Pegasus Spyware: Facebook, Google & Microsoft Vs NSO, a Legal Battle Decoded

Tech giants like Microsoft and Google have joined Facebook's legal battle against NSO in California court

Pegasus spyware maker, NSO Group, an Israeli cyber-intelligence company, responded to The Quint’s questions on the Pegasus 'snoopgate' controversy in which Indian journalists, politicians, rights activists and other citizens were spied upon. 

(Photo: Shruti Mathur/ The Quint)

A report published by news organisations across the world on Sunday, 18 July, revealed that Israel-made spyware Pegasus was believed to have been used to snoop on at least 300 Indian phone numbers, including those of several journalists, politicians, government officials and rights activists.

Pegasus, a product of Israeli cyber weapons company NSO Group, was earlier in the news in late 2019, when it was found that the spyware had been used to hack into phones of roughly 1,400 users around the world, including 121 Indians.

In 2019, WhatsApp had filed a suit against NSO Group before a California Court. We revisit the case, the latest developments, and what lies ahead in the legal battle.

The proceedings in WhatsApp's case against NSO reveal the degree of damage NSO's spyware products can cause, the imminent threat to not just data privacy but also human lives, and why tech giants have joined Facebook in this battle.

Facebook v. NSO: Legal Arguments

In October 2019, WhatsApp, which is owned by Facebook, filed a lawsuit against NSO group, alleging that the latter planted its Pegasus spyware in the devices of 1400 WhatsApp users worldwide. Facebook also alleged that at least 100 out of the 1400 hacked devices belonged to journalists, lawyers, human rights defenders, and political dissidents.

WhatsApp invoked the U.S. Computer Fraud and Abuse Act (CFAA), the California Comprehensive Data Access and Fraud Act, and section 502 of the California Penal Code for "breach of contract" and "trespass". The tech giant demanded damages and an injunction order against NSO.

WhatsApp has asked the court to prevent NSO from "trespassing" the property of its parent company Facebook, and pay damages for violating the data privacy and fraud laws, and for breaching the contract between WhatsApp and its users.

NSO, on the other hand, has dismissed FB's allegations as "baseless". The Israeli company claims its sole purpose is to provide governments and law enforcement agencies with technologies to help them fight terrorism and serious crimes.

Legal Proceedings - NSO cites 'Sovereign Immunity'

On March 02, 2020, the California court passed a "default notice" against NSO for not appearing before the court. Just 4 days later, NSO challenged the default notice by arguing that WhatsApp did not serve adequate notice to them as per the established rules of private international law.

NSO also argued that WhatsApp gave false statements to the court about serving proper notice as per rules laid down in the Hague Convention.

Most interestingly, NSO argues that since its products are only sold to governments and state agencies, the case filed against it should be dismissed on the ground of 'sovereign immunity'. Under the principle of sovereign immunity, a sovereign government or state cannot be prosecuted in a civil or a criminal suit in a foreign court.

NSO argued that it should be covered by the principle of sovereign immunity as its products are given only to those governments/state agencies who request for it. Countering this argument, WhatsApp submitted that NSO is a third-party entity and not a "state agency". Therefore, it cannot claim sovereign immunity.

In July 2020, the California court ruled in favour of WhatsApp and dismissed NSO's claim to sovereign immunity. Subsequently, NSO challenged this ruling in the US's 9th Circuit Appellate Court where the case is still pending.

Microsoft and Google join Facebook against NSO

In December 2020, tech giants Microsoft and Google also moved a motion to be joined as parties in Facebook's ongoing legal battle against NSO. Other tech organisations such as Internet Association, GitHub, and LinkedIn also joined the motion.

Supporting Facebook's claim against NSO, Microsoft and Google stated in their motion that they have an interest in ensuring that "entities who access their products, services, and systems in violation of U.S. law are held accountable in U.S. courts".

The tech giants further asked the court to decide whether to radically expand the risks Pegasus poses by giving NSO sovereign immunity when it acts on behalf of its foreign-government customers.

Expanding foreign sovereign immunity to private companies that use their own cyber-surveillance tools at the behest of their numerous foreign-government customers would dramatically increase the creation and use of cyber-surveillance tools globally. In particular, it would place these tools in the hands of more governments, including governments likely to engage in riskier behaviours and at greater risk of losing control of such tools.

Microsoft, Google claim in their impleadment motion

Governments Should Hold NSO Group Accountable

In its lawsuit, WhastApp didn't reveal the identity of its users whose devices were attacked by the Pegasus spyware. Therefore, we could not find an official statement from the US government on the allegations against NSO or on ongoing legal battle before the California court.

However, tech giants believe that governments should play a more proactive role. Talking to the Indian Express, WhatsApp head Will Cathcart said that there is a growing need for “more companies, and, critically, governments, to take steps to hold NSO Group accountable.”

Cathcart further urged for a “global moratorium on the use of unaccountable surveillance technology now,” adding that it was past time.

In India, the Minister for Information Technology Ashwini Vaishnaw on Monday, 19 July, said in the Lok Sabha that the Pegasus Project is an attempt to malign India’s “democracy and its well-established institutions”.

Bringing up the Pegasus spyware controversy in the Lower House on Monday, Vaishnaw called it a “highly sensational story” around which “many over-the-top allegations” were made.

“The press reports appeared a day before the Monsoon Session of Parliament. This can't be a coincidence… In the past, similar claims were made regarding use of Pegasus on WhatsApp. Those reports had no factual basis and were denied by all parties. Press reports of 18 July 2021 also appear to be an attempt to malign Indian democracy and its well-established institutions.”

IT Minister Ashwini Vaishnaw in Lok Sabha, as quoted by ANI