WHATSAPP INC., a Delaware corporation; FACEBOOK, INC., a Delaware corporation, Plaintiffs-Appellees, v. NSO GROUP TECHNOLOGIES LIMITED; Q CYBER TECHNOLOGIES LIMITED, Defendants-Appellants.
No. 20-16408
United States Court of Appeals for the Ninth Circuit
November 8, 2021
D.C. No. 4:19-cv-07123-PJH
Before: Mary H. Murguia, Ryan D. Nelson, and Danielle J. Forrest, Circuit Judges.
FOR PUBLICATION
Appeal from the United States District Court for the Northern District of California Phyllis J. Hamilton, District Judge, Presiding
Argued and Submitted April 12, 2021 San Francisco, California
Filed November 8, 2021
Opinion by Judge Forrest
SUMMARY*
Foreign Sovereign Immunity
The panel affirmed the district court‘s order denying a private Israeli corporation‘s motion to dismiss, based on foreign sovereign immunity, an action brought under the Computer Fraud and Abuse Act and California state law.
WhatsApp Inc. and Facebook, Inc., alleged that defendant, a privately owned and operated Israeli corporation, sent malware through WhatsApp‘s server system to mobile devices.
The panel held that it had jurisdiction under the collateral order doctrine to review the district court‘s order denying defendant‘s motion to dismiss based on a claim of immunity from suit.
The panel held that the Foreign Sovereign Immunity Act occupies the field of foreign sovereign immunity and categorically forecloses extending immunity to any entity that falls outside the Act‘s broad definition of “foreign state.” The panel rejected defendant‘s argument that it could claim foreign sovereign immunity under common-law immunity doctrines that apply to foreign officials. The panel stated that there was no indication that the Supreme Court in Samantar v. Yousuf, 560 U.S. 305 (2010), intended to extend foreign official immunity to entities. Moreover, the FSIA‘s text, purpose, and history demonstrate that Congress displaced common-law sovereign immunity as it relates to entities. The panel therefore affirmed the district court‘s order.
* This summary constitutes no part of the opinion of the court. It has been prepared by court staff for the convenience of the reader.
COUNSEL
Jeffrey S. Bucholtz (argued), King and Spalding LLP, Washington, D.C.; Matthew V.H. Noller, King and Spalding LLP, Sacramento, California; Joseph N. Akrotirianakis, King and Spalding LLP, Los Angeles, California; for Defendants-Appellants.
Michael R. Dreeben (argued), O‘Melveny & Myers LLP, Washington, D.C.; Yaira Dubin, O‘Melveny & Myers LLP, New York, New York; for Plaintiffs-Appellees.
Mark Parris, Carolyn Frantz, Paul Rugani, and Alyssa Barnard-Yanni, Orrick Herrington & Sutcliffe LLP, Seattle, Washington; for Amici Curiae Microsoft Corp., Cicsco Systems Inc., Github Inc., LinkedIn Corporation, VMWare Inc., and Internet Association.
Michael Trinh, Google LLC, Mountain View, California, for Amicus Curiae Google LLC.
Sophia Cope and Andrew Crocker, Electronic Frontier Foundation, San Francisco, California, for Amicus Curiae Electronic Frontier Foundation.
Elaine Goldenberg, Munger Tolles & Olson LLP, Washington, D.C.; Marianna Mao, Munger Tolles & Olson LLP, San Francisco, California; David Kaye, Irvine, California; for Amicus Curiae David Kaye.
Kyle A. McLorg, Stephanie Skaff, and Deepak Gupta, Farella Braun & Martel LLP, San Francisco, California, for Amici Curiae Access Now, Amnesty International, Committee to Protect Journalists, Internet Freedom Foundation, Paradigm Initiative, Privacy International, Red en Defensa de los Derechos Digitales, and Reporters Without Borders.
Geoffrey M. Klineberg and Bethan R. Jones, Kellogg Hansen Todd Figel & Frederick PLLC, Washington, D.C., for Amicus Curiae Foreign Sovereign Immunity Scholars.
FORREST, Circuit Judge:
The question presented is whether foreign sovereign immunity protects private companies. The law governing this question has roots extending back to our earliest history as a nation, and it leads to a simple answer—no. Indeed, the title of the legal doctrine itself—foreign sovereign immunity—suggests the outcome.
