700 F.Supp.3d 384
E.D. Va.2023Background
- Hanan Khashoggi (Virginia resident) sued Israeli companies NSO Group and Q Cyber alleging their Pegasus spyware—sold to Saudi Arabia and the UAE—was used to infiltrate her phones and materially contributed to the surveillance and assassination of her husband, Jamal Khashoggi.
- Complaint asserts seven counts (including CFAA, Virginia computer crimes, negligence, trespass to chattels, emotional distress, and equitable relief to identify clients/agents); defendants moved to dismiss for lack of jurisdiction and for failure to state a claim.
- Key factual allegations: ESEM/"phishing" attempts on Hanan’s phones beginning Nov. 2017; manual installation while she was detained at Dubai airport in April 2018; Citizen Lab forensic work attributing Pegasus infections to her devices by April 2018.
- Defendants argued (inter alia) derivative foreign sovereign immunity, lack of personal jurisdiction in Virginia, act-of-state, forum non conveniens, extraterritoriality, and Rule 12(b)(6) defects; the court decided the motion on jurisdictional grounds.
- Court rejected defendants’ claim of derivative foreign sovereign immunity under the FSIA but concluded plaintiff failed to plausibly plead specific personal jurisdiction in Virginia (and failed Rule 4(k)(2) jurisdiction), and dismissed the Complaint with prejudice.
Issues
| Issue | Plaintiff's Argument | Defendant's Argument | Held |
|---|---|---|---|
| Derivative foreign sovereign immunity under FSIA | NSO is a private company and is not entitled to sovereign immunity | NSO claimed common-law/derivative sovereign immunity because it acted for foreign states (Saudi/UAE) | Court rejected NSO's derivative sovereign immunity claim under the FSIA (FSIA is the exclusive framework; private foreign corporations are not "foreign states") |
| Specific personal jurisdiction in Virginia | Hanan alleges NSO targeted her devices while she resided in Virginia and thus purposefully directed conduct at the forum | NSO says alleged surveillance occurred abroad, was carried out by foreign sovereigns or their agents, and NSO lacks sufficient Virginia contacts | Court found plaintiff failed to plead plausible, nonconclusory facts of purposeful availment or express aiming at Virginia; no specific jurisdiction |
| Nationwide personal jurisdiction under Fed. R. Civ. P. 4(k)(2) | Federal claims (CFAA) + alleged U.S. contacts suffice; NSO not subject to jurisdiction elsewhere | NSO is subject to specific jurisdiction in California (WhatsApp litigation), and plaintiff cannot meet Base Metal requirements or show U.S.-wide contacts satisfying due process | Court denied 4(k)(2) jurisdiction: plaintiff failed Base Metal requirements and contacts with the U.S. as a whole were insufficient |
| Disposition / amendment | Plaintiff sought to proceed (and argued factual connections to Virginia at oral argument) | Defendants argued dismissal appropriate and urged dismissal with prejudice | Court dismissed complaint with prejudice (plaintiff did not request leave to amend) |
Key Cases Cited
- WhatsApp, Inc. v. NSO Grp. Techs. Ltd., 17 F.4th 930 (9th Cir. 2021) (rejecting NSO's derivative sovereign-immunity theory and explaining FSIA limits)
- Butters v. Vance Int'l, Inc., 225 F.3d 462 (4th Cir. 2000) (extending derivative immunity to U.S. contractors acting for foreign sovereigns)
- Daimler AG v. Bauman, 571 U.S. 117 (U.S. 2014) (general-jurisdiction "at home" standard)
- Calder v. Jones, 465 U.S. 783 (U.S. 1984) ("effects" test for intentional torts directed at a forum)
- Walden v. Fiore, 571 U.S. 277 (U.S. 2014) (focus on defendant's forum contacts for personal jurisdiction)
- Consulting Eng'rs Corp., 561 F.3d 273 (4th Cir. 2009) (three-prong specific-jurisdiction analysis)
- Base Metal Trading, Ltd. v. OJSC Novokuznetsky Aluminum Factory, 283 F.3d 208 (4th Cir. 2002) (requirements for Rule 4(k)(2) jurisdiction)
- Republic of Argentina v. NML Capital, Ltd., 573 U.S. 134 (U.S. 2014) (FSIA is the exclusive statutory framework for foreign-sovereign immunity)