Civil Procedure: Israeli spyware company dodges suit by Khashoggi widow

Where the widow of slain journalist Jamal Khashoggi sued an Israeli company that allegedly developed and licensed spyware that was installed on her phone, but the company was not subject to personal jurisdiction in Virginia, the suit was dismissed.

Background

Hanan Elatr Khashoggi brought this action following the assassination of her husband, Saudi Arabian journalist and human rights activist Jamal Khashoggi. She alleged that at least one cell phone she owned and used to communicate with Jamal had been the subject of unlawful surveillance using a technology developed and licensed by defendant NSO Group Technologies, and that this surveillance culminated in his death. NSO, an Israeli company, moved to dismiss, arguing that the district court lacked personal jurisdiction. The court granted the motion.

Analysis

The parties to this case agree that NSO lacks the sort of persistent contacts with the Commonwealth of Virginia to render it subject to the district court’s general personal jurisdiction. Accordingly, the district court was required to assure itself of specific personal jurisdiction over NSO to properly adjudicate Khashoggi’s claims.

The court agrees with the district court’s reasoning and affirms its judgment on personal jurisdiction. Khashoggi is correct that a single act can support jurisdiction if that act suffices to create a substantial connection with the forum. But whether one act or many, it is the “quality and nature” of the defendant’s connections with the forum that justify personal jurisdiction, “not merely the number of contacts between the defendant and the forum state.”

The quality and nature of the connections between the forum and NSO in this case fail to support an assertion of personal jurisdiction by the district court, and Khashoggi’s arguments to the contrary fail. Khashoggi’s allegations regarding how Pegasus was ultimately installed on her device say nothing about whether a Virginia court has personal jurisdiction.

The “phishing” text messages sent to Khashoggi, supposedly designed to induce her to install Pegasus, were not alleged to have been sent from NSO itself and Khashoggi’s allegations as to her own location when she received those messages are vague at best and do not place her within Virginia at that time. And in any event, Khashoggi’s allegations regarding Pegasus’s eventual installation on her device by Emirati agents places those events in the UAE at the Dubai airport when she was detained there, not Virginia.

This leaves Khashoggi’s argument that jurisdiction is justified by her allegations of Pegasus’s general capabilities and surveillance of her devices when she was present in the Commonwealth at various times after she married Jamal. Khashoggi argues that the district court erred in finding she failed to include any “non-conclusory allegations regarding how long and where” she lived in Virginia or “how NSO group specifically participated in the surveillance of her phones while she was in Virginia, as opposed to conduct that may have happened while she was overseas or travelling for work as a flight attendant.”

However, this court need not address the argument as to whether the district court’s conclusion was clearly erroneous. That is because the court also found that, regardless of whether Khashoggi had made more specific allegations regarding the timing of her presence in Virginia, her allegations do not support the conclusion that NSO directed conduct at the Virginia forum. Khashoggi’s allegations that her data was captured and rerouted to the UAE (and ultimately Saudi Arabia) when she was home with Jamal in Virginia do not suffice to create a substantial connection with Virginia for purposes of personal jurisdiction.

Affirmed.

Khashoggi v. NSO Group Technologies Limited, Case Nos. 23-2234, 23-2241. May 21, 2025. 4th Cir. (Floyd), from EDVA at Alexandria (Brinkema). Michael J. Quirk for Appellant. Ashley Charles Parrish for Appellees. VLW 025-2-182. 20 pp.