On Monday, the Supreme Court called for the views of the Solicitor General in NSO Group Technologies Ltd. v. WhatsApp Inc. The Ninth Circuit held that NSO Group Technologies Ltd and Q Cyber Technologies Ltd (collectively, NSO) could not claim immunity from suit under federal common law for alleged violations of federal and state law because the Foreign Sovereign Immunities Act (FSIA) deals comprehensively with the immunity of corporations and occupies the field. (Disclosure: I joined an amicus brief with Chimène Keitner and Sarah Cleveland arguing for this result.) In its petition for certiorari, NSO argues that the Ninth Circuit is mistaken and that corporations can claim immunity under federal common law when they act as agents for foreign governments.

There are several reasons the United States might recommend that the Supreme Court deny certiorari in NSO’s particular case. First, as I have explained elsewhere, there is no conflict among the circuits on the question presented. Second, no foreign government has stepped forward to assert immunity on NSO’s behalf. Third, NSO has itself been sanctioned by the United States for supplying “spyware to foreign governments that used these tools to maliciously target government officials, journalists, businesspeople, activists, academics, and embassy workers.”

But there is an even more fundamental reason to recommend against cert. It is not in the interests of the United States to create immunity for corporations that goes beyond the terms of the FSIA and international law by shielding from suit contractors for foreign governments.


In 2019, the messaging platform WhatsApp sued NSO, alleging that the Israeli company sent spyware through WhatsApp’s servers to approximately 1,400 mobile devices in violation of state and federal law. NSO argued that it was immune from suit because it had been hired by undisclosed foreign governments.

As previously reported on Just Security, the Ninth Circuit rejected that argument. It held that the FSIA “occupies the field of foreign sovereign immunity as applied to entities and categorically forecloses extending immunity to any entity that falls outside the FSIA’s broad definition of ‘foreign state.’” That definition includes “any entity”  that “is an organ of a foreign state or political subdivision thereof, or a majority of whose shares or other ownership interested is owned by a foreign state or political subdivision thereof.”

NSO analogized its position to that of a foreign government official, noting that the Supreme Court held in Samantar v. Yousuf that the FSIA does not apply to foreign officials, whose immunity is governed instead by federal common law. But the Ninth Circuit distinguished Samantar, noting that “[w]hile the FSIA was silent about immunity for individual officials, that is not true for entities—quite the opposite. . . . If an entity does not fall within the Act’s definition of ‘foreign state,’ it cannot claim foreign sovereign immunity. Period.”

NSO’s petition asked the Supreme Court to call for the views of the Solicitor General if the Court did not grant the petition outright. Now that the Court has done this, it is worth discussing the considerations that might inform the U.S. government’s position.

Customary International Law

The United States might be concerned about denying immunity to NSO if doing so would put the United States in breach of international law. But customary international law does not require immunity for corporations that work for foreign governments.

Customary international law does require some immunity for foreign government officials. As Chimène Keitner and I have recently described, foreign heads of state, heads of government, and foreign ministers are absolutely immune from suit while they hold office, whereas other officials and all former officials are entitled to conduct-based immunity for acts taken in their official capacity. NSO’s petition argues that customary international law requires immunity for anyone who acts as an agent of a foreign government. But the cases it cites—like Jones v. Ministry of Interior (2006) and Church of Scientology (1978)—all involved natural persons, not corporations. NSO does not cite any decisions extending conduct-based immunity to corporations, much less demonstrate the general and consistent practice of states that would be required to establish a rule of customary international law.

NSO also relies on the United Nations Convention on Jurisdictional Immunities of States and Their Property, which the United States has not ratified. The U.N. Convention extends immunity to “representatives of the State acting in that capacity.” But the drafting history of this provision makes clear that “representatives” refers only to natural persons (as explained in this amicus brief).

