(CN) - In a split decision, a Ninth Circuit Court of Appeals panel said Tuesday that a San Francisco trial judge was too hasty in dismissing a lawsuit by a group of El Salvador-based journalists against the Israeli maker of the Pegasus spyware that was surreptitiously installed on their iPhones.
The unsigned decision sent the case back to U.S. District Judge James Donato to reconsider his March 8, 2024, ruling that the Northern District of California was a "forum non conveniens" for the claims against NSO Group Technologies and Q Cyber Technologies, both of which are based in Israel.
Two judges on the appellate panel - U.S. Circuit Judge Jennifer Sung, a Joe Biden appointee, and U.S. District Judge Michael Simon, a Barack Obama appointee at the District Court of Oregon who sat on the panel by designation - found that Donato had failed to consider that one of the plaintiffs is a U.S. citizen and two others U.S. residents, which entitled them to a higher degree of deference to bring a lawsuit in a federal judicial district where they don't reside.
"When the plaintiff is a U.S. citizen or resident, the defendant must satisfy a heavy burden of proof, such that unless the balance is strongly in favor of the defendant, the plaintiff's choice of forum should rarely be disturbed," they said. "Here, however, it appears the district court gave little to no deference to plaintiffs' choice of forum, overlooked the allegations of the operative complaint, and shifted the burden of proof from defendants to plaintiffs."
The 18 journalists who brought the lawsuit work for El Faro, a digital newspaper they say serves as one of the preeminent sources of independent journalism in Central America and is dedicated to investigative and in-depth reporting on corruption, violence, organized crime, migration, inequality and human rights.
They claim that between June 2020 and November 2021, the Israeli companies and their unidentified clients used zero-click exploits, which doesn't require the target to take any action to allow the spyware to access their phones, to surreptitiously install Pegasus on the iPhones of at least 22 of El Faro's 35 employees.
The journalists sued the Pegasus makers in the Northern District of California because that is where Apple is based, and according to their claims, the Israeli companies used Apple's servers to target their phones.
U.S. Circuit Judge Bridget Bade, a Donald Trump appointee, said in dissent that the plaintiffs who are either U.S. citizens or residents weren't entitled to additional deference for filing their lawsuit in San Francisco because none of them lives in Northern California.
"A domestic plaintiff's choice of forum is ordinarily entitled to a strong presumption in its favor," Bade said. "A domestic plaintiff's choice of forum is entitled to less deference, however, if the suit is filed in a domestic forum other than the plaintiff's home forum."
An attorney representing the Israeli companies before the Ninth Circuit didn't immediately respond to a request for comment on the ruling.
The Pegasus program is used by many authoritarian governments to track and spy on dissidents and journalists, at times leading to their arrest, imprisonment and even murder.
Microsoft and Google filed an amicus brief with the Ninth Circuit in support of the El Salvador-based journalists' bid to hold the Israeli companies liable in U.S. court.
"Consistent with their focus on cybersecurity and protecting their customers from cyber-surveillance attacks, amici have a strong interest in ensuring that entities who facilitate covert access to their products and services in violation of federal and state law are held accountable in U.S. courts," the tech companies said. "Holding bad actors accountable is vital to deterring malicious cyber-surveillance and other cyber-attacks."
Apple itself sued NSO Group and Q Cyber Technologies in 2021 for hacking its devices, calling the companies "amoral 21st century mercenaries who have created highly sophisticated cyber-surveillance machinery that invites routine and flagrant abuse."
However, Apple voluntarily dropped the lawsuit last year, saying that the threat to Apple's iPhones had changed significantly and that Pegasus posed a substantially weakened risk because of enhanced user protections through Apple's internal efforts.
Apple's primary worry, according to its request to dismiss the case, was that discovery in litigation would compromise these efforts by revealing the measures Apple has implemented to protect users.
WhatsApp - an encrypted communication app owned by Facebook's parent company Meta Platforms that boasts over 2 billion users around the world - sued in 2019 after Pegasus reportedly compromised the privacy of 1,400 activists, journalists and diplomats via WhatsApp servers.
Pegasus allows the user to observe a cellphone's location data and gain control over the device's microphone and camera. Originally designed as a tool for government law enforcement and intelligence agencies, the software is NSO's flagship product and is licensed to governments around the world.
To embed the spyware into someone's phone, Pegasus clients send a text message, which then invades devices through a malicious code lurking in these messages sent via WhatsApp, Telegram or other messaging services.
Once implanted, it can control a phone's microphones and cameras while extracting the personal and location data of its owner - for example, by scraping browser history and contacts, grabbing screenshots and infiltrating communications.
Pegasus can also infect users through missed phone calls and "zero-click" attacks, which do not require any action from the phone's owner to succeed.
WhatsApp is seeking damages and a permanent injunction that prevents NSO and its affiliates from accessing its computer systems or engaging in further activities that could disrupt its platform's functionality.
Source: Courthouse News Service
