ROSE REID: On the northern coast of Tel Aviv, Israel is the city of Herzliya – known to be the birthplace of Israeli startups, a mecca for entrepreneurs…12

In October of 2019, it was a typical day for NSO Group employees who went to work at headquarters – business as usual – on the 14th floor.3 For the world’s most infamous spyware company, it’s reported that there’s usually only one security guard.4

I can picture vulnerability researchers and marketing employees grabbing coffee from a small galley kitchen – returning to their desks with their mugs, ready for the day.

Although this time, it would be the NSO Group that would find a surprise on their computer screens –

You know the ritual, pull up your work email, take a look at the day’s calendar, and then – reward yourself with a quick visit to Facebook or Instagram.

Except, in this case –

They couldn’t.56

MEDIA CLIP: Now, WhatsApp, part of the Facebook empire, with a 1 billion and a half users around the world is taking one of the biggest players to court.7
MEDIA CLIP: Pegasus used a bug in WhatsApp to penetrate smartphones.8
MEDIA CLIP: They’re known for their end-to-end encryption. They’re used by people who are very security minded.9
MEDIA CLIP: It’s a milestone for the protection of user privacy in general. This is a pretty big deal.

ROSE: Just days before, WhatsApp’s parent company, Facebook – now Meta – filed their suit with the federal district court in the state of California.

At the same time, Facebook identified as many NSO Group employees as possible – and then blocked them from logging onto their Facebook and Instagram accounts.10

NSO Group co-founder Shalev Hulio told the New Yorker that it was a “bully move.”11

NSO Group employees filed a lawsuit against Facebook in Israel, petitioning the Tel Aviv district court to order Facebook to unblock their accounts – but Facebook declined, and responded that the restrictions continue to be necessary for security reasons.12

The NSO Group co-founder claims that what Facebook did was “a hypocrisy.” It’s his belief that because every sale is approved by the Israeli government, employing the NSO Group prevents governments from using what would be considered more dangerous platforms. Shalev Hulio has said, “Instead of them, like, actually saying, ‘O.K., thank you,’ they are going to sue us. Fine, so let’s meet in court.”13

Getting caught in the act of breaching the tech giant WhatsApp – and the subsequent lawsuits from Meta and Apple signals a deep shift and a new kind of faceoff we have not yet seen before – between Silicon Valley against spyware vendors – particularly the NSO GROUP.

Now, the tenacity of the NSO Group would be tested – in the American courts.

MEDIA CLIP: WhatsApp is accusing an Israeli based spyware company called NSO of selling technology to hack into the phones of 1400 WhatsApp users.14
MEHUL SRIVASTAVA: The NSO Group had figured out that if you sent a specific kind of file to somebody’s WhatsApp number, it would download Pegasus.
OTTO EBELING: From a technical point of view, the attackers had studied WhatsApp very carefully and they repurposed various features in quite creative ways.
CLAUDIU DAN GHEORGHE: We never built WhatsApp and the voice and video calling thinking that it could be used for spying.

ROSE: This is Shoot the Messenger, a new biweekly investigative reporting podcast from EXILE Content Studio.

Every season, we investigate one international news story. You may have heard the headlines; this is the deep dive. I’m Rose Reid.

NANDO VILA: And I’m Nando Vila. When Rose and I started reporting on this project we had one question: what is the biggest threat to journalists today?

When we put up a bulletin board and stuck a pin for every journalist threatened or assassinated in the past 5 years, we found one repeating link over and over. From Mexico, to DC, to the United Arab Emirates: Pegasus.

Over the course of ten episodes, we’re doing a special partnership with the Committee to Protect Journalists for our first season, “Espionage, Murder, and Pegasus Spyware.”

