Whatsapp Inc. v. Nso Group Technologies Ltd.

17 F.4th 930

• Court: Court of Appeals for the Ninth Circuit
• Decided: November 8, 2021
• Docket: 20-16408
• Status: Published

Opinion

FOR PUBLICATION

UNITED STATES COURT OF APPEALS FOR THE NINTH CIRCUIT

WHATSAPP INC., a Delaware No. 20-16408 corporation; FACEBOOK, INC., a Delaware corporation, D.C. No. Plaintiffs-Appellees, 4:19-cv-07123- PJH v.

NSO GROUP TECHNOLOGIES OPINION LIMITED; Q CYBER TECHNOLOGIES LIMITED, Defendants-Appellants.

Appeal from the United States District Court for the Northern District of California Phyllis J. Hamilton, District Judge, Presiding

Argued and Submitted April 12, 2021 San Francisco, California

Filed November 8, 2021

Before: Mary H. Murguia, Ryan D. Nelson, and Danielle J. Forrest, Circuit Judges.

Opinion by Judge Forrest 2 WHATSAPP V. NSO GROUP TECHNOLOGIES

SUMMARY *

Foreign Sovereign Immunity

The panel affirmed the district court’s order denying a private Israeli corporation’s motion to dismiss, based on foreign sovereign immunity, an action brought under the Computer Fraud and Abuse Act and California state law.

WhatsApp Inc. and Facebook, Inc., alleged that defendant, a privately owned and operated Israeli corporation, sent malware through WhatsApp’s server system to mobile devices.

The panel held that it had jurisdiction under the collateral order doctrine to review the district court’s order denying defendant’s motion to dismiss based on a claim of immunity from suit.

The panel held that the Foreign Sovereign Immunity Act occupies the field of foreign sovereign immunity and categorically forecloses extending immunity to any entity that falls outside the Act’s broad definition of “foreign state.” The panel rejected defendant’s argument that it could claim foreign sovereign immunity under common-law immunity doctrines that apply to foreign officials. The panel stated that there was no indication that the Supreme Court in Samantar v. Yousuf, 560 U.S. 305 (2010), intended to extend foreign official immunity to entities. Moreover, the FSIA’s text, purpose, and history demonstrate that Congress

* This summary constitutes no part of the opinion of the court. It has been prepared by court staff for the convenience of the reader. WHATSAPP V. NSO GROUP TECHNOLOGIES 3

displaced common-law sovereign immunity as it relates to entities. The panel therefore affirmed the district court’s order.

COUNSEL

Jeffrey S. Bucholtz (argued), King and Spalding LLP, Washington, D.C.; Matthew V.H. Noller, King and Spalding LLP, Sacramento, California; Joseph N. Akrotirianakis, King and Spalding LLP, Los Angeles, California; for Defendants-Appellants.

Michael R. Dreeben (argued), O’Melveny & Myers LLP, Washington, D.C.; Yaira Dubin, O’Melveny & Myers LLP, New York, New York; for Plaintiffs-Appellees.

Mark Parris, Carolyn Frantz, Paul Rugani, and Alyssa Barnard-Yanni, Orrick Herrington & Sutcliffe LLP, Seattle, Washington; for Amici Curiae Microsoft Corp., Cicsco Systems Inc., Github Inc., LinkedIn Corporation, VMWare Inc., and Internet Association.

Michael Trinh, Google LLC, Mountain View, California, for Amicus Curiae Google LLC.

Sophia Cope and Andrew Crocker, Electronic Frontier Foundation, San Francisco, California, for Amicus Curiae Electronic Frontier Foundation.

Elaine Goldenberg, Munger Tolles & Olson LLP, Washington, D.C.; Marianna Mao, Munger Tolles & Olson LLP, San Francisco, California; David Kaye, Irvine, California; for Amicus Curiae David Kaye. 4 WHATSAPP V. NSO GROUP TECHNOLOGIES

Kyle A. McLorg, Stephanie Skaff, and Deepak Gupta, Farella Braun & Martel LLP, San Francisco, California, for Amici Curiae Access Now, Amnesty International, Committee to Protect Journalists, Internet Freedom Foundation, Paradigm Initiative, Privacy International, Red en Defensa de los Derechos Digitales, and Reporters Without Borders.

