WhatsApp v. NSO Group
In October 2019, WhatsApp – an online messaging platform
owned by Facebook Inc. – filed a lawsuit against NSO Group (NSO) before the
District Court for the Northern District of California. NSO is an Israeli-based
technology company best known for its Pegasus spyware, which can be used to
gain access to confidential information stored on computer networks and
systems. WhatsApp claims that, by exploiting a vulnerability in its operating
system, NSO implanted this spyware on the mobile phones of its customers,
including human rights activists, lawyers, and religious figures. According to
WhatsApp’s complaint, NSO’s spying activities violate U.S. law on computer
fraud as well as WhatsApp’s user agreement. WhatsApp has applied for a
permanent injunction to prevent NSO from accessing its platform.
NSO denies WhatsApp’s allegations and, on April 4, 2020, it
filed a motion to dismiss the case, which was accompanied by a declaration by
NSO CEO Shalev Hulio. NSO claims its activities are limited to licensing
software to government law enforcement and intelligence agencies, and that it
does not operate the technology. This is consistent with a previous statement
in which NSO maintained that it only sells its software to human
rights-respecting governments that use it to fight terrorism and serious crime.
Yet, media outlets cite NSO sources who suggest that NSO is directly involved
in surveillance operations because either foreign governments lack the
technological expertise to carry out the operations themselves or their
national law prohibits them from doing so.
Whether WhatsApp can establish NSO’s direct involvement in
the surveillance operations will be an important factual matter to be resolved
at trial. However, it is not necessarily the case that this dispute will end
with a consideration of its merits. NSO argues that, even if the court accepts
WhatsApp’s allegations as true (p. 8), U.S. courts lack both personal and
subject-matter jurisdiction to hear the case. While personal jurisdiction
raises the question of whether the company has sufficient connections with the
United States for the case to be decided by U.S. courts, this article focuses
on NSO’s arguments concerning subject-matter jurisdiction. In this regard, NSO
relies entirely on the doctrine of foreign sovereign immunity, and this poses a
difficult and novel question in international law: can a private company assert
state immunity in legal proceedings to which the state is not a party? To
answer this, NSO’s arguments will be tested against the United States’ foreign
sovereign immunity jurisprudence under the 1976 Foreign Sovereign Immunities
Act (FSIA) and the relevant rules of international law.
The Doctrine of State Immunity
Customary international law recognizes that, as sovereign
entities, states are entitled to some degree of immunity from suit before
foreign courts (ICJ, Germany v Italy, para 78). While the precise boundaries of
the rules governing state immunity are contested, most states now follow a “restrictive
approach”. According to this view, state immunity applies exclusively to acts
carried out by foreign states in the exercise of sovereign functions (acta jure
imperii) and cannot be asserted with regard to acts that do not involve the
exercise of such functions (acta jure gestionis). This trend, which Italian and
Belgian courts initiated at the turn of the 20th century, was endorsed by the
United States with the 1952 Tate Letter. In 1976, FSIA confirmed the
restrictive doctrine by providing a number of exceptions to state immunity for
non-sovereign activities.
Under U.S. law, in Amerada Hess the Supreme Court held that
FSIA is “the sole basis for obtaining jurisdiction over a foreign state” (p.
434). A “foreign state” is defined at § 1603(a) of FSIA as the state as well as
“a political subdivision of a foreign state or an agency or instrumentality of
a foreign state.” States can of course assert immunity before U.S. courts when
proceedings are instituted against them in their own name. Yet, in the WhatsApp
dispute the parties to the case are two private companies. Under § 1603(b) of
FSIA, a separate legal person is considered “an agency or instrumentality of a
foreign State” when it is “an organ of a foreign State or a political
subdivision thereof, or a majority of [its] shares or other ownership interest
is owned by a foreign State or political subdivision thereof.” It is clear that
NSO meets none of these requirements: NSO is a privately owned company and
there is no indication that it acted as the organ of a particular government.
Derivative State Immunity as Indirect Impleading
NSO argues that, “[t]o the extent [it has] any role in
sovereign governments’ use of NSO’s technology,” it is “entitled to derivative
sovereign immunity” (pp. 9-10). “Derivative sovereign immunity” is not a term
of art in international law, and the FSIA is silent on this issue. In support
of its claim, NSO relies principally on the 2000 judgment in Butters v. Vance
Intern., Inc., in which a U.S. company was deemed to be entitled to “derivative
immunity under the FSIA” for acts carried out following Saudi Arabia’s orders
(p. 466). However, it is unclear how this judgment can be reconciled with the
2010 Supreme Court’s decision in Samantar v. Yousef, which clearly states that
Congress’ purpose in enacting FSIA was exclusively to codify state immunity,
not other sovereign immunities such as the immunity of state officials, which
continue to be governed by the common law incorporating international law (p.
