By Jonathan Stempel and Elizabeth Culliford
(Reuters) - A U.S. appeals court said Facebook (NASDAQ:FB) can pursue a lawsuit accusing Israel's NSO Group of exploiting a bug in its WhatsApp messaging app to install malware allowing the surveillance of 1,400 people, including journalists, human rights activists and dissidents.
In a 3-0 decision on Monday, the 9th U.S. Circuit Court of Appeals in San Francisco rejected privately owned NSO's claim it was immune from being sued because it had acted as a foreign government agent.
Facebook, now known as Meta Platforms Inc, sued NSO for an injunction and damages in October 2019, accusing it of accessing WhatsApp servers without permission six months earlier to install its Pegasus malware on victims' mobile devices.
NSO has argued that Pegasus helps law enforcement and intelligence agencies fight crime and protect national security.
It was appealing a trial judge's July 2020 refusal to award it "conduct-based immunity," a common law doctrine protecting foreign officials acting in their official capacity.
Upholding that ruling, Circuit Judge Danielle Forrest said it was an "easy case" because NSO's mere licensing of Pegasus and offering technical support did not shield it from liability under federal law, which took precedence over common law.
"Whatever NSO's government customers do with its technology and services does not render NSO an 'agency or instrumentality of a foreign state,'" Forrest wrote. "Thus, NSO is not entitled to the protection of foreign sovereign immunity."
The case will return to U.S. District Judge Phyllis Hamilton in Oakland, California.
Asked for comment on the decision, NSO said in an email that its technology helps defend the public against serious crime and terrorism, and that it "stands undeterred in its mission."
WhatsApp spokesman Joshua Breckman in an email called the decision "an important step in holding NSO accountable for its attacks against journalists, human rights defenders and government leaders."
Facebook's case drew support from Microsoft Corp (NASDAQ:MSFT), Alphabet (NASDAQ:GOOGL) Inc's Google and Cisco Systems (NASDAQ:CSCO) Corp, which in a court filing called surveillance technology such as Pegasus "powerful, and dangerous."
On Nov. 3, the U.S. government blacklisted NSO and Israel's Candiru for allegedly providing spyware to governments that used it to "maliciously target" journalists, activists and others.
The case is WhatsApp Inc et al v NSO Group Technologies Ltd et al, 9th U.S. Circuit Court of Appeals, No. 20-16408.