Geoffrey M. Klineberg and Bethan R. Jones, Kellogg Hansen Todd Figel & Frederick PLLC, Washington, D.C., for Amicus Curiae Foreign Sovereign Immunity Scholars.

OPINION

FORREST, Circuit Judge:

The question presented is whether foreign sovereign immunity protects private companies. The law governing this question has roots extending back to our earliest history as a nation, and it leads to a simple answer—no. Indeed, the title of the legal doctrine itself—foreign sovereign immunity—suggests the outcome.

Plaintiffs-Appellees WhatsApp Inc. and Facebook, Inc. (collectively WhatsApp) sued Defendants-Appellants NSO Group Technologies Ltd. and Q Cyber Technologies Ltd. (collectively NSO), alleging that NSO, a privately owned and operated Israeli corporation, sent malware through WhatsApp’s server system to approximately 1,400 mobile devices, breaking both state and federal law. NSO argues foreign sovereign immunity protects it from suit and, therefore, the court lacks subject matter jurisdiction. Specifically, NSO contends that even if WhatsApp’s allegations are true, NSO was acting as an agent of a foreign WHATSAPP V. NSO GROUP TECHNOLOGIES 5

state, entitling it to “conduct-based immunity”—a common- law doctrine that protects foreign officials acting in their official capacity.

The district court rejected NSO’s argument, concluding that common-law foreign official immunity does not protect NSO from suit in this case. We agree that NSO is not entitled to immunity in this case, but we reach this conclusion for a different reason than did the district court. We hold that the Foreign Sovereign Immunity Act (FSIA or Act) occupies the field of foreign sovereign immunity as applied to entities and categorically forecloses extending immunity to any entity that falls outside the FSIA’s broad definition of “foreign state.” And we reject NSO’s argument that it can claim foreign sovereign immunity under common-law immunity doctrines that apply to foreign officials—i.e., natural persons. See Samantar v. Yousuf, 560 U.S. 305, 315–16 (2010). There is no indication that the Supreme Court intended to extend foreign official immunity to entities. Moreover, the FSIA’s text, purpose, and history demonstrate that Congress displaced common-law sovereign immunity doctrine as it relates to entities. See Native Vill. of Kivalina v. ExxonMobile Corp., 696 F.3d 849, 856 (9th Cir. 2012) (“Federal common law is subject to the paramount authority of Congress.”).

I. BACKGROUND

NSO is an Israeli company that designs and licenses surveillance technology to governments and government agencies for national security and law enforcement purposes. One of NSO’s products—a program named Pegasus— “enables law enforcement and intelligence agencies to remotely and covertly extract valuable intelligence from virtually any mobile device.” Pegasus users may intercept messages, take screenshots, or exfiltrate a device’s contacts 6 WHATSAPP V. NSO GROUP TECHNOLOGIES

or history. NSO claims that it markets and licenses Pegasus to its customers, 1 which then operate the technology themselves. According to NSO, its role “is limited to . . . providing advice and technical support to assist customers in setting up—not operating—the Pegasus technology.”

WhatsApp provides an encrypted communication service to the users of its application. Because of its encryption technology, every type of communication (telephone calls, video calls, chats, group chats, images, videos, voice messages, and file transfers) sent using WhatsApp on a mobile device can be viewed only by the intended recipient. WhatsApp asserts that NSO used WhatsApp’s servers without authorization to send “malicious code” to approximately 1,400 WhatsApp users. The malicious code was allegedly designed to infect the targeted devices for the purpose of surveilling the device users.