KYLE McLORG: Even if you are in a place that you believe is safe, that doesn’t necessarily mean that you’re safe from NSO’s technology.
NATALIA KRAPIVA: The industry has become really a Wild West. There is no oversight. It’s not controlled how it’s used against whom. And so this is really a bigger problem.
MEDIA CLIP: If Facebook and Amnesty International win their cases against NSO, it could be a victory in the battle to protect people’s privacy.15

ROSE: In response to the WhatsApp lawsuit, the NSO Group issued a public statement saying: “In the strongest possible terms, we dispute today’s allegations and will vigorously fight them.” The NSO Group argues that its technology has saved thousands of lives, takes misuse of its contracts seriously and claims their technology is “rooted in the protection of human rights.”16 The co-founder shared with The New Yorker that “I don’t know if we’ll win, but we will fight.”17

It’s reported that inside the offices of the NSO Group headquarters, there is a whiteboard with a single word underlined: “War!”18

This is Episode 5: WhatsApp and Facebook Take the NSO Group to Court

NANDO: The WhatsApp lawsuit alleges that the NSO Group violated both federal and California state law by breaching WhatsApp contracts, committing computer fraud, and wrongfully trespassing on “Facebook property.”19

Because WhatsApp traced the Pegasus breach back to servers belonging to the NSO Group – it wasn’t even disputed if Pegasus or the NSO Group were behind the attack.

But two things made the case complicated. The first question: which party was to blame? Was the NSO Group the right entity to sue, or its customers?

And second: can an American company sue an Israeli company that is providing a special service to sovereign nations? Do they have immunity to be sued in US courts?

KYLE: Generally what happened was between April and May 2019, NSO used its Pegasus technology to exploit vulnerabilities and WhatsApp servers, to infect the smartphones of 1400 people around the world.

My name is Kyle McLorg. I am an attorney at Farella Braun and Martel in San Francisco. I have been representing a group of civil society organizations led by Access Now since 2019 in relation to the WhatsApp v NSO case.

And investigations by WhatsApp and the Citizen Lab at the University of Toronto revealed that at least 100 of these 1400 people were civil society actors. So that means they’re dissidents, journalists, human rights activists, opposition party politicians. And I say at least because that’s just what WhatsApp and Citizen Lab could piece together after the fact. So the actual number of civil society actors who could have been targeted specifically in this WhatsApp infiltration could very well be higher.

NATALIA: When we learn about this case that WhatsApp filed against NSO, we sort of – Access Now – we convene this coalition of organizations and decided that it would be a great opportunity to come in and provide our expertise on the issue of spyware and then also Pegasus in particular.

I’m Natalia Krapvia and I’m a technical counsel at Access Now, a digital rights organization that defends the rights of users at risk. And I do what I do because I think that human rights should be defended online, just as they are in the physical space.

ROSE: Natalia Krapiva is an attorney at Access Now, which is an organization that focuses on defending and strengthening human rights protections around the world to effect real-time policy.

NATALIA: So we consider users at risk to be those who are especially vulnerable online, such as journalists, human rights defenders, activists, bloggers, so they are vulnerable to being targeted.

ROSE: WhatsApp filed its lawsuit against NSO Group in a California Federal Court in October, 2019, over 2 and 1/2 years ago. The case has been winding its way through the US court system as the NSO Group has sought every delay and appeal possible in an effort to thwart WhatsApp’s legal team and its allies from having their case heard in a US court of law.

Kyle McLorg explains the intricacies of the legal process and the underlying principles that NSO Group has tried to use to shut this lawsuit down. The NSO Group claims that they should receive what’s called “foreign sovereign immunity,” which would prevent them being sued in the American court system.

KYLE: There is a doctrine in United States law called foreign sovereign immunity that says that foreign governments cannot be sued in United States courts. Foreign sovereign immunity is a doctrine that goes back to the 1800s. And ultimately, what the court decided was that foreign governments cannot be sued in US state courts. Certainly the United States would not want to be sued in a foreign court. And so eventually in the 1900s, the US legislature passed what’s called the Foreign Sovereign Immunity Act. And this was basically the theory that NSO relied on in arguing that they were immune; is that they were just acting as agents for foreign governments.

NANDO: The foreign sovereign immunity doctrine has been relied on for decades by foreign diplomats and government officials to relieve them of all kinds of transgressions they may have committed. It provides immunity for things as minor as excessive parking violations to actions as serious as extreme violence, and even murder.

