantar, 560 U.S. at 311.

During our early years as a country, the State Department

took the lead in applying foreign sovereign immunity. Id.;

see also Br. of Foreign Sovereign Immunity Scholars, 4–7,

No. 20-16408. Essentially, when faced with an immunity

claim brought by a foreign state or official, if the State

10 WHATSAPP V. NSO GROUP TECHNOLOGIES

Department suggested immunity, a court would acquiesce.

Samantar, 560 U.S. at 311–12. And if the State Department

did not suggest immunity, the court’s inquiry consisted of

asking whether the State Department had a policy for

recognizing sovereign immunity in similar circumstances.

Id. So, the State Department, not the courts, was the primary

arbiter of foreign sovereign immunity. And the State

Department’s general practice was to suggest immunity “in

all actions against friendly sovereigns.” Id. at 312.

2. The Foreign Sovereign Immunity Act

In the early 1950s, the State Department abandoned the

absolute theory of foreign sovereign immunity and “join[ed]

the majority of other countries by adopting the ‘restrictive

theory’ of sovereign immunity.” Permanent Mission of India

to the U.N., 551 U.S. at 199. Under this theory, foreign

sovereign “‘immunity is confined to suits involving the

foreign sovereign’s public acts, and does not extend to cases

arising out of a foreign state’s strictly commercial acts.’”

Samantar, 560 U.S. at 312 (quoting Verlinden B.V. v. Cent.

Bank of Nigeria, 461 U.S. 480, 487 (1983)). Congress

recognized that “[u]nder international law, states are not

immune from the jurisdiction of foreign courts insofar as

their commercial activities are concerned.” 28 U.S.C.

§ 1602. Unsurprisingly, the politics of international

diplomacy, at times, caused the State Department to suggest

granting immunity in cases where its new, restrictive theory

would have dictated denial. Samantar, 560 U.S. at 312;

Verlinden B.V., 461 U.S. at 487. Inconsistent outcomes also

occurred depending on whether an immunity claim was

presented to the State Department or a court. Verlinden B.V.,

461 U.S. at 487–88.

Congress disapproved of this inconsistency and enacted

the FSIA to promote uniformity. Samantar, 560 U.S. at 313.

WHATSAPP V. NSO GROUP TECHNOLOGIES 11

As the Act explains, its purpose was twofold: (1) “endorse

and codify the restrictive theory of sovereign immunity” that

existed under international law, and (2) “transfer primary

responsibility for deciding claims of foreign states to

immunity from the State Department to the courts.” Id.

(internal quotation marks omitted); 28 U.S.C. § 1602. In

Congress’s view, placing the responsibility for deciding

foreign sovereign immunity claims with courts “would serve

the interests of justice and would protect the rights of both

foreign states and litigants in the United States courts.”

28 U.S.C. § 1602. And so, immunity determinations were no

longer made in the Secretary’s office but a courtroom.

The Supreme Court has addressed the purpose and scope

of the FSIA on multiple occasions. In Verlinden B.V., the

Court addressed whether the FSIA exceeded the scope of

Article III of the Constitution and concluded that the FSIA

“contains a comprehensive set of legal standards governing

claims of immunity in every civil action against a foreign

state or its political subdivisions, agencies or

instrumentalities.” 461 U.S. at 488. Likewise, in Republic of

Austria, the Court considered whether the FSIA governed

pre-enactment conduct and stated that the FSIA “established

a comprehensive framework for resolving any claim of

sovereign immunity.” 541 U.S. at 699 (emphasis added). Six

years later, the Court addressed whether a foreign official

comes within the FSIA’s definition of “foreign state” and is,

therefore, subject to the Act. Samantar, 560 U.S. at 313–14.

Backing away from its prior expansive pronouncements

concerning the scope of the FSIA, the Court interpreted the

Act’s definition of “foreign state” as not including individual

foreign officials seeking immunity. Id. at 315–20. But the

Court reiterated that the FSIA does govern the immunity of

foreign state entities: “The FSIA was adopted . . . to address

a modern world where foreign state enterprises are every day

12 WHATSAPP V. NSO GROUP TECHNOLOGIES

participants in commercial activities, and to assure litigants

that decisions regarding claims against states and their

enterprises are made purely on legal grounds.” Id. at 323

(emphasis added) (internal quotation marks and citation

omitted). Considering that foreign sovereign immunity cases

involving foreign officials were “few and far between” prior

to the FSIA’s enactment, the Court’s initial expansive

pronouncements concerning the scope of the Act are not

surprising. Id.

For purposes of resolving the present case, it is worth

retracing the Court’s interpretative analysis in Samantar.