In October 2019, WhatsApp sued NSO in federal district court. WhatsApp asserted claims under the Computer Fraud and Abuse Act, 18 U.S.C. § 1030, and the California Comprehensive Computer Data Access and Fraud Act, Cal. Penal Code § 502, as well as claims for breach of contract and trespass to chattels. WhatsApp alleged that NSO intentionally accessed WhatsApp servers without authorization to figure out how to place Pegasus on WhatsApp users’ devices without detection. WhatsApp sought an injunction restraining NSO from accessing WhatsApp’s servers, violating WhatsApp’s terms, and

1 WhatsApp contends that NSO’s customers are not limited to foreign governments. Whether this is true or not is immaterial to the outcome of this case. WHATSAPP V. NSO GROUP TECHNOLOGIES 7

impairing WhatsApp’s service. WhatsApp also sought compensatory, statutory, and punitive damages.

NSO moved to dismiss the complaint. As relevant here, NSO asserted that the court lacked subject matter jurisdiction because NSO was acting at the direction of its foreign government customers and is protected from suit under foreign sovereign immunity. The district court denied NSO’s motion. Relying on the Restatement (Second) of Foreign Relations Law § 66, the district court concluded that NSO was not entitled to common-law conduct-based foreign sovereign immunity because it failed to show that exercising jurisdiction over NSO would serve to enforce a rule of law against a foreign state. This interlocutory appeal followed.

II. DISCUSSION

A. Interlocutory Jurisdiction

As a threshold matter, WhatsApp argues that we lack jurisdiction over this interlocutory appeal because the district court’s order is not a final appealable order. “We review questions of our own jurisdiction de novo.” Hunt v. Imperial Merch. Servs., Inc., 560 F.3d 1137, 1140 (9th Cir. 2009) (citation omitted).

We have jurisdiction over “final decisions of the district courts.” 28 U.S.C. § 1291. Under the collateral-order doctrine, a small class of interlocutory orders qualifies as “final decisions.” See Cohen v. Beneficial Indus. Loan Corp., 337 U.S. 541, 545–46 (1949). To be an appealable collateral order, the decision must “[1] conclusively determine the disputed question, [2] resolve an important issue completely separate from the merits of the action, and [3] be effectively unreviewable on appeal from a final judgment.” P.R. Aqueduct & Sewer Auth. v. Metcalf & Eddy, 8 WHATSAPP V. NSO GROUP TECHNOLOGIES

Inc., 506 U.S. 139, 144 (1993) (citation omitted). WhatsApp contests only the third element—that the order is effectively unreviewable after final judgment.

A common example of an immediately appealable collateral order that is effectively unreviewable after final judgment is an interlocutory denial of certain immunities from suit. SolarCity Corp. v. Salt River Project Agric. Improvement & Power Dist., 859 F.3d 720, 725 (9th Cir. 2017) (noting that the “Supreme Court has allowed immediate appeals from” interlocutory denials of Eleventh Amendment immunity, absolute and qualified immunity, foreign sovereign immunity, and tribal sovereign immunity). In contrast, denials of a “defense to liability” are not immediately appealable final orders. Id. at 725–26 (explaining that “[u]nlike immunity from suit, immunity from liability can be protected by a post-judgment appeal” and “therefore do[es] not meet the requirements for immediate appeal under the collateral-order doctrine”).

The parties dispute whether common-law conduct-based foreign official immunity is an immunity from suit, entitling it to an interlocutory appeal, or a defense to liability that can only be appealed post-judgment. But all agree that foreign state sovereign immunity, now codified in the FSIA, is an immunity from suit and that an order denying a foreign state’s claim of sovereign immunity is immediately appealable. Compania Mexicana de Aviacion, S.A. v. U.S. Dist. Ct., 859 F.2d 1354, 1358 (9th Cir. 1988). Because we conclude that the FSIA governs NSO’s claim of immunity, we have jurisdiction over this appeal under the collateral- order doctrine. WHATSAPP V. NSO GROUP TECHNOLOGIES 9