MEDIA CLIP: A Saudi activist accuses NSO of providing the kingdom with the spyware required to hack his phone conversations with journalist, Jamal Khashoggi.20
MEDIA CLIP: The fiancee of murdered Saudi journalist, Jamal Khashoggi, has filed a civil lawsuit in the United States against Saudi crown prince Mohammed bin Salman…21

ROSE: In a controversial decision just a few months ago, the Biden Administration determined that the Saudi crown prince, Mohammed Bin Salman, had foreign sovereign immunity in regards to the lawsuit Jamal Khashoggi’s fiance brought against the royal family in American courts regarding his involvement in Khashoggi’s murder.

The NSO Group is arguing that they also have foreign sovereign immunity.22

KYLE: What NSO argues is that WhatsApp doesn’t have grounds to actually sue foreign governments in United States courts. The other reason is, this is NSO’s technology, NSO has all of the people who run it and certainly the know-how in order to actually make these attacks work. And while NSO is arguing that they are simply providing a service or even just a piece of technology, I think there’s a belief that that NSO is the one who is actually driving these attacks when they happen.

NATALIA: They say, well, we’re in Israel. The victims, they were outside of US. And so there is no reason for the US courts to have jurisdiction.

KYLE: WhatsApp filed their complaint in the Northern District of California and it basically told the Court what it had learned through its investigation and through the Citizen Labs’ investigation about how NSO infiltrated its servers.

WhatsApp suit alleged four separate causes of action. Two of them were based on statutes, and then two of them were based on general contract and tort principles. So one of the causes of action is based on the Computer Fraud and Abuse Act. That’s a federal statute that was passed in the 1980s, and it was designed to prevent hacking.

The next was for violations of California’s comprehensive Data Access and Fraud Act. And then they alleged breach of contract that is generally based on violation of terms of service. You know, in order for NSO to actually use Pegasus and target people through WhatsApp, they had to set up WhatsApp accounts and agree to their terms of service. And so this is a pretty actually straightforward cause of action that basically says: “You violated our terms of service by using WhatsApp to target and surveil people.” And then, the last cause of action is called trespass to chattels. And it’s a common law claim that basically protects property.

NANDO: As WhatsApp filed the case – they are the plaintiff. The NSO Group is the defendant in this case, and they had a couple of options how to respond to the lawsuit:

KYLE: After a plaintiff files a complaint in a civil case, the defendant has a couple of options. One is that they can answer it, which is essentially just filing a paper that either admits, denies or pleads lack of knowledge to the allegations in the complaint, or they can do something what’s called moving to dismiss, essentially telling the court this case shouldn’t go forward. And so they chose that second option.

Because NSO is an Israeli company – they are not located in the US – and so they raised issues about whether the court could actually require it to appear in California federal court. And one of the arguments that they made is what ended up being the main controversy on appeal, is: they claimed that the court did not have subject matter jurisdiction under this doctrine called foreign sovereign immunity. The district court disagreed with that assertion and ultimately denied the motion to dismiss in its entirety.

ROSE: If the NSO Group can get a court to support their claim of foreign sovereign immunity – they would avoid trial completely. The case would be dismissed and there would be no testimony or evidence. WhatsApp would never have its day in court. So when the district court of California denied NSO Group’s claim to foreign sovereign immunity – and held that the lawsuit filed by WhatsApp, and its parent company Facebook could proceed against the NSO Group,23 the NSO Group appealed.

That appeal goes to the circuit court of appeal – in this case the Ninth Circuit – which oversees California:

KYLE: And so NSO went to the Ninth Circuit and said, hey, the district court made a mistake here. It needs to be decided immediately before this case can go forward. And so that they ended up appealing to the Ninth Circuit on those grounds.

JEFFERY BUCKHOLTZ: Good morning, Your Honor. May it please the Court Jeffrey Buckholtz for NSO.24

JUDGE MURGUIA: You may proceed. Thank you.

ROSE: This is an excerpt from the hearing of NSO Group’s appeal to the Ninth Circuit Court. The NSO Group’s lawyer is asking the court to recognize it has foreign sovereign immunity, which would dismiss WhatsApp’s case and prevent a trial.

