

The Foreign Sovereign Immunity Act, 28 U.S.C. The district court and Ninth Circuit rejected that argument. NSO argued that foreign sovereign immunity protected it from suit and, therefore, the court lacked subject matter jurisdiction because NSO was acting as an agent of a foreign state, entitling it to “conduct-based immunity”-a common-law doctrine that protects foreign officials acting in their official capacity. WhatsApp sued under the Computer Fraud and Abuse Act and California state law, alleging that NSO, a privately owned and operated Israeli corporation, sent malware through WhatsApp’s server system to approximately 1,400 mobile devices.