B. Foreign Sovereign Immunity

1. Origins of the Doctrine

Chief Justice John Marshall’s opinion in Schooner Exchange v. McFadden, 7 Cranch 116; 3 L. Ed. 287 (1812), is credited with establishing foreign sovereign immunity in American law. See Opati v. Republic of Sudan, 140 S. Ct. 1601, 1605 (2020); see also Schooner Exchange, 7 Cranch at 136 (noting the Court was “exploring an unbeaten path, with few, if any, aids from precedents or written law”). Writing for the Court, he reasoned that a nation’s jurisdiction within its own boundaries is “exclusive and absolute” and any limitations on such jurisdiction “must be traced up to the consent of the nation itself. They can flow from no other legitimate source.” Schooner Exchange, 7 Cranch at 136. Chief Justice Marshall further explained that respecting, and claiming, the “perfect equality and absolute independence of sovereigns,” the nations of the world have “wave[d] the exercise of a part of that complete exclusive territorial jurisdiction” in cases brought within their jurisdiction against a foreign sovereign and ministers of a foreign sovereign. Id. at 137–39; Republic of Austria v. Altmann, 541 U.S. 677, 688 & n.9 (2004).

From this origin—described as “the classical or virtually absolute theory of sovereign immunity,” Permanent Mission of India to the U.N. v. City of New York, 551 U.S. 193, 199 (2007) (internal quotation marks and citation omitted)— “[t]he doctrine of foreign sovereign immunity developed as a matter of common law.” Samantar, 560 U.S. at 311. During our early years as a country, the State Department took the lead in applying foreign sovereign immunity. Id.; see also Br. of Foreign Sovereign Immunity Scholars, 4–7, No. 20-16408. Essentially, when faced with an immunity claim brought by a foreign state or official, if the State 10 WHATSAPP V. NSO GROUP TECHNOLOGIES

Department suggested immunity, a court would acquiesce. Samantar, 560 U.S. at 311–12. And if the State Department did not suggest immunity, the court’s inquiry consisted of asking whether the State Department had a policy for recognizing sovereign immunity in similar circumstances. Id. So, the State Department, not the courts, was the primary arbiter of foreign sovereign immunity. And the State Department’s general practice was to suggest immunity “in all actions against friendly sovereigns.” Id. at 312.

2. The Foreign Sovereign Immunity Act

In the early 1950s, the State Department abandoned the absolute theory of foreign sovereign immunity and “join[ed] the majority of other countries by adopting the ‘restrictive theory’ of sovereign immunity.” Permanent Mission of India to the U.N., 551 U.S. at 199. Under this theory, foreign sovereign “‘immunity is confined to suits involving the foreign sovereign’s public acts, and does not extend to cases arising out of a foreign state’s strictly commercial acts.’” Samantar, 560 U.S. at 312 (quoting Verlinden B.V. v. Cent. Bank of Nigeria, 461 U.S. 480, 487 (1983)). Congress recognized that “[u]nder international law, states are not immune from the jurisdiction of foreign courts insofar as their commercial activities are concerned.” 28 U.S.C. § 1602. Unsurprisingly, the politics of international diplomacy, at times, caused the State Department to suggest granting immunity in cases where its new, restrictive theory would have dictated denial. Samantar, 560 U.S. at 312; Verlinden B.V., 461 U.S. at 487. Inconsistent outcomes also occurred depending on whether an immunity claim was presented to the State Department or a court. Verlinden B.V., 461 U.S. at 487–88.

Congress disapproved of this inconsistency and enacted the FSIA to promote uniformity. Samantar, 560 U.S. at 313. WHATSAPP V. NSO GROUP TECHNOLOGIES 11

As the Act explains, its purpose was twofold: (1) “endorse and codify the restrictive theory of sovereign immunity” that existed under international law, and (2) “transfer primary responsibility for deciding claims of foreign states to immunity from the State Department to the courts.” Id. (internal quotation marks omitted); 28 U.S.C. § 1602. In Congress’s view, placing the responsibility for deciding foreign sovereign immunity claims with courts “would serve the interests of justice and would protect the rights of both foreign states and litigants in the United States courts.” 28 U.S.C. § 1602. And so, immunity determinations were no longer made in the Secretary’s office but a courtroom.