Plaintiffs-Appellees WhatsApp Inc. and Facebook, Inc. (collectively WhatsApp) sued Defendants-Appellants NSO Group Technologies Ltd. and Q Cyber Technologies
The district court rejected NSO‘s argument, concluding that common-law foreign official immunity does not protect NSO from suit in this case. We agree that NSO is not entitled to immunity in this case, but we reach this conclusion for a different reason than did the district court. We hold that the Foreign Sovereign Immunity Act (FSIA or Act) occupies the field of foreign sovereign immunity as applied to entities and categorically forecloses extending immunity to any entity that falls outside the FSIA‘s broad definition of “foreign state.” And we reject NSO‘s argument that it can claim foreign sovereign immunity under common-law immunity doctrines that apply to foreign officials—i.e., natural persons. See Samantar v. Yousuf, 560 U.S. 305, 315–16 (2010). There is no indication that the Supreme Court intended to extend foreign official immunity to entities. Moreover, the FSIA‘s text, purpose, and history demonstrate that Congress displaced common-law sovereign immunity doctrine as it relates to entities. See Native Vill. of Kivalina v. ExxonMobil Corp., 696 F.3d 849, 856 (9th Cir. 2012) (“Federal common law is subject to the paramount authority of Congress.“).
I. BACKGROUND
NSO is an Israeli company that designs and licenses surveillance technology to governments and government agencies for national security and law enforcement purposes. One of NSO‘s products—a program named Pegasus—“enables law enforcement and intelligence agencies to remotely and covertly extract valuable intelligence from virtually any mobile device.” Pegasus users may intercept messages, take screenshots, or exfiltrate a device‘s contacts or history. NSO claims that it markets and licenses Pegasus to its customers,1 which then operate the technology themselves. According to NSO, its role “is limited to providing advice and technical support to assist customers in setting up—not operating—the Pegasus technology.”
WhatsApp provides an encrypted communication service to the users of its application. Because of its encryption technology, every type of communication (telephone calls, video calls, chats, group chats, images, videos, voice messages, and file transfers) sent using WhatsApp on a mobile device can be viewed only by the intended recipient. WhatsApp asserts that NSO used WhatsApp‘s servers without authorization to send “malicious code” to approximately 1,400 WhatsApp users. The malicious code was allegedly designed to infect the targeted devices for the purpose of surveilling the device users.
In October 2019, WhatsApp sued NSO in federal district court. WhatsApp asserted claims under the Computer Fraud and Abuse Act,
NSO moved to dismiss the complaint. As relevant here, NSO asserted that the court lacked subject matter jurisdiction because NSO was acting at the direction of its foreign government customers and is protected from suit under foreign sovereign immunity. The district court denied NSO‘s motion. Relying on the Restatement (Second) of Foreign Relations Law § 66, the district court concluded that NSO was not entitled to common-law conduct-based foreign sovereign immunity because it failed to show that exercising jurisdiction over NSO would serve to enforce a rule of law against a foreign state. This interlocutory appeal followed.
II. DISCUSSION
A. Interlocutory Jurisdiction
As a threshold matter, WhatsApp argues that we lack jurisdiction over this interlocutory appeal because the district court‘s order is not a final appealable order. “We review questions of our own jurisdiction de novo.” Hunt v. Imperial Merch. Servs., Inc., 560 F.3d 1137, 1140 (9th Cir. 2009) (citation omitted).
We have jurisdiction over “final decisions of the district courts.”
A common example of an immediately appealable collateral order that is effectively unreviewable after final judgment is an interlocutory denial of certain immunities from suit. SolarCity Corp. v. Salt River Project Agric. Improvement & Power Dist., 859 F.3d 720, 725 (9th Cir. 2017) (noting that the “Supreme Court has allowed immediate appeals from” interlocutory denials of Eleventh Amendment immunity, absolute and qualified immunity, foreign sovereign immunity, and tribal sovereign immunity). In contrast, denials of a “defense to liability” are not immediately appealable final orders. Id. at 725–26 (explaining that “[u]nlike immunity from suit, immunity from liability can be protected by a post-judgment appeal” and “therefore do[es] not meet the requirements for immediate appeal under the collateral-order doctrine“).
