Appeals Court Allows El Faro’s Pegasus Lawsuit to Proceed in California

El Faro English translates Central America. Subscribe to our newsletter.

On Tuesday, the Ninth Circuit Court of Appeals ruled in favor of 18 current and former members of El Faro in a major international spyware lawsuit against NSO Group, the Israel-based developer and vendor of Pegasus software. The judges ruled that the litigation can proceed in California, reversing the district court’s March 2024 decision that the case “belongs in a court in Israel or El Salvador, and not here.”

The case, filed in November 2022, will now return to the Northern District of California to continue its course. The appeal had received support in letters to the court from over a dozen major technology companies and press and privacy organizations, including Google, Microsoft, the Electronic Frontier Foundation, and The New York Times Company.

Microsoft, for example, wrote in its blog that “[c]yber mercenaries like NSO Group have exploited our technology by attacking our users and we believe that those who have been victimized are entitled to legal recourse even if they are located outside the United States.”

The need to enforce the CFAA [Computer Fraud and Abuse Act] extraterritorially has only become more urgent as computer data and infrastructure has become increasingly borderless,” wrote the Electronic Privacy Information Center in an amicus curiae brief.

According to The Citizen Lab and Access Now, Pegasus spyware —software which NSO reports to only sell to governments, allegedly to fight organized crime— was deployed dozens of times between 2020 and 2021 against the plaintiffs by an operator located in El Salvador. The Citizen Lab called this pattern of illegal espionage “one of the most shocking and obsessive cases of targeting that we have investigated.”

[rel1]

On March 8, 2024, Judge James Donato, of the Northern District of California, had written that a “local jury would understandably struggle with being asked to sit for a long trial that involves purely foreign plaintiffs and defendants, and events in foreign lands.” But in a two-to-one reversal, the majority on the appellate bench noted that one of the plaintiffs is a U.S. citizen, and two filed as residents in the period relevant to the case.

The appellate judges wrote that “it appears the district court incorrectly determined that it should apply the foreign plaintiff standard.” The district court, they added, “gave little to no deference to Plaintiffs’ choice of forum (...) and shifted the burden of proof from Defendants to Plaintiffs” on the allegation that certain evidence is located in California.

Dissenting Judge Bridget S. Bade took the opposite tack, writing that “[t]here was no reason for the district court to” acknowledge the U.S. citizen and residents: “The district court accurately observed” that “the Northern District of California is not their home forum.”

[newsletter]

“Spyware manufacturers that participate in the persecution of journalists shouldn’t be able to operate with impunity,” stated Carrie DeCell, plaintiffs’ attorney from the Knight First Amendment Institute who argued the appeal. “U.S. courts must ensure that they are held accountable for their actions where those actions violate U.S. law, as they did here.”

“This is good news,” comments El Faro director Carlos Dada. “It motivates us to keep demanding from the justice system an end to the use of spyware programs against journalists and human rights defenders.”

Last case in the United States

Members of El Faro brought the case against NSO in California, rather than El Salvador, citing the lack of guarantees from a judiciary controlled by Bukele since 2021. In the last two months alone, the Salvadoran Journalists’ Association reports that dozens of journalists have fled El Salvador in an escalating crackdown against civil society, involving high-profile political arrests and the passage of a Foreign Agents Law similar to Nicaragua.

In early June, following significant new reporting into Bukele’s covert former gang negotiations, El Faro announced that multiple members of the newsroom had not returned to El Salvador from the annual journalism conference ForoCAP, in Costa Rica, after being warned by diplomatic and other sources of a police operation to arrest them at the airport.

Last week, in a further escalation of this panorama, El Faro denounced a report from a police intelligence source of a plot from de-facto President Nayib Bukele’s cabinet to mount false drug trafficking charges against members of the newsroom.

In addition to this new threat, El Faro has denounced baseless money laundering and tax evasion accusations by the government in El Salvador dating back to 2021. Among the plaintiffs are current and former members of El Faro who received precautionary measures from the Inter-American Commission on Human Rights that same year, stemming from a “serious, urgent risk of suffering irreparable harm to their human rights.”

[rel2]

In his Senate confirmation hearing in March, U.S. Ambassador to Mexico Ronald Johnson asserted that “I don’t doubt that it could have” been the case that Pegasus spyware was used against civil society or U.S. officials during his tenure in El Salvador from 2019 to 2021. Since leaving the country, Ambassador Johnson has kept close to Bukele.

In a major revelation of private bilateral conversations, Johnson added: “I was constantly emphasizing to everyone that I spoke with, from President Bukele throughout his government, that there must be no surveillance on anyone that works for the Embassy.”

The deployment of Pegasus against civil society, journalists, diplomats, and other actors has been widely documented around the world. In early May, following a six-year lawsuit, the Northern District of California ordered NSO Group to pay WhatsApp $167 million U.S. dollars in damages for the exploitation of the platform in hundreds of known hacks.

Months earlier, Apple —which was also litigating against NSO in the same district as WhatsApp and the members of El Faro— agreed with the Israeli firm to drop its lawsuit in September 2024. In a withdrawal that drew criticism from digital-rights groups, the tech giant argued that the discovery process could compel disclosure of company information compromising efforts to combat illegal spyware.

This leaves the El Faro case as the last unresolved lawsuit against NSO Group in the United States. As for the appeal, “we receive this news particularly well right now, in a moment when a good part of our team has had to exile itself due to the persecution of the Bukele regime,” says Dada.

“It spurs us on to know,” he concludes, “that a court in California understands the threat to press freedom when state authorities use sophisticated programs to intercept the communications of journalists.”

This article first appeared in the July 9 edition of the El Faro English newsletter. Subscribe here.