The Supreme Court has addressed the purpose and scope of the FSIA on multiple occasions. In Verlinden B.V., the Court addressed whether the FSIA exceeded the scope of Article III of the Constitution and concluded that the FSIA “contains a comprehensive set of legal standards governing claims of immunity in every civil action against a foreign state or its political subdivisions, agencies or instrumentalities.” 461 U.S. at 488. Likewise, in Republic of Austria, the Court considered whether the FSIA governed pre-enactment conduct and stated that the FSIA “established a comprehensive framework for resolving any claim of sovereign immunity.” 541 U.S. at 699 (emphasis added). Six years later, the Court addressed whether a foreign official comes within the FSIA’s definition of “foreign state” and is, therefore, subject to the Act. Samantar, 560 U.S. at 313–14. Backing away from its prior expansive pronouncements concerning the scope of the FSIA, the Court interpreted the Act’s definition of “foreign state” as not including individual foreign officials seeking immunity. Id. at 315–20. But the Court reiterated that the FSIA does govern the immunity of foreign state entities: “The FSIA was adopted . . . to address a modern world where foreign state enterprises are every day 12 WHATSAPP V. NSO GROUP TECHNOLOGIES

participants in commercial activities, and to assure litigants that decisions regarding claims against states and their enterprises are made purely on legal grounds.” Id. at 323 (emphasis added) (internal quotation marks and citation omitted). Considering that foreign sovereign immunity cases involving foreign officials were “few and far between” prior to the FSIA’s enactment, the Court’s initial expansive pronouncements concerning the scope of the Act are not surprising. Id.

For purposes of resolving the present case, it is worth retracing the Court’s interpretative analysis in Samantar. The FSIA established that “‘a foreign state shall be immune from the jurisdiction of the courts of the United States and of the States’ except as provided in the Act.” Id. at 313 (quoting 28 U.S.C. § 1604). Where it applies, the FSIA takes the entire field regarding application of immunity. If a party seeking immunity is a “foreign state,” as defined in the Act, the FSIA “is the sole basis for obtaining jurisdiction” over that party. Id. at 314 (internal quotation marks and citation omitted). In such a case, it is improper for courts to consider common-law principles. Native Vill. of Kivalina, 696 F.3d at 856 (“[W]hen federal statutes directly answer the federal question, federal common law does not provide a remedy because legislative action has displaced the common law.”). While “foreign state” could be defined as including only “a body politic that governs a particular territory,” Congress defined it more broadly. Samantar, 560 U.S. at 314. Under the FSIA, “foreign state” includes a body politic, as well as its “political subdivisions, agencies, and instrumentalities.” Id.; 28 U.S.C. § 1603(a). And “agency or instrumentality” is defined to include “any entity [that] is a separate legal person, corporate or otherwise and . . . which is an organ of a foreign state or political subdivision thereof, or a majority of whose shares or other ownership interest is owned by a WHATSAPP V. NSO GROUP TECHNOLOGIES 13

foreign state or political subdivision thereof.” 28 U.S.C. § 1603(b) (emphasis added); Samantar, 560 U.S. at 316 (“Congress had corporate formalities in mind.”); see also EIE Guam Corp. v. Long Term Credit Bank of Japan, Ltd., 322 F.3d 635, 640 (9th Cir. 2003) (noting that an entity can be an organ of a foreign state even if it is involved in some commercial affairs). Given these defined terms, and the absence of any reference to individual foreign officials, 2 the Supreme Court held that Congress did not intend for the FSIA to govern immunity of foreign officials in part because “the types of defendants listed [in the FSIA] are all entities.” Samantar, 560 U.S. at 317 (emphasis added).

