Federal judge advances Saudi activist's lawsuit against Emirati cybersecurity firm

(CN) — A federal judge in Oregon Tuesday denied a United Arab Emirates-based software firm’s request to dismiss a lawsuit filed against it by a Saudi women’s rights activist and former political prisoner, Loujain al-Hathloul.

David Greene, a staff attorney for the Electronic Frontier Foundation, said his client, al-Hathloul, was pleased with the ruling.

“For someone in her situation, being able to have her day in court is a really huge and significant thing,” Greene said. “She doesn’t have the opportunity to do this in Saudi Arabia.”

The 36-year-old al-Hathloul had campaigned to end Saudi Arabia’s ban on women driving, which the country did do in 2018. She also pushed the country to end the male guardianship system, which makes women legally and socially dependent on their husbands or other male relatives for various aspects of their lives — for example, they need their male guardian’s permission to obtain a passport, get married, divorced, or in some cases, receive health care. Unlike some activists, al-Hathloul uses her real name. Saudi officials have called her “an existential threat to Saudi society."

In 2018, al-Hathloul was kidnapped by authorities in the United Arab Emirates, or UAE, and rendered to her home country, where she was imprisoned and tortured. In her civil complaint, first filed in 2021 federal court in Oregon, she said DarkMatter Group — which has been called effectively an arm of the Emirati government — hacked her iPhone, surveilled her movements and stole her private data, which led to her capture. The hacking was, she says, part of Project Raven, a UAE-run cybersurveillance program targeting human rights activists, academics, journalists and government critics.

Al-Hathloul claims the firm violated the Computer Fraud and Abuse Act, and she accuses three former U.S. intelligence officers and former DarkMatter executives — Mark Baier, Ryan Adams and Daniel Gericke — with crimes against humanity under the Alien Tort Statute. In 2021, the three executives admitted to providing hacking-related services to the UAE, a federal crime, and agreed to pay more than $1.68 million as part of a deferred prosecution agreement.**** They served no prison time.

U.S. District Judge Karin Immergut, a Trump appointee, dismissed al-Hathloul’s complaint in 2023 for lacking jurisdiction, finding that DarkMatter did not “purposefully direct their actions at the United States,” and that the harms done to her were not otherwise related to the U.S. The judge gave al-Hathloul a chance to amend her complaint, which the activist did. On Tuesday, the second version of her complaint cleared that crucial legal hurdle.

The fact that it did so was largely due to the Ninth Circuit’s recent ruling in Briskin v. Shopify , in which the court clarified the legal standard for personal jurisdiction in cases involving the extraction of data. At a hearing in May, Judge Immergut said the Shopify ruling “changes the landscape pretty significantly."

The plaintiff had also amended her complaint to stress a vital claim: that some of the extraction of her data occurred when she was in the U.S. for a few days, meeting with allies and speaking on a panel. That, combined with the claim DarkMatter used Apple’s U.S.-based servers in their hacking operation, was enough to sway the judge.

“This court concludes that plaintiff has made a prima facie showing that defendants expressly aimed their conduct at the U.S. by deliberately targeting Plaintiff’s iPhone while she was in the U.S. to extract her private communications with other individuals in the U.S.,” Immergut wrote in her 56-page ruling. “Defendants’ use of U.S. exploits to create their hacking tool and U.S. anonymization services to avoid detection further support a finding of express aiming.”

“Plaintiff was arrested less than three months after her visit to the U.S., and her charging document explicitly mentioned that she was arrested based on information found on her social media account and in her private communications with human rights advocates abroad, including in the U.S,” the judge added. “It is reasonable to infer, based on these allegations and the fact that defendants were allegedly constantly surveilling her location, that defendants knew plaintiff was in the U.S. when they deliberately exfiltrated data from her device, facilitating her alleged arrest in the UAE and detention in Saudi Arabia.”

Immergut did agree to dismiss the Alien Tort Claims against the three individual plaintiffs, although the Computer Fraud and Abuse Act claim against them remains active.

Green said the ruling was a significant one.

“This is really the first time, that I’m aware of, where a U.S. court has found that it has jurisdiction over a spyware victim when the spying was done at the behest of a foreign government,” the attorney said.

DarkMatter declined to comment.

Follow @hillelaron