Hanan Khashoggi v. NSO Group Technologies Limited
138 F.4th 152
4th Cir.2025Background
- Hanan Elatr Khashoggi, widow of slain journalist Jamal Khashoggi, sued NSO Group, alleging the company's Pegasus spyware was used to illegally surveil her devices, leading to her husband's assassination.
- Khashoggi, an Egyptian citizen and US resident, claimed the surveillance was orchestrated by Saudi Arabia and the UAE using software developed and licensed by NSO, an Israeli company.
- The alleged spyware installation occurred primarily while Khashoggi was traveling, including during her detention in the UAE before her return to the US and marriage to Jamal in Virginia.
- Khashoggi filed suit in the Eastern District of Virginia, bringing federal and Virginia state law claims for unauthorized computer access, computer trespass, negligence, and emotional distress.
- NSO moved to dismiss, arguing lack of personal jurisdiction and, alternatively, that it was immune as an agent of foreign sovereigns.
- The district court found no personal jurisdiction over NSO and dismissed the case; Khashoggi appealed, and NSO cross-appealed on the immunity issue.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Specific Personal Jurisdiction over NSO | NSO directed its spyware at her devices in Virginia, creating sufficient forum contacts | NSO did not purposefully direct conduct at Virginia; any targeting of Khashoggi was by Saudi/UAE agents | No personal jurisdiction; no express aiming at Virginia by NSO |
| Foreign Sovereign Immunity | NSO not entitled to immunity as it is a private company, not a sovereign | NSO allegedly functioned as an instrumentality of foreign sovereigns (Saudi Arabia, UAE) | Not decided, as court resolved case on personal jurisdiction |
| Sufficiency of Allegations about Contacts with Virginia | Surveillance occurred while plaintiff was present in Virginia and affected her there | Plaintiff failed to allege facts showing NSO targeted Virginia specifically or acted directly in the state | Plaintiff's allegations do not establish required Virginia contacts |
| Effect of Alleged Harm Suffered in Virginia | Harm (surveillance) occurred in Virginia, thus jurisdiction is proper | Effect in forum alone without defendant’s forum-directed conduct insufficient | Defendant’s own contacts, not mere effects in Virginia, are required |
Key Cases Cited
- Int’l Shoe Co. v. Wash., 326 U.S. 310 (minimum contacts required for due process in personal jurisdiction)
- Calder v. Jones, 465 U.S. 783 ("express aiming" and "effects" tests for specific personal jurisdiction)
- Daimler AG v. Bauman, 571 U.S. 117 (limits of general personal jurisdiction over foreign companies)
- UMG Recordings, Inc. v. Kurbanov, 963 F.3d 344 (Fourth Circuit framework for specific personal jurisdiction)
- ALS Scan, Inc. v. Digit. Serv. Consultants, Inc., 293 F.3d 707 (electronic activity must be purposefully directed at forum)
- Carefirst of Md., Inc. v. Carefirst Pregnancy Ctrs. Inc., 334 F.3d 390 (effects in forum alone are not enough for jurisdiction)