322). Indeed, the Samantar ruling looms large given that in the 2014 Republic
of Argentina v. NML case, the Supreme Court found that “any sort of immunity
defense made by a foreign sovereign in an American court must stand on the
[FSIA] text” (pp. 141-142).
There are only two routes by which the existence of a
doctrine of “derivative immunity” might be argued before U.S. courts, and in
both cases customary international law plays a crucial role in determining the
content of this doctrine. The first option is to maintain that, despite the
dicta of the Supreme Court, the FSIA implicitly allows private entities to
claim immunity on behalf of foreign states. In this case, international law
continues to inform the interpretation of this doctrine pursuant to the
Charming Betsey canon (“an act of Congress ought never to be construed to
violate the law of nations if any other possible construction remains”; p.
118). Alternatively, as the Supreme Court acknowledged, “[e]ven if a suit is
not governed by the [FSIA], it may still be barred by foreign sovereign
immunity under the common law” (Samantar, p. 324). Thus, if the question of
derivative state immunity is deemed to fall outside of the scope of FSIA (the
most plausible interpretation), derivative state immunity may still be found in
the common law. In this regard, federal common law is deemed to incorporate
customary international law and, moreover, respect for customary law on
sovereign immunity is arguably required by the Constitution itself (Bellia and
Clark, p. 170). However, even if one does not share this view, it has been
convincingly demonstrated that “it is likely that CIL will influence judicial
assessments of common law immunity claims” (Bradley and Helfer, p. 272).
Looking at customary international law, the concept of
“derivative state immunity” invoked by NSO seems to refer to what is known as
the “indirect impleading” of foreign states. Under certain circumstances,
customary international law permits state immunity to be asserted before a
foreign court when the state is not a party to the case but its sovereign
rights are nevertheless implicated. Historically, indirect impleading occurred
in those situations when state-owned property (usually vessels) was subject to
proceedings before a foreign court (UNCSI Commentary, p. 25). In these cases,
U.K. and U.S. courts found that state immunity constituted a bar to judicial
proceedings because foreign states should not have to choose “between being
deprived of property or else submitting to the jurisdiction of the Court”
(UNCSI Commentary, p. 25).
That said, customary international law as evidenced by state
practice and opinio juris on indirect impleading makes it very difficult for
NSO to successfully invoke the doctrine of state immunity.
First, for NSO to claim some form of derivative immunity, at
the very least it must identify the state(s) impleaded by the proceedings and
to substantiate how their sovereign interests are affected. NSO’s claim that it acts “entirely at the
direction of their government customers” does not meet this requirement (p. 10).
A court cannot be expected to accept these claims at face value, considering
that foreign states remain free to waive their immunity and must be reasonably
put in a position to do so (§ 1605(a)(1) FSIA). This places NSO in a difficult
position because one of the reasons it is resisting proceedings before U.S.
courts is to avoid “revealing national security secrets of foreign countries”.
Second, state practice on indirect impleading largely
consists of cases in which sovereign property is affected by foreign court
proceedings. This is important in the WhatsApp case because NSO seems to be
suggesting that it is intelligence collection as an activity that implicates
the sovereign authority of a state – in other words, NSO’s claim does not
pertain to a state’s sovereign property.
The International Law Commission attempted to codify
indirect impleading in Article (6)(2)(b) of the United Nations Convention on
State Immunity 2004 (UNCSI), which reads:
A proceeding before a court of a State shall be considered
to have been instituted against another State if that other State:
. . .
(b) is not named as a party to the proceeding but the
proceeding in effect seeks to affect the property, rights, interests or
activities of that other State.
Ostensibly, Article 6(2)(b) expands the circumstances in
which state immunity can be indirectly impleaded before foreign courts – state
immunity can be asserted where proceedings affect not just the property of the
state but also their “rights, interests or activities”. If indirect impleading
is available when proceedings affect the sovereign activities of a state, there
is no reason why it cannot in principle apply to intelligence operations.
However, UNCSI is not yet in force and there is controversy as to the whether
all of its provisions codify customary international law. In fact, in 2017 the
UK Supreme Court confirmed that, beyond cases affecting the property interests
of foreign states, indirect impleading remains exceptional and is difficult to
conceive (Belhaj v Straw; case note by Franchini). This decision was followed
in the same year by the High Court of South Africa (“NM Cherry Blossom”), which
reached the same conclusion.
Third, even if indirect impleading is available in relation
to state activities, this rule applies only when legal proceedings affect the
sovereign activities of a foreign state. This conclusion is sound because a
private party cannot benefit from state immunity through indirect impleading
with regard to activities for which the state itself would not enjoy immunity.