The FSIA established that “‘a foreign state shall be immune

from the jurisdiction of the courts of the United States and

of the States’ except as provided in the Act.” Id. at 313

(quoting 28 U.S.C. § 1604). Where it applies, the FSIA takes

the entire field regarding application of immunity. If a party

seeking immunity is a “foreign state,” as defined in the Act,

the FSIA “is the sole basis for obtaining jurisdiction” over

that party. Id. at 314 (internal quotation marks and citation

omitted). In such a case, it is improper for courts to consider

common-law principles. Native Vill. of Kivalina, 696 F.3d at

856 (“[W]hen federal statutes directly answer the federal

question, federal common law does not provide a remedy

because legislative action has displaced the common law.”).

While “foreign state” could be defined as including only “a

body politic that governs a particular territory,” Congress

defined it more broadly. Samantar, 560 U.S. at 314. Under

the FSIA, “foreign state” includes a body politic, as well as

its “political subdivisions, agencies, and instrumentalities.”

Id.; 28 U.S.C. § 1603(a). And “agency or instrumentality” is

defined to include “any entity [that] is a separate legal

person, corporate or otherwise and . . . which is an organ of

a foreign state or political subdivision thereof, or a majority

of whose shares or other ownership interest is owned by a

WHATSAPP V. NSO GROUP TECHNOLOGIES 13

foreign state or political subdivision thereof.” 28 U.S.C.

§ 1603(b) (emphasis added); Samantar, 560 U.S. at 316

(“Congress had corporate formalities in mind.”); see also

EIE Guam Corp. v. Long Term Credit Bank of Japan, Ltd.,

322 F.3d 635, 640 (9th Cir. 2003) (noting that an entity can

be an organ of a foreign state even if it is involved in some

commercial affairs). Given these defined terms, and the

absence of any reference to individual foreign officials, 2 the

Supreme Court held that Congress did not intend for the

FSIA to govern immunity of foreign officials in part because

“the types of defendants listed [in the FSIA] are all entities.”

Samantar, 560 U.S. at 317 (emphasis added).

3. Foreign Sovereign Immunity & Private Entities

Neither the Supreme Court nor this Court has answered

whether an entity that does not qualify as a “foreign state”

can claim foreign sovereign immunity under the common

law. It is clear under existing precedent that such an entity

cannot seek immunity under the FSIA. Whether such entity

can sidestep the FSIA hinges on whether the Act took the

entire field of foreign sovereign immunity as applied to

entities, or whether it took the field only as applied to foreign

state entities, as NSO suggests. The answer lies in the

question. The idea that foreign sovereign immunity could

2

We recognize that the FSIA literally includes “person” in the

definition of “agency or instrumentality,” but as the Supreme Court has

explained, the phrase “separate legal person, corporate or otherwise” in

§ 1603(b)(1) “typically refers to the legal fiction that allows an entity to

hold personhood separate from the natural persons who are its

shareholders or officers.” Samantar, 560 U.S. at 315. “It is similarly

awkward to refer to a person as an ‘organ’ of the foreign state . . . . [And]

the terms Congress chose simply do not evidence the intent to include

individual officials within the meaning of ‘agency or instrumentality.’”

Id. at 315–16.

14 WHATSAPP V. NSO GROUP TECHNOLOGIES

apply to non-state entities is contrary to the originating and

foundational premise of this immunity doctrine. Moreover,

there is no indication that Congress, in codifying the

restrictive theory of foreign sovereign immunity to promote

uniformity and ensure that immunity decisions are based on

law rather than politics, intended to exempt an entire

category of entities from its “comprehensive” regime. See 28

U.S.C. § 1603(b); Republic of Austria, 541 U.S. at 699.

While the FSIA was silent about immunity for individual

officials, that is not true for entities—quite the opposite.

Thus, we hold that an entity is entitled to foreign sovereign

immunity, if at all, only under the FSIA. If an entity does not

fall within the Act’s definition of “foreign state,” it cannot

claim foreign sovereign immunity. Period.

Before diving into the details, we go back to the

beginning. Chief Justice Marshall explained that foreign

sovereign immunity arises from the recognition of the

“perfect equality and absolute independence of sovereigns.”

Schooner Exchange, 7 Cranch at 137. We give sovereign

immunity to other nations as an act of “grace and comity,”

Verlinden B.V., 461 U.S. at 486, so they will do the same for

us. This cooperative acknowledgement that each nation has

equal autonomy and authority promotes exchange and good

relationships between nations. See Schooner Exchange,

7 Cranch at 137; see also Siderman de Blake v. Republic of

Argentina, 965 F.2d 699, 718 (9th Cir. 1992) (quoting Chief

Justice Marshall’s discussion of the origins of sovereign

immunity); Butters v. Vance Int’l, Inc., 225 F.3d 462, 465

(4th Cir. 2000) (“[Sovereign] acts often have political,

cultural, and religious components. Judicial interference

with them would have serious foreign policy ramifications

for the United States.”). None of the purposes for

recognizing foreign sovereign immunity are served by

granting immunity to entities and actors that are neither

WHATSAPP V. NSO GROUP TECHNOLOGIES 15

sovereigns themselves nor are not acting on behalf of a

sovereign. Again, the very name of the doctrine—foreign

sovereign immunity—reflects this truth. Congress did not

displace this foundational premise when it enacted the FSIA.

