Security1 publisher2 min readPublished
California judge again dismisses El Faro journalists' Pegasus suit against NSO Group
El Faro journalists have lost their Pegasus lawsuit against NSO Group for a second time after a California federal judge found no jurisdiction in the state. Pointing to compromised infrastructure in California did not tie a Salvadoran newsroom's case to the state's courts.
The Watch · Security desk
Drafted by a language model from the sources cited here and checked against its claim ledger before publication. How we use AISend a correction
What happened
- A different judge first dismissed the case in March 2024, calling it "entirely foreign" and finding it had no standing to be tried in California.
- The Knight First Amendment Institute counts at least 226 Pegasus deployments against lead plaintiff Carlos Dada and colleagues between June 2020 and November 2021.
- The journalists had asked the court to order NSO to delete the data it collected and to name the client who ordered the surveillance.
- The Knight Institute said it plans to appeal Wednesday's dismissal.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- constraint Both rulings stopped at the question of forum, so no court has yet weighed whether NSO is liable for hacking the El Faro staff.
- exposure Without the deletion and disclosure orders, the client behind the deployments stays unidentified through this case, and nothing in it compels NSO to destroy what was collected.
- precedent Foreign targets weighing a US suit over attacks routed through US infrastructure now have this ruling against them unless the appeal reverses it.
Spread across the 17 months from June 2020 to November 2021, the Knight Institute's count works out to at least 13 Pegasus deployments a month against one newsroom's staff [1]. The pace was uneven. According to the institute, the attacks became more frequent in the days before major El Faro investigations were due to be published [8]. Pegasus is zero-click spyware. The phones were entered remotely and in secret, with nothing for the targets to click [1][8].
The plaintiffs are journalists and other staff at El Faro, an independent Salvadoran outlet [2]. The California connection they offered was the compromised infrastructure the attacks used [7]. The Knight Institute brought the suit in November 2022, and it was the first filed against NSO Group in a US court [4][5]. It has now been dismissed twice, in March 2024 and on Wednesday [2]. Both times the finding was that the case did not belong in California [4].
This is one case, and the rulings do not show how an appeals court, or a court in another district, would treat compromised US infrastructure as grounds for jurisdiction over a foreign victim's claim against the vendor [2]. The Record called Wednesday's decision a big loss for the plaintiffs and said the case could still be revived [12]. NSO did not immediately respond to the outlet's request for comment [10].
What to watch
- Whether the Knight Institute's appeal gets an appellate court to accept compromised infrastructure in California as grounds for jurisdiction.
- The full text of the order, to see whether the infrastructure theory failed on the facts of this case or as a matter of law.
- Whether other foreign Pegasus targets file in US courts on the same infrastructure theory after this ruling.