JEFFERY BUCKHOLTZ: The District Court found, based on NSO’s undisputed evidence that Facebook is trying to hold NSO liable for its official conduct as an agent of foreign sovereigns. Under that finding, NSO is entitled to conduct based immunity.25

ROSE: There are three judges present at the hearing. These are edited excerpts of their initial response to NSO’s request for foreign sovereign immunity:

JUDGE MURGUIA: We have to ask, I suppose, whether the ground of immunity sought is one which the State Department has an established policy of recognizing. So how do we grant the immunity that you’re asking for in this case where there’s no apparent example of the executive branch ever suggesting immunity for a private foreign corporation?

JUDGE HUNSACKER: In the over 200 year history of our country, we have no example of foreign, sovereign immunity being granted to a private company.

ROSE: NSO legal counsel stresses that it’s the clients of NSO – sovereign governments – not the NSO Group, that are operating its tools. Here’s another edited excerpt.

JEFFERY BUCKHOLTZ: So, Your Honor looks at the declaration from NSO’s CEO Mr. Hulio explains what NSO does and what NSO does not do. And it is absolutely the case that NSO does not operate the software on behalf of its foreign state customers. It does not decide who the foreign states should use this tool to conduct an investigation over how to conduct those investigations. That is within the sovereign authority of the foreign states, what NSO does is it installs the software for the foreign states. NSO doesn’t operate the software itself.

ROSE: WhatsApp’s legal counsel disagrees. Here’s another edited excerpt:

MICHAEL DREEBEN: WhatsApp was victimized by the use of Pegasus, by the foreign states with the support of NSO. It monitors its clients activities, allegedly to determine whether they have complied with the restrictions in the contracts, which is incidentally a practice that puts NSO potentially at odds with its foreign clients and makes it look a lot less like an agent than an independent corporate actor.

KYLE: And ultimately the Ninth Circuit decided that there was no merit to NSO’s argument. And so they denied that appeal as well.

JUDGE MURGUIA: The case of WhatsApp versus NSO Group Technologies Ltd is submitted. Thank you.

KYLE: And the Ninth Circuit issued a pretty lengthy opinion that quite forcefully denied NSO and said, we disagree with you entirely on your foreign sovereign immunity arguments. It was one of the most forceful rebukes of a legal theory that I’ve ever read, actually.

ROSE: The Ninth Circuit Court of appeals denied NSO’s petition to receive foreign sovereign immunity.26

The Ninth Circuit Court is the highest court of appeal in the state of California.

As a recap of the federal system – there are three main levels. There are 94 district courts throughout the country (the trial court), 13 circuit courts serving all 50 states – which are the first level of appeal (and the Ninth Circuit Court of California is one of those thirteen), and then one Supreme Court of the United States, which is the final level of appeal in the federal system. The NSO Group had one last option – to appeal beyond the Ninth Circuit Court – to the US Supreme Court.

That’s after the break.

****

CARRIE: My name is Carrie.
MICHAEL: My name is Michael.
LORIN: Lorin.
EMILY: I’m Emily.
MEREDITH: Meredith.
YONI: Yoni.
CARRIE: I live in Brooklyn, New York.
EMILY: I live in Cartersville, Georgia.
LORIN: Charleston, South Carolina.
YONI: Oakland, California.

ROSE: Hey Shoot the Messenger listeners, this is Rose Reid, your host. I’ve spent close to two years researching this story on Pegasus, and when I first started, I didn’t know anything about spyware – unless it was in the movies.

And working on this story, I had endless questions about how this spyware was being used. Not just as a journalist, but as a person living in the digital age, always online. And I figured that you might have questions about it too.

MEREDITH: I want to learn more about Pegasus spyware and how it works
YONI: Who gets to decide where it gets sold to and how it gets used?
CARRIE: I’m curious if there’s a way to detect if your phone’s infected with Pegasus?

ROSE: We want to hear from you – what do you want to know about Pegasus? Do you have questions about what happened to Jamal Khashoggi? Leave us a voicemail at 805-328-4491 or send us an email with your question, or even a voice memo at stm@exilecontent.com. We can’t wait to hear from you.

****

NANDO: After the NSO Group’s appeal was denied by the Ninth Circuit Court of Appeals, they had one last and final option in order to avoid going to trial – they appealed to the United States Supreme Court.

