The El Faro journalists’ Pegasus case has been dismissed again in a California federal court, this time for lack of jurisdiction over NSO Group. The decision did not examine whether the surveillance software attacks occurred as the journalists allege, but rather whether there was a sufficient legal connection to allow the case to proceed in the state. The issue now is whether the plaintiffs’ side will appeal, as they have said they plan to. The Sept. 30 ruling concerns a lawsuit against the company that develops Pegasus.
Judge James Donato of the U.S. District Court for the Northern District of California ruled that the plaintiffs had failed to prove that the court had personal jurisdiction over the Israeli company. The complaint was dismissed without examining the merits of the allegations, and the court did not allow a new amendment at the same stage of the proceedings, according to the text of the court decision.
El Faro's Pegasus case dismissed due to jurisdiction
The lawsuit was filed in 2022 by Carlos Dada and other journalists and employees of the independent El Faro news outlet, based in El Salvador. In the Pegasus case, the plaintiffs alleged that the software was used to gain covert, remote access to their iPhones and that NSO Group helped develop, sell and use it against them. These are allegations in the lawsuit, not findings in the new court decision, according to the judge’s reasoning.
According to the Knight First Amendment Institute, which represents the journalists, there were at least 226 incidents of Pegasus infecting devices between June 2020 and November 2021. The journalists’ side had also argued that the attacks were linked to Apple’s infrastructure in California, because that’s where the company is headquartered. The number of incidents is attributed to the plaintiffs’ representatives and is not a finding of the decision.
The judge's ruling was narrower: the case materials did not sufficiently establish that NSO conducted an illegal act in California or that it knew that the servers the plaintiffs alleged were located there. The ruling noted that the devices allegedly compromised were located out of state and that there was no indication that any of the plaintiffs' phones were compromised in the United States, according to the court document.
At the same time, the judge rejected NSO’s argument that the case should be dismissed because another state would be a more appropriate venue. He did, however, grant the motion to dismiss for lack of personal jurisdiction. Simply put, the court did not rule on whether the alleged attacks occurred; it ruled that the plaintiffs had not established the jurisdiction of that court to hear the claims against the company, as stated in the decision.
See also: Pegasus on Serbian student's iPhone – New evidence of targeted espionage
From the first rejection to the new judicial decision
The case was dismissed in 2024 on different grounds. In July 2025, an appeals court overturned that decision and sent the case back to the trial court for a new trial. In the latter ruling, the judge ruled that the additional evidence was not enough to prove the requisite connection between NSO and California, as outlined in the case’s reasoning.
The outcome does not resolve broader questions about the use of commercial surveillance software against journalists, nor does it reveal who allegedly ordered the surveillance operation. The lawsuit sought, among other things, to delete the data that had been collected and to name the client who allegedly requested the surveillance, according to a report by The Record. The decision did not address those requests, as it did not proceed to the merits of the case.
The Pegasus case shows how complex accountability can become when the company, the technical infrastructure, and the people reporting the surveillance are located in different countries. The connection to servers that may have been located in California was not considered sufficient in itself to bring NSO under the court’s jurisdiction. This narrow legal judgment does not answer the broader question of the software’s use against journalists, as is evident from the breadth of the decision.
Journalists plan appeal
The Knight Institute called the decision disappointing and announced that it intends to appeal. This does not mean that a new appeal has already been filed. The decision dismisses the complaint without ruling on the merits of the allegations and does not allow a new amendment in the same court, as the plaintiffs have already had the opportunity to establish jurisdiction.
The possibility of an appeal leaves open the next step in the legal dispute. For now, the substance of the allegations in the Pegasus case remains outside the ruling: the judicial decision concerns where the dispute can be heard, not whether the attacks were proven.
See also: Pegasus spyware: Amnesty reveals NSO Group's architecture
See also: Pegasus creator sells antidote to governments through Dream
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
