138 F.4th 152
4th Cir.2025Background
- Hanan Elatr Khashoggi, widow of Jamal Khashoggi, alleged her devices were unlawfully surveilled with Pegasus spyware, developed/licensed by NSO Group, leading to Jamal's assassination.
- Khashoggi claims surveillance began in 2017, via Saudi/UAE agents, including her detainment and alleged manual installation of Pegasus while overseas.
- After her release, Khashoggi moved to Virginia, continued communications with Jamal, and claims ongoing surveillance while in Virginia.
- She filed a seven-count suit in the Eastern District of Virginia asserting violations under federal and Virginia law, plus common law claims against NSO and its parent.
- NSO, an Israeli company, moved to dismiss for lack of personal and subject matter jurisdiction, arguing it had no Virginia contacts and was immune as an agent of foreign sovereigns.
- The district court found subject matter jurisdiction existed but dismissed for lack of personal jurisdiction. Khashoggi appealed, NSO cross-appealed on immunity.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Personal Jurisdiction over NSO in Virginia | NSO intentionally aimed conduct at Virginia by surveilling Khashoggi's devices while she was present in the state. | NSO has no purposeful contacts with Virginia; any surveillance was directed by and attributable to Saudi and UAE agents, not NSO. | No personal jurisdiction; NSO did not purposefully avail itself of Virginia law nor direct conduct at the forum. |
| Sufficiency of Khashoggi's Allegations about Forum Contacts | Allegations about her presence in Virginia and the operation of Pegasus in-state establish forum contact. | Khashoggi's complaint fails to specifically allege sufficient, non-conclusory ties between NSO's actions and Virginia. | Allegations were too vague; complaint did not plausibly show substantial connection between NSO's conduct and Virginia. |
| Whether Effects Test (Calder) Supports Jurisdiction | The injurious effects felt in Virginia (as forum of residence and surveillance) satisfy minimum contacts. | Any effects in Virginia were incidental and not proof of conduct expressly aimed at Virginia by NSO. | Effects alone, without conduct expressly aimed at Virginia, are insufficient for jurisdiction. |
| Role of Third Parties (Foreign States) | NSO should be liable based on spyware's operation regardless of client user. | Primary targeting and operation by Saudi and UAE agents, not NSO itself; software merely supplied by NSO. | Actions attributed to foreign governments; mere licensing of software by NSO does not establish jurisdiction. |
Key Cases Cited
- Calder v. Jones, 465 U.S. 783 (U.S. 1984) (personal jurisdiction lies if conduct was expressly aimed at the forum and harm was felt there)
- Daimler AG v. Bauman, 571 U.S. 117 (U.S. 2014) (general jurisdiction requires contacts rendering defendant essentially at home in forum)
- Ford Motor Co. v. Mont. Eighth Jud. Dist. Ct., 592 U.S. 351 (U.S. 2021) (specific jurisdiction focuses on defendant's relationship with forum state)
- Goodyear Dunlop Tires Operations, S.A. v. Brown, 564 U.S. 915 (U.S. 2011) (general jurisdiction requires “constant and pervasive” forum contacts)
- Walden v. Fiore, 571 U.S. 277 (U.S. 2014) (defendant's contacts with the forum state must arise out of defendant’s own activities)
- ALS Scan, Inc. v. Digit. Serv. Consultants, Inc., 293 F.3d 707 (4th Cir. 2002) (electronic activity must be directed into the forum to support jurisdiction)
- Carefirst of Md., Inc. v. Carefirst Pregnancy Ctrs. Inc., 334 F.3d 390 (4th Cir. 2003) (plaintiff’s injury location relevant but not dispositive for jurisdiction)
- Fidrych v. Marriott Int’l, Inc., 952 F.3d 124 (4th Cir. 2020) (connection between defendant and forum must arise from defendant’s own contacts)