KYLE: They have filed a petition for writ of certiorari to the Supreme Court. Which basically means they’re asking the Supreme Court of the United States to take up the appeal now. And they want the court to say that the Ninth Circuit was wrong.

ROSE: Kyle and Natalia are lawyers who worked together to represent civil society, forming a coalition of organizations – Access Now, Amnesty International, Reporters without Borders, and the Committee to Protect Journalists – along with several other organizations27 to provide additional material in support of WhatsApp’s lawsuit against the NSO Group as a petition to the Court in what is called an amicus brief.2829

KYLE: We did end up filing an amicus brief for the Ninth Circuit Court of Appeals in that case. And so we continue to represent them throughout this process. So an amicus brief is a friend of the court brief. And what they do is they provide the court with a perspective that the parties cannot provide, because by definition, an amicus is not a party to the case. They’re an interested non-party. And they have a view or possibly a preferred outcome in the case that they’re filing the brief in.

NATALIA: So the goal of this brief was to provide something that was missing from the case. So the case, the WhatsApp versus NSO case, it’s a case between two companies and it’s about servers and loss of profits, loss of business. But it doesn’t really give enough understanding of the impact that this targeting had on those users. How did this targeting of WhatsApp servers and ultimately right of the devices, how did it impact the actual people such as community organizers, activists and journalists in various countries?

KYLE: There is data out there that tends to show that they can be quite impactful and that they often do play a significant role in the outcome of cases, both in appeals courts and at the Supreme Court level.

And our goal was how do we tell a small number of stories of people who were actually infected in this WhatsApp hack, that would really move the Court. We told the stories of five different people:

MEDIA CLIP: Since I had a mobile in my hand, immediately I was noticed and then they came after me, threateningly.30
MEDIA CLIP: For those who have been following in detail what has been going on in Morocco, they have seen the writings on the wall. Because the first bannings of newspapers started in 2000.31
MEDIA CLIP: We ask the Rwandan government about its alleged involvement in the spyware scandal.32

KYLE: One is a former Rwandan national who is now in exile in Belgium. One is a Catholic priest in the western African country of Togo. Two are in Morocco. One of them is a journalist and one of them is a human rights activist going back to even the previous regime. And then one is an activist and an attorney in India. And, you know, over the course of that work, we interviewed them. We did a lot internet research looking for reputable news organizations that credibly backed up these victims’ stories.

NANDO: One of the five victims Kyle and Natalia focused on was Placide Kayumba, from Rwanda:

PLACIDE KAYUMBA: I think we are really on regular basis targeted by the regime and, uh, it’s not a surprise for me to know that they have been trying to spy my phone.33

ROSE: Placide Kayumba is a member of the opposition party to the government in Rwanda. Although living in Europe, he is part of an organization that supports democratic government in Rwanda.

Rwanda is believed to be an NSO Group client. Pegasus Project has estimated that more than 3,500 phone numbers, including those of activists, journalists, political opponents, foreign politicians and diplomats of interest to Rwanda, had been selected as potential targets for the spyware.34

Kayumba lives in exile in Belgium – but he is in regular communication with people in Rwanda, and within the diaspora of other Rwandans living in exile. He recalls the moment he realized he could have been a target:

PLACIDE: As I saw that Rwanda was among 40 countries that are using the Pegasus Spyware I was quite sure that I was targeted. I’m the third vice president of our political party. When I used WhatsApp, sometimes I couldn’t hang up. I used to think there was a problem.35

ROSE: Kayumba left Rwanda as a child in 1994, but he says even now, he doesn’t feel safe living in Belgium.36

KYLE: NSO’s argument was your reliance on periodicals and newspaper articles and these victims’ stories is not appropriate at this stage of the litigation. And they tried to get our amicus brief kicked out from the court for that reason. Ultimately, the court disagreed. I wanna say we were one of four or five different Amichai. All all on the side of WhatsApp, none on the side of NSO.

NANDO: The amicus brief filed by Kyle and Natalia narrowed their focus on the human element – the people behind the “target” – the life belonging to the identified phone number.