3. Foreign Sovereign Immunity & Private Entities

Neither the Supreme Court nor this Court has answered whether an entity that does not qualify as a “foreign state” can claim foreign sovereign immunity under the common law. It is clear under existing precedent that such an entity cannot seek immunity under the FSIA. Whether such entity can sidestep the FSIA hinges on whether the Act took the entire field of foreign sovereign immunity as applied to entities, or whether it took the field only as applied to foreign state entities, as NSO suggests. The answer lies in the question. The idea that foreign sovereign immunity could

2 We recognize that the FSIA literally includes “person” in the definition of “agency or instrumentality,” but as the Supreme Court has explained, the phrase “separate legal person, corporate or otherwise” in § 1603(b)(1) “typically refers to the legal fiction that allows an entity to hold personhood separate from the natural persons who are its shareholders or officers.” Samantar, 560 U.S. at 315. “It is similarly awkward to refer to a person as an ‘organ’ of the foreign state . . . . [And] the terms Congress chose simply do not evidence the intent to include individual officials within the meaning of ‘agency or instrumentality.’” Id. at 315–16. 14 WHATSAPP V. NSO GROUP TECHNOLOGIES

apply to non-state entities is contrary to the originating and foundational premise of this immunity doctrine. Moreover, there is no indication that Congress, in codifying the restrictive theory of foreign sovereign immunity to promote uniformity and ensure that immunity decisions are based on law rather than politics, intended to exempt an entire category of entities from its “comprehensive” regime. See 28 U.S.C. § 1603(b); Republic of Austria, 541 U.S. at 699. While the FSIA was silent about immunity for individual officials, that is not true for entities—quite the opposite. Thus, we hold that an entity is entitled to foreign sovereign immunity, if at all, only under the FSIA. If an entity does not fall within the Act’s definition of “foreign state,” it cannot claim foreign sovereign immunity. Period.

Before diving into the details, we go back to the beginning. Chief Justice Marshall explained that foreign sovereign immunity arises from the recognition of the “perfect equality and absolute independence of sovereigns.” Schooner Exchange, 7 Cranch at 137. We give sovereign immunity to other nations as an act of “grace and comity,” Verlinden B.V., 461 U.S. at 486, so they will do the same for us. This cooperative acknowledgement that each nation has equal autonomy and authority promotes exchange and good relationships between nations. See Schooner Exchange, 7 Cranch at 137; see also Siderman de Blake v. Republic of Argentina, 965 F.2d 699, 718 (9th Cir. 1992) (quoting Chief Justice Marshall’s discussion of the origins of sovereign immunity); Butters v. Vance Int’l, Inc., 225 F.3d 462, 465 (4th Cir. 2000) (“[Sovereign] acts often have political, cultural, and religious components. Judicial interference with them would have serious foreign policy ramifications for the United States.”). None of the purposes for recognizing foreign sovereign immunity are served by granting immunity to entities and actors that are neither WHATSAPP V. NSO GROUP TECHNOLOGIES 15

sovereigns themselves nor are not acting on behalf of a sovereign. Again, the very name of the doctrine—foreign sovereign immunity—reflects this truth. Congress did not displace this foundational premise when it enacted the FSIA. See Samantar, 560 U.S. at 320 n.13 (“Congress is understood to legislate against a background of common-law . . . principles” (omission in original) (internal quotation marks and citation omitted)).

As noted above, Congress could have limited the FSIA’s reach to only “a body politic that governs a particular territory.” Id. at 314. It did not. It expanded the FSIA’s reach to “any entity [that] is a separate legal person, corporate or otherwise and . . . which is an organ of a foreign state or political subdivision thereof, or a majority of whose shares or other ownership interest is owned by a foreign state of political subdivision thereof.” 28 U.S.C. § 1603(b) (emphasis added). In defining what qualifies as a “foreign state,” the FSIA necessarily defines the scope of foreign sovereign immunity. An entity must be a sovereign or must have a sufficient relationship to a sovereign to claim sovereign-based immunity. Without such status or relationship, there is no justification for granting sovereign immunity. It is odd indeed to think that by not including a category of entity within its definition of “foreign state,” Congress intended for such entities to have the ability to seek immunity outside its “comprehensive” statutory scheme. See Republic of Austria, 541 U.S. at 699.

