NSO Group’s legal problems have deepened after a US appeals court thoroughly rejected the Israeli spyware company’s claim that it ought to be protected under sovereign immunity laws, in a high-profile case involving WhatsApp.

The decision on Monday by the US court of appeals for the ninth circuit means that WhatsApp can proceed with its lawsuit against NSO over allegations that its spyware was used to hack 1,400 users of the app. It also means that the Israeli company will probably have to respond to discovery requirements as the case moves forward. That could lead to new disclosures about who NSO’s government clients are, how its technology works, and the process that is used to deploy its signature spyware, called Pegasus, attacks against mobile phone users.

... In a recent interview with the Guardian, WhatsApp’s chief executive, Will Cathcart, said senior government officials around the world – including individuals in high national security positions who are “allies of the US” – were also targeted in the attack... NSO has said that even if WhatsApp’s allegations were true, it was acting as a “foreign agent” when its spyware was deployed against WhatsApp users, because its software is used by foreign governments who are meant to use its spyware to fight crime. In effect, it sought the kind of protection that a foreign government would receive in a US court. But that argument was rejected.

... The decision was praised by WhatsApp, whose spokesman, Carl Woog, called the decision “an important step in holding NSO accountable for its attacks against journalists, human rights defenders, and government leaders”.

He added: “The spyware industry must be prevented from undermining the privacy and security of people across the world. We are grateful for the support from privacy and human rights NGOs and technology companies.”

The case is far from over. Now the court will hear arguments about whether NSO ought to be held responsible for the attacks...

NSO has said it would challenge the ruling. The company did not immediately respond to the Guardian’s request for comment on the court ruling.