See Samantar, 560 U.S. at 320 n.13 (“Congress is

understood to legislate against a background of common-law

. . . principles” (omission in original) (internal quotation

marks and citation omitted)).

As noted above, Congress could have limited the FSIA’s

reach to only “a body politic that governs a particular

territory.” Id. at 314. It did not. It expanded the FSIA’s reach

to “any entity [that] is a separate legal person, corporate or

otherwise and . . . which is an organ of a foreign state or

political subdivision thereof, or a majority of whose shares

or other ownership interest is owned by a foreign state of

political subdivision thereof.” 28 U.S.C. § 1603(b)

(emphasis added). In defining what qualifies as a “foreign

state,” the FSIA necessarily defines the scope of foreign

sovereign immunity. An entity must be a sovereign or must

have a sufficient relationship to a sovereign to claim

sovereign-based immunity. Without such status or

relationship, there is no justification for granting sovereign

immunity. It is odd indeed to think that by not including a

category of entity within its definition of “foreign state,”

Congress intended for such entities to have the ability to seek

immunity outside its “comprehensive” statutory scheme. See

Republic of Austria, 541 U.S. at 699.

This reasoning is supported by the expressio unius

exclusio alterius 3 interpretive canon. In creating a

“comprehensive set of legal standards governing claims of

immunity . . . against a foreign state or its political

3

The expression of one thing implies the exclusion of another.

16 WHATSAPP V. NSO GROUP TECHNOLOGIES

subdivisions, agencies or instrumentalities,” Verlinden B.V.,

461 U.S. at 488, Congress defined the types of foreign

entities—including, specifically, foreign corporate

entities —that may claim immunity. 28 U.S.C. § 1603(b).

4

The most reasonable interpretation then is that the definition

of “foreign state” forecloses immunity for any entity falling

outside such definition, particularly where “foreign state” is

defined broadly. 5 See Pfizer, Inc. v. Gov’t of India, 434 U.S.

308, 312–13 (1978) (noting that expansive statutory

language matched the underlying statute’s comprehensive

nature); Ingersoll-Rand Co. v. McClendon, 498 U.S. 133,

138–39 (1990) (explaining that defining a term broadly

underscored Congress’s intent that the underlying statutory

term be expansively applied). And the Supreme Court’s

holding in Samantar that individual foreign officials are not

subject to the FSIA does not defeat this interpretation

because, as the Court explained, the FSIA did not address, at

4

The Supreme Court has recognized that in enacting the FSIA,

“Congress was aware of settled principles of corporate law and legislated

within that context.” Dole Food Co. v. Patrickson, 538 U.S. 468, 474

(2003).

5

The D.C. Circuit recently relied on the common law in denying

foreign sovereign immunity to three United States citizens and a United

States limited liability corporation. Broidy Cap. Mgmt. LLC v. Muzin,

12 F.4th 789, 798 (D.C. Cir. 2021). When summarizing Samantar, the

court presumed without explanation that the common law applied to

“private entities or individuals.” Id. at 802. Unlike here, the parties in

Broidy agreed that the FSIA did not apply; the defendants made only

common-law arguments, and the defendant-entity was domestic, not

foreign. Id. at 792; see also NML Cap., Ltd., 573 U.S. at 142. The D.C.

Circuit did not make an explicit finding that foreign sovereign immunity

claims from foreign private entities should be analyzed under the

common law, and it did not explain its summary assertion that a private

entity can seek immunity under the common law despite the FSIA. See

Broidy, 12 F.4th at 802.

WHATSAPP V. NSO GROUP TECHNOLOGIES 17

all, immunity for individuals or natural persons. 560 U.S.

at 319 (“Reading the FSIA as a whole, there is nothing to

suggest we should read ‘foreign state’ in § 1603(a) to include

an official acting on behalf of the foreign state, and much to

indicate that this meaning was not what Congress enacted.”).

Moreover, the Act’s definition of “foreign state” cannot

be divorced from the context that “[t]he FSIA was adopted

. . . to address a modern world where foreign state

enterprises are every day participants in commercial

activities.” Id. at 323 (emphasis added) (internal quotation

marks and citation omitted). Congress prohibited applying

foreign sovereign immunity to “strictly commercial acts.”

