The Record reported that a federal judge in California on Wednesday dismissed a lawsuit by journalists from El Faro, an independent news outlet in El Salvador. Their phones were infected with Pegasus, a zero-click spyware, meaning it gets in without the owner tapping anything. The Knight First Amendment Institute filed the case in November 2022. From June 2020 to November 2021, the institute counted at least 226 Pegasus attacks on lead plaintiff Carlos Dada and colleagues. The Record described it as the first U.S. lawsuit against NSO Group, which makes Pegasus.
The plaintiffs argued the case belonged in California because the attacks used compromised infrastructure in the state. The judge's order said they failed to convince the court on jurisdiction. They sought two orders: erase the data NSO gathered, and name the customer behind the spying. The Record said another judge dismissed the case in March 2024 as entirely foreign. The sources do not say what the California systems did, or who ordered the spying. The Record said the case could still be revived, and the Knight Institute said it plans to appeal.
In this case, the location of the attack infrastructure was the legal hook, and the court was not persuaded. Leaders can ask where their own hosting sits, which vendors' systems are in which places, and what support exists for staff targeted while abroad.