For Kayumba, his life was turned upside down – he had to adjust to a new reality.

PLACIDE: This is very shocking news. We used it because it was safe, that WhatsApp was encrypted so it was, uh, really safe. And unfortunately it was like a trap. The problem is that there’s no any other mean to talk with people in Rwanda, in the region.37

ROSE: Rwanda is still recovering from the genocide that occurred in 1994. Since, at least 2 million have fled Rwanda, and its estimated five million died in the decade of conflict.38 Many live like Kayumba – abroad with dreams of returning home. They stay connected with family, friends, and others living inside and outside Rwanda online and on their phones.39

NATALIA: We argue that the law, human rights law should apply just as well in the digital space as it applies in the physical space. And in some cases, we need even more protection online than in digital sphere. If you have access to your digital device, that presents a whole other set of information about you that is now accessible to the government. And so for that reason our organization argues that, you know, we really need to put measures in place to really respect human rights online. And I think the courts and international bodies and experts have really been doing that and accepting the importance of the Internet and social media, for example, as sort of enablers of human rights, such as freedom of expression, freedom of assembly, but also others like right to education and work and so on.

So certainly when the government retaliates against them for their speech or organizing, then that violates those rights under international conventions. It could be also argument made that very essential the most essential rights, the right to life, freedom from torture, enforced disappearances, that they’re also violated when spyware is used to to kill or torture someone or make them disappear.

ROSE: Can we call this a crime?

KYLE: You know, that’s an interesting question. It depends on which country you’re asking. I think that for a lot of the countries of the victims whose stories we told in our amicus brief, what the NSO technology does is not a crime. One of the reasons that NSO contends that what they do is okay is because they say that they’re subject to these strict regulations under Israeli law, and they claim that their technology is only used to fight terrorism or investigate crimes. But the loophole in that is pretty obvious once you stop and think about it for a second, because in so many of these countries, dissent and human rights activism are considered crimes. If we’re talking about a country like Rwanda or a country like Morocco or Togo, certainly using spyware technology to surveil people and follow them is not considered a crime at all.

NANDO: For Kayumba, he’s not just thinking about his own safety, but also about others who might have been identified through his communications.

PLACIDE: I fear for people in Rwanda, particularly. Those people with whom I’ve been exchanging messages, even if there is no criminal messages that we have exchanged, it was just about freedom, about what is going on in Rwanda, I fear that they will be killed.40

NATALIA: People sometimes have this very abstract idea of what hacking is, but this makes it very real and I think brings it really home. These days we’re living our entire lives essentially on our phones. Some of the information actually gets leaked and publicized also, to retaliate and discourage the people from, you know, publishing inconvenient articles or criticizing the government. Certainly I think a sample of those cases is really representative of what we are seeing overall from other victims of Pegasus and other spyware.

KYLE: A lot has transpired since we wrote this Ninth Circuit brief. And when I say a lot has transpired, I mean, there have been substantially more victims of Pegasus while this case is going on. It’s happening all over the world to people in all walks of life.

NANDO: One of the points that the amicus brief was trying to demonstrate – isn’t just the lived experience of those targeted by Pegasus, but the impact and ripple effects its had on their lives:

NATALIA: This fact just of knowledge that they were targeted is powerful enough to create this sort of sense of deep insecurity and trauma. You know, because imagine the horror, you going back in time and thinking, Oh, what was I doing at the time? Maybe I was talking to this as a journalist. You know, I was talking to the source and now they are in danger, and what can happen to them and what will happen to the trust, you know, that I’ve been building with this person. All of these things are exposed and not just to anyone, but again, to your sort of worst adversary. Again and again, we hear from victims and and often again, we hear this really, we sense this real trauma from coming from this experience.

KYLE: We knew that we had a different perspective and a different angle to provide. So our focus was that we need to let the Ninth Circuit know what the real world first person impacts of NSO’s technology are.

NATALIA: The industry has become really a Wild West. There is no oversight. It’s being sold to the worst of the worst offenders of human rights. It’s not controlled how it’s used against whom. And so this is really a bigger problem.