Id. at 312. So, a plaintiff who can show that a foreign

entity—even a direct sovereign like the Welsh

Government—was engaged in “a regular course of

commercial conduct or a particular commercial transaction

or act,” 28 U.S.C. § 1603(d), may defeat a claim of

immunity, see Pablo Star Ltd. v. Welsh Gov’t, 961 F.3d 555,

560 (2d Cir. 2020), cert. denied, 141 S. Ct. 1069 (2021);

28 U.S.C. § 1605(a)(2). It makes little sense to conclude that

the FSIA leaves open the possibility that a corporate entity

less connected to a sovereign than those meeting the

statutory definition of “foreign state” could seek immunity

for commercial conduct under a different immunity doctrine

while entities more connected to a sovereign—even a body

politic itself—could not. Especially where the other

immunity doctrine proffered, foreign official immunity, is as

narrowly focused on natural persons as the FSIA is broadly

focused on entities. See Samantar, 560 U.S. at 323 (finding

“no reason to believe that Congress saw as a problem, or

wanted to eliminate, the State Department’s role in

determinations regarding individual official immunity.”).

Instead, the omission of entities like NSO from the FSIA’s

definition of foreign states and their “political subdivisions,

18 WHATSAPP V. NSO GROUP TECHNOLOGIES

agencies, and instrumentalities” reflects a threshold

determination about the availability of foreign sovereign

immunity for such entities: they never qualify. 6

4. NSO’s Foreign Sovereign Immunity Claim

Concluding that the FSIA governs all foreign sovereign

immunity claims brought by entities, as opposed to

individuals, makes this an easy case. NSO is a private

corporation that designs spyware technology used by

governments for law enforcement purposes. According to

NSO, its Pegasus technology is a program that was

“marketed only to and used only by sovereign governments”

and it allowed those governments “to intercept messages,

take screenshots, or exfiltrate a device’s contacts or

history.” 7 NSO’s clients choose how and when to use

Pegasus, not NSO. NSO simply licenses the technology and

provides “advice and technical support” at its customers’

direction.

NSO does not contend that it meets the FSIA’s definition

of “foreign state,” and, of course, it cannot. It is not itself a

sovereign. 28 U.S.C. § 1603(a). It is not “an organ . . . or

6

In Butters, the Fourth Circuit extended the doctrine of domestic

derivative sovereign immunity, applicable to United States contractors,

to a United States corporation acting as an agent of a foreign state.

225 F.3d at 466. Butters did not discuss whether this common-law

doctrine also extends to foreign contractors acting on behalf of foreign

states. In any event, it is unclear what remains of such reasoning where

the Supreme Court has instructed that “any sort of immunity defense

made by a foreign sovereign in an American court must stand on the

Act’s text. Or it must fall.” Republic of Argentina v. NML Cap., Ltd.,

573 U.S. 134, 142 (2014).

7

NSO alleges that its customers include the Kingdom of Bahrain,

the United Arab Emirates, and Mexico.

WHATSAPP V. NSO GROUP TECHNOLOGIES 19

political subdivision” of a sovereign. Id. § 1603(b)(2). Nor

is a foreign sovereign its majority owner. Id. NSO is a

private corporation that provides products and services to

sovereigns—several of them. NSO claims that it should

enjoy the immunity extended to sovereigns because it

provides technology used for law-enforcement purposes and

law enforcement is an inherently sovereign function.

Whatever NSO’s government customers do with its

technology and services does not render NSO an “agency or

instrumentality of a foreign state,” as Congress has defined

that term. Thus, NSO is not entitled to the protection of

foreign sovereign immunity. And that is the end of our task.

There is no need to analyze whether NSO is entitled to

immunity under the common law and inquire how the State

Department would resolve this case. See WhatsApp Inc. v.

NSO Grp. Techs. Ltd., 472 F. Supp. 3d 649, 665 (N.D. Cal.

2020). Nor is it necessary to explain that neither the State

Department nor any court has ever applied foreign official

immunity to a foreign private corporation under the common

law, although this is a compelling fact indeed. 8 The proper

analysis begins and ends with the FSIA, the comprehensive

framework Congress enacted for resolving any entity’s

8

There is not a single documented instance of the State Department

recommending conduct-based immunity for a foreign private

corporation. See, e.g., Digest of U.S. Practice in International Law 2020,

at 403–09 (CarrieLyn D. Guymon, ed.); Digest of U.S. Practice in

International Law 2019, at 344–55 (CarrieLyn D. Guymon, ed.); Digest

of U.S. Practice in International Law 2018, at 410–13 (CarrieLyn D.

Guymon, ed.); Digest of U.S. Practice in International Law 2017, at 444–

55 (CarrieLyn D. Guymon, ed.); Digest of U.S. Practice in International

Law 2016, at 450–61 (CarrieLyn D. Guymon, ed.). Nor have we found

any case contemplating the same.

20 WHATSAPP V. NSO GROUP TECHNOLOGIES

claim of foreign sovereign immunity. See Republic of

Austria, 541 U.S. at 699; Samantar, 560 U.S. at 319.

AFFIRMED.