This reasoning is supported by the expressio unius exclusio alterius 3 interpretive canon. In creating a “comprehensive set of legal standards governing claims of immunity . . . against a foreign state or its political

3 The expression of one thing implies the exclusion of another. 16 WHATSAPP V. NSO GROUP TECHNOLOGIES

subdivisions, agencies or instrumentalities,” Verlinden B.V., 461 U.S. at 488, Congress defined the types of foreign entities—including, specifically, foreign corporate entities —that may claim immunity. 28 U.S.C. § 1603(b). 4

The most reasonable interpretation then is that the definition of “foreign state” forecloses immunity for any entity falling outside such definition, particularly where “foreign state” is defined broadly. 5 See Pfizer, Inc. v. Gov’t of India, 434 U.S. 308, 312–13 (1978) (noting that expansive statutory language matched the underlying statute’s comprehensive nature); Ingersoll-Rand Co. v. McClendon, 498 U.S. 133, 138–39 (1990) (explaining that defining a term broadly underscored Congress’s intent that the underlying statutory term be expansively applied). And the Supreme Court’s holding in Samantar that individual foreign officials are not subject to the FSIA does not defeat this interpretation because, as the Court explained, the FSIA did not address, at

4 The Supreme Court has recognized that in enacting the FSIA, “Congress was aware of settled principles of corporate law and legislated within that context.” Dole Food Co. v. Patrickson, 538 U.S. 468, 474 (2003). 5 The D.C. Circuit recently relied on the common law in denying foreign sovereign immunity to three United States citizens and a United States limited liability corporation. Broidy Cap. Mgmt. LLC v. Muzin, 12 F.4th 789, 798 (D.C. Cir. 2021). When summarizing Samantar, the court presumed without explanation that the common law applied to “private entities or individuals.” Id. at 802. Unlike here, the parties in Broidy agreed that the FSIA did not apply; the defendants made only common-law arguments, and the defendant-entity was domestic, not foreign. Id. at 792; see also NML Cap., Ltd., 573 U.S. at 142. The D.C. Circuit did not make an explicit finding that foreign sovereign immunity claims from foreign private entities should be analyzed under the common law, and it did not explain its summary assertion that a private entity can seek immunity under the common law despite the FSIA. See Broidy, 12 F.4th at 802. WHATSAPP V. NSO GROUP TECHNOLOGIES 17

all, immunity for individuals or natural persons. 560 U.S. at 319 (“Reading the FSIA as a whole, there is nothing to suggest we should read ‘foreign state’ in § 1603(a) to include an official acting on behalf of the foreign state, and much to indicate that this meaning was not what Congress enacted.”).

Moreover, the Act’s definition of “foreign state” cannot be divorced from the context that “[t]he FSIA was adopted . . . to address a modern world where foreign state enterprises are every day participants in commercial activities.” Id. at 323 (emphasis added) (internal quotation marks and citation omitted). Congress prohibited applying foreign sovereign immunity to “strictly commercial acts.” Id. at 312. So, a plaintiff who can show that a foreign entity—even a direct sovereign like the Welsh Government—was engaged in “a regular course of commercial conduct or a particular commercial transaction or act,” 28 U.S.C. § 1603(d), may defeat a claim of immunity, see Pablo Star Ltd. v. Welsh Gov’t, 961 F.3d 555, 560 (2d Cir. 2020), cert. denied, 141 S. Ct. 1069 (2021); 28 U.S.C. § 1605(a)(2). It makes little sense to conclude that the FSIA leaves open the possibility that a corporate entity less connected to a sovereign than those meeting the statutory definition of “foreign state” could seek immunity for commercial conduct under a different immunity doctrine while entities more connected to a sovereign—even a body politic itself—could not. Especially where the other immunity doctrine proffered, foreign official immunity, is as narrowly focused on natural persons as the FSIA is broadly focused on entities. See Samantar, 560 U.S. at 323 (finding “no reason to believe that Congress saw as a problem, or wanted to eliminate, the State Department’s role in determinations regarding individual official immunity.”). Instead, the omission of entities like NSO from the FSIA’s definition of foreign states and their “political subdivisions, 18 WHATSAPP V. NSO GROUP TECHNOLOGIES

agencies, and instrumentalities” reflects a threshold determination about the availability of foreign sovereign immunity for such entities: they never qualify. 6