KYLE: You ask people from around the globe, I mean, you know, our victim who is an exile from Rwanda was targeted while living in Belgium. And so that should put in perspective that, you know, even if you are in a place that you believe is safe, that doesn’t necessarily mean that you’re safe from NSO’s technology.

ROSE: In response to NSO’s petition to receive foreign sovereign immunity, in December of 2020, tech giants got together to file an amicus brief of their own, opposing that concept of immunity. Cisco, Dell, Microsoft, Github, Google and LinkedIn, all together filed an amicus brief in opposition to the NSO Group’s claim.41

Their brief argued that awarding foreign sovereign immunity to the NSO Group would lead to a proliferation of hacking technology and “more foreign governments with powerful and dangerous cyber surveillance tools”42 which would encourage more cyber security firms to create and sell tools that exploit vulnerabilities.

And that this would dramatically increase more opportunities for those tools to “fall into the wrong hands and be used nefariously.”

Because the WhatsApp case kept being appealed – and was then sitting in the Supreme Court’s docket – there was no discovery made. Discovery happens before a trial in a lawsuit in which each party investigates the facts of a case, through the rules of civil procedure, and is entitled to obtain evidence from the other party. This could include a range of confidential material – from texts, emails, business contracts, or even depositions.43

NATALIA: Discovery is something that NSO has really been fighting against. They don’t want the information to be revealed about their operations. I mean, the whole business model is dependent on secrecy and lack of transparency. So they know that once the information starts coming out, it will expose them. And it will help not only WhatsApp and Apple’s cases, but it will also help the many cases around the world that are being filed against them and some are waiting to file those cases, but they’re missing evidence. So things like who are the clients of NSO, because some of the countries are not even public yet their clients. And what is the extent of NSO’s involvement in those targetings?

NANDO: Many cases go to the Supreme Court – but not all are heard. The US Supreme Court can choose which cases they want to hear – and for the cases they don’t hear, those go back to the lower courts.44 The US Supreme Court asked the Country’s highest lawyer – the solicitor general – the top lawyer in the executive branch of the Biden administration to weigh in.45 Should the US Supreme Court hear NSO Group’s appeal? Does the State Department have an opinion? Is the NSO Group’s argument to receive foreign sovereign immunity valid?

KYLE: For people who aren’t familiar with what the solicitor general is, they are essentially the attorney for the United States. They argue for the United States when a case comes up in the Supreme Court that involves the United States. And so when the court calls for the opinions. Or views of the solicitor general, they are asking the solicitor general to talk to the interested Department of States, to talk to the parties, and then essentially to issue an amicus brief to the court, letting it know whether or not the solicitor general thinks they should actually hear the appeal.

NANDO: In November of 2022, the solicitor general came back with an answer for the Supreme Court.46

MEDIA CLIP: The US Supreme Court lets WhatsApp group pursue Pegasus Spyware lawsuit… And basically the Supreme Court have upheld the lawsuit, saying that you can’t get immunity.47

ROSE: The State Department said unequivocally that NSO does not have foreign sovereign immunity, saying that the Supreme Court should not hear NSO’s appeal because “neither the United States nor any foreign sovereign has supported NSO’s claim to immunity.” And the brief went on to point out that “the NSO Group itself has not even identified the foreign sovereigns for which it claims to have acted as an agent” and they’ve provided little detail about “the nature and contours of those purported agency relationships.”48

And so in January of this year – the Supreme Court made its decision. In a massive win for WhatsApp, and all the parties supporting their lawsuit, the US Supreme Court denied NSO Group’s petition to review its foreign sovereign immunity claim.

Which means that the case will continue – it will go to trial in the California district court.

NATALIA: The Ninth Circuit decision, the lower court’s decision stands right and WhatsApp prevails, NSO has no immunity. So the case can proceed. It goes back again to the district court level and proceeds to discovery. But we also have a valuable precedent, that companies cannot take advantage of the sovereign immunity doctrine to escape accountability.