An important question is whether it is an activity’s nature
or purpose that determines its sovereign character (Crawford, p. 95). If it is
an activity’s nature that is determinative, we must look to whether it relates
to the exercise of public authority. By contrast, if the exercise of a
sovereign function is identified by an activity’s purpose, we must consider its
overall objective — potentially capturing a wider range of activities. The
UNCSI provides that in order to determine whether an activity is “commercial”
and thus non-sovereign, “its purpose should also be taken into account”
(Article 2(2)). Yet, this approach runs counter to state practice, which
suggests that “the predominant approach has been to focus upon the nature of
the [activity] rather than the purpose” (Shaw, p. 532).
Intelligence operations are a quintessentially sovereign
function. For example, espionage against hostile states is a matter of national
security and, as such, it constitutes an acta jure imperii. However, there are
some circumstances in which it is difficult to argue that intelligence
operations possess the imprimatur of sovereign authority. For instance,
intelligence operations against foreign companies – which are designed to
acquire trade secrets that are then passed to domestic competitors – are activities
that are likely to fall outside of the sovereign authority of a state, at least
for most states. The United States for example insists that it never uses state
apparatus to conduct commercial espionage, but the same may not be true for
China. Thus, for NSO to persuade a court that its intelligence operations
relate to the performance of a sovereign function, it will have to identify the
nature of these operations. As we have already noted, it is unlikely that NSO
will be prepared to discuss the specifics of these operations in open court.
Fourth, Article 6(2)(b) UNCSI explains that it is only when
proceedings “affect” the sovereign property, rights, interests or activities of
a state that the exercise of jurisdiction is precluded. The use of the term “affect”
sets the bar low. To give this term its literal definition would mean that
proceedings even marginally or tangentially touching upon the exercise of
sovereign functions might be covered by state immunity. However, the rule of indirect impleading under
customary law is likely to require a much greater impact on a sovereign
function (Grant, Chapter 11). For example, the United States has previously
pointed out that the terms used by Article 6(2)(b) are “sufficiently expansive
to reach many other kinds of cases” and for this reason they required “further
consideration” by states before finalizing the text (p. 30).
It stands to reason that, if state immunity applies in all
proceeding that have an impact, however remote, on the activities of foreign
states, this doctrine would lend itself to abuse as it would block courts from
considering the legality of many corporate activities. An expansive reading of
indirect impleading is also inconsistent with the current trajectory of state
immunity, given that almost all states increasingly qualify this immunity with
restrictions and exceptions to ensure an adequate balance between the
protection of sovereignty and the individual right of access to a court (for
further discussion on the immunity exceptions in FSIA see here and here).
Indirect impleading should be therefore kept within strict and clear
boundaries.
For the present authors, this doctrine should find
application only when a determination of the legal rights and interests of a
foreign state not party to the proceedings is a requirement for the court to
reach a decision on the merits of the case. If a court is unable to decide a
dispute “but for” judging on the rights and interests of foreign states,
allowing the court to proceed to the merits would circumvent the rules of state
immunity and undermine state sovereignty. However, when the rights and
interests of foreign states do not form the subject-matter of the proceedings,
the rationale behind state immunity is absent. The outcome of the proceedings do
not involve the courts of one state passing judgment on the sovereign rights
and interests of another state without its consent. Applying the doctrine of
state immunity in this context would therefore unjustifiably deprive the court
of its jurisdiction and amount to a denial of justice.
WhatsApp is suing NSO under U.S. law for hacking its
customers’ accounts. Thus, it is the legality of these activities, not of the
acts of foreign states that are doing business with NSO, that constitutes the
subject-matter of the proceedings. To be clear, judicial findings on the
legality of NSO’s surveillance operations may very well have implications for
foreign states if they directed, profited from, or were otherwise involved in
NSO’s activities. However, it is a far cry to say that the WhatsApp case
affects the rights and interests of foreign states.
Conclusion
NSO is seeking to bar proceedings before U.S. courts by
invoking the doctrine of derivative state immunity. This article has
demonstrated that, even if this doctrine is available under U.S. law, when
tested against the relevant rules of international law this claim is likely to
fail for four main reasons: (i) NSO will not identify from which state(s) it is
deriving state immunity, a pre-requisite for indirect impleading; (ii) indirect
impleading is usually limited to protecting state property rather than state
activities; (iii) the secrecy surrounding NSO’s links with its
client-governments means it will be very difficult to persuade the court that
the intelligence operations involved the exercise of a sovereign function; and
(iv) WhatsApp’s focus on NSO’s intelligence operations means that the sovereign
rights and interests of foreign states are not the subject-matter of the
lawsuit.
Comments
Post a Comment