The U.N. Convention also extends immunity to “agencies or instrumentalities of the State or other entities, to the extent that they are entitled to perform and are actually performing acts in the exercise of sovereign authority of the State.” But the requirement of exercising sovereign authority is a demanding one. The Commentaries to the Draft Articles on which the Convention is based give the example of banks entrusted to deal with import and export licensing, an authority it describes as falling “exclusively within governmental powers” (Commentary (15) to Draft Article 2). Rather than adopting such a test in the FSIA, Congress extended immunity only to corporations that are organs of a foreign state or majority-owned by one. It has not been suggested that Congress thereby violated customary international law. To the contrary, this provision gives corporations more immunity than customary international law requires.

State practice, in the form of other countries’ statutory codifications, also does not support immunity for government contractors generally. Some states do extend immunity to separate entities that exercise sovereign authority or sovereign power: Japan (art. 2(iii)), Pakistan (art. 15(2)), Singapore (art. 16(2)), South Africa (art. 15(1)), and the United Kingdom (art. 14(2)). Australia (art. 3(1)) limits these entities to ones that can be considered an “agency or instrumentality” of a foreign state. And Canada (art. 2) and Israel (art. 1) exclude corporate entities from their definitions of “foreign state” entirely.

NSO itself does not claim to have exercised any “sovereign authority.”  Given the lack of support for any broader immunity for foreign government contractors, there seems no risk that the United States would violate international law by denying NSO immunity.

Protecting U.S. Contractors

NSO’s strongest pitch to the U.S. government is that the United States must protect foreign government contractors from suit in U.S. courts in order to protect U.S. government contractors from suit abroad. “If such contractors can never seek immunity in U.S. courts,” the petition says, “then the floodgates will open to foreign suits against U.S. contractors designed to interfere with the United States’ most sensitive intelligence and military operations.”

But NSO’s petition identifies no cases in which U.S. government contractors have been sued abroad. Instead, it cites cases in which U.S. government contractors have been sued in the United States for their work abroad. It makes sense for such suits to be brought in U.S. courts rather than in foreign courts. U.S. courts have personal jurisdiction over U.S. defendants, and any resulting judgment is enforceable against their assets in the United States, neither of which is certain with respect to suits in foreign courts. Notwithstanding the current lack of immunity, foreign suits against U.S. contractors do not constitute even a trickle, much less a flood.

Even if foreign suits against U.S. contractors were a problem, immunizing foreign government contractors would not solve it because there is no guarantee that other countries would reciprocate. Other countries are only have to grant immunity when international law requires it. As discussed above, customary international law does not require immunity for corporations except, possibly, when they are exercising the “sovereign authority” of the state.

Other countries are, of course, free to grant more immunity to U.S. government contractors than customary international law requires as a matter of international comity. The United States might hope for reciprocity if it immunizes some foreign government contractors, but international comity comes with no guarantees. As noted above, those countries that have codified their laws of sovereign immunity have not broadly extended immunity to foreign government contractors. Indeed, these countries would have to amend their laws to authorize such immunity, something the mere possibility of immunity for foreign corporations under federal common law seems unlikely to encourage.

Foreign Relations Concerns

The Solicitor General might want to preserve the possibility of suggesting immunity for a foreign government contractor in a future case to avoid foreign relations problems, even if NSO is not entitled to immunity here. But the possibility that the executive branch might suggest immunity in a future case carries with it the certainty that the executive will be asked to do so.

One of the lessons from the pre-FSIA era, when the executive had authority to decide whether foreign states should receive immunity in particular cases, is that having discretion of this kind creates foreign relations problems of its own. As the Supreme Court noted in Verlinden B.V. v. Central Bank of Nigeria, “foreign nations often placed diplomatic pressure on the State Department in seeking immunity.” Congress passed the FSIA at the behest of the executive branch “in order to free the Government from the case-by-case diplomatic pressures.”

In Samantar, the executive branch argued that the FSIA does not apply to foreign officials. Since then the executive has claimed authority to make the rules governing foreign official immunity and to make binding immunity determinations in specific cases, although this authority is disputed. Writing shortly after Samantar came down, former State Department Legal Adviser John Bellinger presciently compared the State Department to the dog that caught the car, for now it would be subject to diplomatic pressures to grant immunity to foreign officials. The State Department should avoid putting itself in a similar position with respect to foreign government contractors, adding an entirely new category of immunity claims for it to deal with.

