Pegasus lawsuit by El Faro journalists dismissed in US
A federal judge in California has dismissed a lawsuit brought by journalists from the Salvadoran news outlet El Faro, whose phones were infected with NSO Group's Pegasus spyware.
The ruling was issued on Wednesday. According to the judge's order, the plaintiffs did not show that the case belonged in a California court. The Knight First Amendment Institute, which filed the suit for the journalists, said it plans to appeal.
The case drew attention because it was the first lawsuit against NSO Group, the company that makes Pegasus, to be filed in a U.S. court.
226 infections in 17 months
El Faro is an independent news outlet based in El Salvador. The lead plaintiff is Carlos Dada, and the other plaintiffs are fellow El Faro staff.
According to the Knight Institute, Pegasus was used against Dada and his colleagues at least 226 times between June 2020 and November 2021. The institute filed the lawsuit in November 2022.
Pegasus is zero-click spyware, which means it can compromise a device without the target opening a link or attachment. The Knight Institute said the journalists' phones were accessed remotely and in secret. It also said the attacks became more frequent in the days before El Faro was due to publish major investigations.
The plaintiffs asked the court for two things. First, they wanted NSO ordered to delete the data it had collected from their devices. Second, they wanted the company directed to name the client that ordered the surveillance.
The jurisdiction question
The legal dispute centred on whether a U.S. court in California was the right place to hear the case at all.
Dada and his colleagues argued that it was, because the attacks relied on compromised infrastructure located in California. The judge was not persuaded.
This is not the first time the case has been thrown out. In March 2024, a different judge dismissed it, calling the matter "entirely foreign" and finding that it had no standing to be tried in California.
The latest dismissal is a significant setback for the journalists. It does not necessarily end the case, though, and it could still be revived later. The planned appeal by the Knight Institute is the next step.
NSO did not immediately respond to a request for comment.
What is still unknown
The decision does not settle the questions at the heart of the complaint. The court has not ordered NSO to delete any collected data, and the client behind the surveillance has not been identified through this case.
Those were the two main goals of the lawsuit. Without a court willing to hear it, the plaintiffs have no route to either outcome in the U.S. for now.
Our Take
The ruling points to a weakness in using U.S. courts to hold spyware vendors accountable. The victims were Salvadoran journalists, the vendor is NSO Group, and the link to California came from the infrastructure the attacks passed through. Two judges have now found that link too weak. This suggests that foreign targets of commercial spyware may struggle to get a hearing in American courts, even when U.S.-based systems played a part in the attack.
For journalists, activists and other high-risk users, the case shows that legal remedies after an infection are slow and uncertain. Prevention and detection still matter most. Features such as the spyware forensic logs in Android 17 show that platform vendors are paying more attention to this threat.
The commercial spyware market is not shrinking, either. A Paragon listing on Nasdaq shows that these tools still attract investor interest.
It is worth watching whether the Knight Institute's appeal changes how courts treat the role of U.S. infrastructure in cross-border spyware attacks. A different reading on appeal could open the door for similar claims. Another loss would make that route much harder.