The parties dispute whether common-law conduct-based foreign official immunity is an immunity from suit, entitling it to an interlocutory appeal, or a defense to liability that can only be appealed post-judgment. But all agree that foreign state sovereign immunity, now codified in the FSIA, is an immunity from suit and that an order denying a foreign state‘s claim of sovereign immunity is immediately appealable. Compania Mexicana de Aviacion, S.A. v. U.S. Dist. Ct., 859 F.2d 1354, 1358 (9th Cir. 1988). Because we conclude that the FSIA governs NSO‘s claim of immunity, we have jurisdiction over this appeal under the collateral-order doctrine.
B. Foreign Sovereign Immunity
1. Origins of the Doctrine
Chief Justice John Marshall‘s opinion in Schooner Exchange v. McFadden, 7 Cranch 116; 3 L. Ed. 287 (1812), is credited with establishing foreign sovereign immunity in American law. See Opati v. Republic of Sudan, 140 S. Ct. 1601, 1605 (2020); see also Schooner Exchange, 7 Cranch at 136 (noting the Court was “exploring an unbeaten path, with few, if any, aids from precedents or written law“). Writing for the Court, he reasoned that a nation‘s jurisdiction within its own boundaries is “exclusive and absolute” and any limitations on such jurisdiction “must be traced up to the consent of the nation itself. They can flow from no other legitimate source.” Schooner Exchange, 7 Cranch at 136. Chief Justice Marshall further explained that respecting, and claiming, the “perfect equality and absolute independence of sovereigns,” the nations of the world have “wave[d] the exercise of a part of that complete exclusive territorial jurisdiction” in cases brought within their jurisdiction against a foreign sovereign and ministers of a foreign sovereign. Id. at 137–39; Republic of Austria v. Altmann, 541 U.S. 677, 688 & n.9 (2004).
From this origin—described as “the classical or virtually absolute theory of sovereign immunity,” Permanent Mission of India to the U.N. v. City of New York, 551 U.S. 193, 199 (2007) (internal quotation marks and citation omitted)—“[t]he doctrine of foreign sovereign immunity developed as a matter of common law.” Samantar, 560 U.S. at 311. During our early years as a country, the State Department took the lead in applying foreign sovereign immunity. Id.; see also Br. of Foreign Sovereign Immunity Scholars, 4–7, No. 20-16408. Essentially, when faced with an immunity claim brought by a foreign state or official, if the State Department suggested immunity, a court would acquiesce. Samantar, 560 U.S. at 311–12. And if the State Department did not suggest immunity, the court‘s inquiry consisted of asking whether the State Department had a policy for recognizing sovereign immunity in similar circumstances. Id. So, the State Department, not the courts, was the primary arbiter of foreign sovereign immunity. And the State Department‘s general practice was to suggest immunity “in all actions against friendly sovereigns.” Id. at 312.
2. The Foreign Sovereign Immunity Act
In the early 1950s, the State Department abandoned the absolute theory of foreign sovereign immunity and “join[ed] the majority of other countries by adopting the ‘restrictive theory’ of sovereign immunity.” Permanent Mission of India to the U.N., 551 U.S. at 199. Under this theory, foreign sovereign “immunity is confined to suits involving the foreign sovereign‘s public acts, and does not extend to cases arising out of a foreign state‘s strictly commercial acts.” Samantar, 560 U.S. at 312 (quoting Verlinden B.V. v. Cent. Bank of Nigeria, 461 U.S. 480, 487 (1983)). Congress recognized that “[u]nder international law, states are not immune from the jurisdiction of foreign courts insofar as their commercial
Congress disapproved of this inconsistency and enacted the FSIA to promote uniformity. Samantar, 560 U.S. at 313.