4. NSO’s Foreign Sovereign Immunity Claim

Concluding that the FSIA governs all foreign sovereign immunity claims brought by entities, as opposed to individuals, makes this an easy case. NSO is a private corporation that designs spyware technology used by governments for law enforcement purposes. According to NSO, its Pegasus technology is a program that was “marketed only to and used only by sovereign governments” and it allowed those governments “to intercept messages, take screenshots, or exfiltrate a device’s contacts or history.” 7 NSO’s clients choose how and when to use Pegasus, not NSO. NSO simply licenses the technology and provides “advice and technical support” at its customers’ direction.

NSO does not contend that it meets the FSIA’s definition of “foreign state,” and, of course, it cannot. It is not itself a sovereign. 28 U.S.C. § 1603(a). It is not “an organ . . . or

6 In Butters, the Fourth Circuit extended the doctrine of domestic derivative sovereign immunity, applicable to United States contractors, to a United States corporation acting as an agent of a foreign state. 225 F.3d at 466. Butters did not discuss whether this common-law doctrine also extends to foreign contractors acting on behalf of foreign states. In any event, it is unclear what remains of such reasoning where the Supreme Court has instructed that “any sort of immunity defense made by a foreign sovereign in an American court must stand on the Act’s text. Or it must fall.” Republic of Argentina v. NML Cap., Ltd., 573 U.S. 134, 142 (2014). 7 NSO alleges that its customers include the Kingdom of Bahrain, the United Arab Emirates, and Mexico. WHATSAPP V. NSO GROUP TECHNOLOGIES 19

political subdivision” of a sovereign. Id. § 1603(b)(2). Nor is a foreign sovereign its majority owner. Id. NSO is a private corporation that provides products and services to sovereigns—several of them. NSO claims that it should enjoy the immunity extended to sovereigns because it provides technology used for law-enforcement purposes and law enforcement is an inherently sovereign function. Whatever NSO’s government customers do with its technology and services does not render NSO an “agency or instrumentality of a foreign state,” as Congress has defined that term. Thus, NSO is not entitled to the protection of foreign sovereign immunity. And that is the end of our task. There is no need to analyze whether NSO is entitled to immunity under the common law and inquire how the State Department would resolve this case. See WhatsApp Inc. v. NSO Grp. Techs. Ltd., 472 F. Supp. 3d 649, 665 (N.D. Cal. 2020). Nor is it necessary to explain that neither the State Department nor any court has ever applied foreign official immunity to a foreign private corporation under the common law, although this is a compelling fact indeed. 8 The proper analysis begins and ends with the FSIA, the comprehensive framework Congress enacted for resolving any entity’s

8 There is not a single documented instance of the State Department recommending conduct-based immunity for a foreign private corporation. See, e.g., Digest of U.S. Practice in International Law 2020, at 403–09 (CarrieLyn D. Guymon, ed.); Digest of U.S. Practice in International Law 2019, at 344–55 (CarrieLyn D. Guymon, ed.); Digest of U.S. Practice in International Law 2018, at 410–13 (CarrieLyn D. Guymon, ed.); Digest of U.S. Practice in International Law 2017, at 444– 55 (CarrieLyn D. Guymon, ed.); Digest of U.S. Practice in International Law 2016, at 450–61 (CarrieLyn D. Guymon, ed.). Nor have we found any case contemplating the same. 20 WHATSAPP V. NSO GROUP TECHNOLOGIES

claim of foreign sovereign immunity. See Republic of Austria, 541 U.S. at 699; Samantar, 560 U.S. at 319.

AFFIRMED.