In addition, when considering questions of immunity, avoiding foreign relations problems is not the only relevant concern. When Congress passed the FSIA, it declared that its purpose was to “protect the rights of both foreign states and litigants in United States courts” (emphasis added). Accordingly, the FSIA places limits on immunity. One of those is to limit the immunity of agencies and instrumentalities to entities that are organs of a foreign state or are majority-owned by foreign states, neither of which is true of NSO. This protects the rights of persons who have allegedly been injured by NSO’s violations of U.S. law, including both WhatsApp and WhatsApp’s users, who had spyware installed on their devices without their consent.

Lessons from Dole Food v. Patrickson

Twenty years ago, in Dole Food v. Patrickson, the United States filed an amicus brief arguing for a narrow interpretation of the immunities available to corporations. In Dole, the relevant defendants were also Israeli companies. Unlike NSO, these companies were owned by the Israeli government through a holding company, though by the time of suit, government ownership had fallen to less than 50%. The United States argued that these companies were not entitled to immunity under the FSIA because Israel did not own them directly and because Israel was not their majority owner at the time of suit. Although NSO’s claim of immunity is not based on the FSIA, the United States’ reasoning in this brief is instructive on several points.

First, in response to the argument that immunity was needed to minimize foreign relations problems, the amicus brief looked to the practice of other countries, noting that they did not grant immunity in similar circumstances. “By and large, foreign states do not grant sovereign-immunity-based protections of any kind to government-owned corporations,” the brief noted, “unless the corporations are engaged in sovereign acts.” As noted above, the same is true for the immunity that NSO claims: foreign states do not grant immunity to corporations based on their status as government contractors.

Second, the U.S. amicus brief pointed out that avoiding foreign relations problems was not the only purpose that Congress had in mind when it passed the FSIA. Quoting the FSIA’s declaration of purpose (noted above), the brief observed that Congress crafted the FSIA’s rules on immunity “to give proper respect to the competing interests of both foreign states and other litigants in United States courts.” Immunizing foreign government contractors, like NSO, would obviously compromise the interests of those harmed by their conduct, like WhatsApp and its users.

Third, the United States pointed to the need for “clear and manageable rules” to govern immunity. “Individuals who do business with foreign corporations need such rules when determining whether they are dealing with entities that may be subject to the FSIA,” the brief said. The FSIA provides clear rules by limiting the immunity of corporations to those that are organs of foreign states or are majority state-owned. NSO’s proposal to supplement the FSIA with federal common law immunity for corporations whenever they act as “agents for foreign governments” would make the availability of U.S. courts much less predictable.


Recognizing the possibility of immunity for corporations under federal common law that goes beyond the terms of the FSIA will not advance the interests of the United States. Such a rule is unnecessary to comply with international law, which does not require immunity for foreign government contractors. It would do nothing to shield U.S. government contractors from suits abroad because it is not required by international law and other countries do not recognize such immunity. It is not necessary to avoid foreign relations concerns and may in fact create such concerns by injecting the executive branch into a new category of immunity claims. It would compromise the interests of other litigants in U.S. courts who may see their potentially valid claims barred. And it would replace the clear lines for corporate immunity drawn by the FSIA with fuzzier rules of federal common law. In the end, the best position for the Solicitor General to take on the immunity of corporations is the one the Ninth Circuit adopted: “If an entity does not fall within the Act’s definition of ‘foreign state,’ it cannot claim foreign sovereign immunity. Period.”

IMAGE: A woman walks by the building entrance of Israeli cyber company NSO Group at one of its branches in the Arava Desert on November 11, 2021 in Sapir, Israel. The company, which makes the spyware Pegasus, is being sued in the United States by WhatsApp, which alleges that NSO Group’s spyware was used to hack 1,400 users of the popular messaging app. An US appeals court ruled in November that NSO Group is not protected under sovereign immunity laws. (Photo by Amir Levy/Getty Images)