Spyware Lawsuits: Victims Face Uphill Battle Against NSO Group and Governments

In September, Apple sought to dismiss its case against NSO Group due to challenges in advancing the proceedings. Meanwhile, Meta approached the court demanding sanctions against NSO for refusing to provide the source code of its software. For years, victims of spyware have strived to hold its developers or the states deploying such technology for surveillance accountable, yet they encounter considerable obstacles.

Courts have seldom upheld claims by victims against spyware manufacturers. However, there have been a few successful instances. For example, a court in the United Kingdom recently allowed a citizen to sue Saudi Arabia over espionage, offering hope that justice and the protection of victims’ rights can be achieved through the legal system.

Citizen Lab emphasized the importance of legal proceedings in combatting the proliferation of spyware. According to experts, courts play a crucial role in holding perpetrators accountable and curtailing the development of such technologies. Yet, victims still face numerous challenges, as companies and their government clients often attempt to shield themselves through various forms of immunity.

Among the notable plaintiffs is Hanan Elatr, widow of the slain journalist Jamal Khashoggi. Last year, a U.S. court dismissed her suit against NSO Group, asserting that Saudi Arabia used spyware to monitor her and her husband. Elatr expressed disappointment with the court’s decision but remains hopeful: her case is currently under appeal, and she is simultaneously seeking justice through the British courts.

According to Citizen Lab, the majority of spyware-related lawsuits have been filed against NSO Group. Courts frequently cite the Foreign Sovereign Immunities Act, enacted in the U.S. in 1976, which limits the ability to hold foreign governments accountable. For instance, in 2017, a court dismissed a U.S. resident’s claim against Ethiopia for infecting his computer with spyware.

Legal experts explain that companies like NSO Group are easier to prosecute than governments, as courts are more inclined to entertain cases against commercial entities. Last year, the U.S. Supreme Court rejected NSO Group’s attempt to portray itself as a foreign government agent to secure immunity.

Jurisdictional issues pose yet another challenge in such cases. For example, a California court dismissed a suit against NSO Group brought by a group of journalists from El Salvador, asserting that the case would be better suited to proceedings in Israel, where the company’s headquarters are located.

Israel is also reportedly aiding NSO Group in evading disclosure of data. For example, the country’s authorities seized computers and documents related to the Pegasus software, sparing NSO from disclosing information in the WhatsApp case. Meanwhile, NSO Group itself is demanding data disclosure from Citizen Lab. Apple, fearing data leaks, attempted to drop its case against the company, a decision that NSO supported for its own reasons.

However, the U.S. Supreme Court ruled that NSO Group must indeed provide the source code to Meta, yet the company has so far failed to comply. Meta has asked the court to rule in its favor, accusing NSO of stalling the proceedings.

Challenges also arise from legal limitations. For example, the Computer Fraud and Abuse Act of 1986 requires plaintiffs to demonstrate damages of at least $5,000. Initially intended to target hackers, the law is not entirely suited for spyware cases, though violations of privacy can still be pursued under its provisions.

Lawyers also believe that Meta’s case against NSO Group stands a strong chance of success. Legal proceedings could unveil critical details; for instance, documents have revealed that Dubai’s ruler used NSO Group’s spyware to monitor members of the British Parliament. Despite restrictions on information disclosure, the threat of such revelations undermines the spyware companies’ business, as clients expect absolute confidentiality.

A U.S. court ruling allowing foreign citizens to file suits under international law has also opened new avenues for spyware victims. Cases are already underway where spyware victims are attempting to hold developers accountable. However, experts anticipate that legal battles with spyware developers may drag on for years.