ROSE: Since, the State Department blacklisted the NSO Group.49

MEDIA CLIP: The Israel spyware company was blacklisted in November by the US Commerce department, which claims its clients were using the software for dubious purposes…50
MEDIA CLIP: “How significant is it for the commerce department to blacklist NSO Group?” – Nicole Perlroth: “It’s the furthest an American President has gone to try to curb spyware abuse.”51
MEDIA CLIP: The NSO has put itself at odds with perhaps the strongest forces in the world – which is not the White House, but big tech.52

NANDO: The day after the blacklisting, NSO Group could no longer buy American products for its businesses – that means Windows operating systems, Dell computers, Apple iPhones, Amazon cloud servers – any hardware or software made by an American company – the kinds of products it has relied on to run its business. Co-founder Shalev Hulio said to reporter Ronan Farrow for The New Yorker, “It’s outrageous – we never sold to any country which is not an ally of the US, or an ally of Israel. We’ve never sold to any country the US doesn’t do business with.”53

The case will proceed and as we speak, discovery is underway.

NATALIA: When the truth comes out, the information has been revealed at this point has really made them suffer financially, not only just reputationally, but financially. they’re struggling right now with investors. It’s really for them and a matter of life or death now for, for the company to survive. So obviously, they don’t want that information to be revealed.

ROSE: Trial is set to begin December 2, 2024 in the Oakland, California Courthouse.

What does it mean that WhatsApp and the NSO Group are going to face each other at a trial? What’s at stake?

KYLE: Oh, there is a lot at stake. What does it mean if NSO gets its way here. And what does it mean if WhatsApp succeeds and finds a way to hold NSO accountable? WhatsApp is going to have the ability to learn a lot about how NSO Group works and who its country clients are and exactly how this infiltration took place. And so I think the implications of that are pretty substantial. The court is going to have a lot of really, really damning stuff about about NSO Group.

In so many countries there really is no recourse for victims of of NSO’s spyware. And so for them, the only recourse that’s really available, is a US court holding this company accountable for attacking technology that these people rely on. Technology that people all over the world use and they need to use it because it’s safe.If NSO’s technology is, is stopped, then I think it makes the world a safer place for everybody and certainly civil society actors around the world who are trying to affect positive change in their own countries.

NANDO: The NSO co-founder Shalev Hulio told The New Yorker, “People can survive and can adapt to almost any situation.”

NSO is looking at a couple of paths – one reported solution was to sell to Pegasus to more egregious human rights violators – and their board refused to approve. The other pathway is to expand the product line. They are building a new tool they are calling “Maestro” that can process surveillance data, and then build models of someone’s relationships and schedules based on that data. Essentially, a minority report version of trying to anticipate the routine of a criminal committing a crime.

The question is, what will the NSO Group do next – and how far reaching is the financial web that underwrites this company and a product like Pegasus?

SCOTT STEDMAN: NSO Group founders have made statements in court, statements to the public, statements to press, that are verifiably false, especially when it comes to the finances.
KAYE WIGGINS: So just at the time when the Pegasus Project has come out and NSO is in the headlines again, behind the scenes, there’s also this kind of total chaos at the private equity firm that owns NSO.
MEHUL: We know nothing about this industry other than a few players and a little bit of abuse. We should be very, very worried.

NANDO: That’s on the next episode of Shoot the Messenger

ROSE: Shoot the Messenger is a production of Exile Content Studio.

We are distributed by PRX.

Hosted by me, Rose Reid and Nando Vila. Produced by me, Rose Reid, with Sabine Jansen, Nora Kipnis, and Ana Isabel Octavio.

Written by me, Rose Reid. With story editing by Gail Reid.

Production assistance by Alvaro Cespedes, Andrea Zevallos, and Stella Emmett.

Daniel Batista oversees audio at Exile Content Studio.

Sound design and mixing by Pachi Quinones.

Executive producers are myself, Rose Reid, along with Nando Vila, Carmen Graterol, and Isaac Lee.

Special thanks to Sonic Union, Fernando Suarez and Carla Lechuga.

For more information on the status of journalists and freedom of the press – visit the Committee to Protect Journalists at cpj.org.

To learn more about EXILE, our other podcasts and films, visit exilecontent.com.

We want to hear from you – find us on Twitter and Instagram @exilecontent.

Or, send us a voice memo with your questions about Pegasus to stm@exilecontent.com.