As the Act explains, its purpose was twofold: (1) “endorse and codify the restrictive theory of sovereign immunity” that existed under international law, and (2) “transfer primary responsibility for deciding claims of foreign states to immunity from the State Department to the courts.” Id. (internal quotation marks omitted);
The Supreme Court has addressed the purpose and scope of the FSIA on multiple occasions. In Verlinden B.V., the Court addressed whether the FSIA exceeded the scope of Article III of the Constitution and concluded that the FSIA “contains a comprehensive set of legal standards governing claims of immunity in every civil action against a foreign state or its political subdivisions, agencies or instrumentalities.” 461 U.S. at 488. Likewise, in Republic of Austria, the Court considered whether the FSIA governed pre-enactment conduct and stated that the FSIA “established a comprehensive framework for resolving any claim of sovereign immunity.” 541 U.S. at 699 (emphasis added). Six years later, the Court addressed whether a foreign official comes within the FSIA‘s definition of “foreign state” and is, therefore, subject to the Act. Samantar, 560 U.S. at 313–14. Backing away from its prior expansive pronouncements concerning the scope of the FSIA, the Court interpreted the Act‘s definition of “foreign state” as not including individual foreign officials seeking immunity. Id. at 315–20. But the Court reiterated that the FSIA does govern the immunity of foreign state entities: “The FSIA was adopted... to address a modern world where foreign state enterprises are every day participants in commercial activities, and to assure litigants that decisions regarding claims against states and their enterprises are made purely on legal grounds.” Id. at 323 (emphasis added) (internal quotation marks and citation omitted). Considering that foreign sovereign immunity cases involving foreign officials were “few and far between” prior to the FSIA‘s enactment, the Court‘s initial expansive pronouncements concerning the scope of the Act are not surprising. Id.
For purposes of resolving the present case, it is worth retracing the Court‘s interpretative analysis in Samantar. The FSIA established that “a foreign state shall be immune from the jurisdiction of the courts of the United States and of the States’ except as provided in the Act.” Id. at 313 (quoting
3. Foreign Sovereign Immunity & Private Entities
Neither the Supreme Court nor this Court has answered whether an entity that does not qualify as a “foreign state” can claim foreign sovereign immunity under the common law. It is clear under existing precedent that such an entity cannot seek immunity under the FSIA. Whether such entity can sidestep the FSIA hinges on whether the Act took the entire field of foreign sovereign immunity as applied to entities, or whether it took the field only as applied to foreign state entities, as NSO suggests. The answer lies in the question. The idea that foreign sovereign immunity could apply to non-state entities is contrary to the originating and foundational premise of this immunity doctrine. Moreover, there is no indication that Congress, in codifying the restrictive theory of foreign sovereign immunity to promote uniformity and ensure that immunity decisions are based on law rather than politics, intended to exempt an entire category of entities from its “comprehensive” regime.
As noted above, Congress could have limited the FSIA‘s reach to only “a body politic that governs a particular territory.” Id. at 314. It did not. It expanded the FSIA‘s reach to “any entity [that] is a separate legal person, corporate or otherwise and ... which is an organ of a foreign state or political subdivision thereof, or a majority of whose shares or other ownership interest is owned by a foreign state of political subdivision thereof.”
This reasoning is supported by the expressio unius exclusio alterius3 interpretive canon. In creating a “comprehensive set of legal standards governing claims of immunity ... against a foreign state or its political subdivisions, agencies or instrumentalities,” Verlinden B.V., 461 U.S. at 488, Congress defined the types of foreign entities—including, specifically, foreign corporate entities4—that may claim immunity.
Moreover, the Act‘s definition of “foreign state” cannot be divorced from the context that “[t]he FSIA was adopted ... to address a modern world where foreign state enterprises are every day participants in commercial activities.” Id. at 323 (emphasis added) (internal quotation marks and citation omitted). Congress prohibited applying foreign sovereign immunity to “strictly commercial acts.” Id. at 312. So, a plaintiff who can show that a foreign entity—even a direct sovereign like the Welsh Government—was engaged in “a regular course of commercial conduct or a particular commercial transaction or act,”
Concluding that the FSIA governs all foreign sovereign immunity claims brought by entities, as opposed to individuals, makes this an easy case. NSO is a private corporation that designs spyware technology used by governments for law enforcement purposes. According to NSO, its Pegasus technology is a program that was “marketed only to and used only by sovereign governments” and it allowed those governments “to intercept messages, take screenshots, or exfiltrate a device‘s contacts or history.”7 NSO‘s clients choose how and when to use Pegasus, not NSO. NSO simply licenses the technology and provides “advice and technical support” at its customers’ direction.
NSO does not contend that it meets the FSIA‘s definition of “foreign state,” and, of course, it cannot. It is not itself a sovereign.
AFFIRMED.