Federal judge dismisses phone hacking case of Saudi human rights activist

PORTLAND, Ore. (CN) — A federal judge on Thursday dismissed a lawsuit filed by prominent Saudi human rights activist Loujain al-Hathloul against an Emirati cybersurveillance company and three former U.S. intelligence operatives, finding a lack of jurisdiction consistent with due process.

The lengthy order from U.S. District Judge Karin J. Immergut comes only a week after the motion hearing between attorneys for al-Hathloul and defendants DarkMatter Group and former U.S. intelligence operative Ryan Adams.

Al-Hathloul, 33, rose to prominence after launching a campaign to give Saudi women the right to drive — a right they were denied until June 2018. Yet, al-Hathloul’s activism did not come without dire costs to her safety.

According to al-Hathloul’s complaint filed in 2021, DarkMatter and its former senior executives — which include Adams and other former intelligence operatives Marc Baier and Daniel Gericke —hacked her iPhone to surveil her movements and used her confidential communications against her by the security services of the United Arab Emirates, leading to her arrest and extradition to Saudi Arabia, where she was “detained, imprisoned and tortured.”

As first reported by Reuters in 2019, the three operatives were a part of the same DarkMatter surveillance unit called Project Raven, which aided the UAE in spying on human rights activists, academics, journalists and government critics.

In 2021, the three men entered into a deferred prosecution agreement with the U.S. Department of Justice, where they admitted to hacking into computer networks in the U.S. and exporting cyber intrusion tools without the necessary permission from the U.S. government.

Al-Hathloul tried suing DarkMatter and the three men for computer fraud violations and crimes against humanity under the Alien Tort Statute. However, Immergut did not see how the court in Oregon could exercise jurisdiction over DarkMatter and the former operatives “with due process,” citing three reasons.

To start, Immergut reasoned that DarkMatter did not “purposefully direct their actions at the United States,” citing Will Co. Ltd. v. Lee — a Ninth Circuit case from August 2022 involving personal jurisdiction over foreign parties who accessed U.S. servers as well. More specifically, the court applied the purposeful direction test to determine personal jurisdiction over the defendants who published a website displaying copyrighted material.

Based on Will Co., Immergut knew there would be a three-step inquiry for determining whether exercising jurisdiction is proper: (1) the act must be intentional; (2) the act must be aimed at the forum state; (3) the defendant must know that the act is going to cause harm in the forum state.

While Immergut did not doubt that the acts were intentional, she found that DarkMatter’s use of Apple’s U.S.-based servers did not constitute express aiming at the U.S., and to consider otherwise would be “to stretch the Ninth Circuit’s personal jurisdiction case law to cover conduct that has never been found sufficient to confer jurisdiction over a foreign-based defendant.”

Additionally, Immergut reasoned DarkMatter did not know that the harm caused to al-Hathloul would be suffered in the U.S.

As Immergut noted, al-Hathloul argued that by uploading malicious code to Apple’s U.S. servers to hack her phone, DarkMatter broke the digital security vital to her human rights work and transformed Apple’s secure messaging system into its personal malware delivery device. Therefore, the harm to al-Halthoul’s device occurred outside of the U.S., and the only injury she alleges in the states is the transformation of Apple’s messaging system.

“Plaintiff cites to no authority to support her theory that harm to a third party in the forum, rather than harm to the plaintiff, constitutes a ‘jurisdictionally sufficient amount of harm,” Immergut wrote.

Secondly, Immergut reasoned al-Hathloul’s claims do not involve DarkMatter’s U.S.-related activities, explaining that the technology DarkMatter purchased from U.S. companies to infect her phone was significantly altered before its deployment in hacking her phone. The fact that DarkMatter “may have developed expertise and knowhow” in the U.S. that was later used to create the malware is not enough to confer jurisdiction, according to Immergut.

Lastly, the judge decided exercising jurisdiction over DarkMatter and the three operatives would be unreasonable, as the court only agrees with al-Hathloul for the second, sixth and seventh factors within the Ninth Circuit’s seven-factor balancing test for reasonableness.

“This court agrees that plaintiff’s complaint alleges conduct by the UAE that, if assumed to be true, would make the UAE a hostile forum to plaintiff’s claims,” Immergut wrote. “The fact that the second, sixth, and seventh factors favor plaintiff, however, is not sufficient to overcome the conclusion that the other reasonableness factors weigh against jurisdiction.”

But while Immergut granted DarkMatter’s motion to dismiss, she left some room for opportunity. Immergut noted that “there may be certain factual allegations that plaintiff could add to her complaint to satisfy the exercise of jurisdiction over defendants,” thereby dismissing the case without prejudice and with leave to amend.

Al-Hathloul now has 14 days to amend.

Follow @alannamayhampdx

Subscribe to Closing Arguments

Sign up for new weekly newsletter Closing Arguments to get the latest about ongoing trials, major litigation and hot cases and rulings in courthouses around the U.S. and the world.

Email *

Submit