Judge dismisses spyware case brought by Salvadoran journalists targeted with Pegasus

Judge Dismisses El Faro Journalists' Pegasus Lawsuit Against NSO Group

U.S. District Judge James Donato of the Northern District of California dismissed Dada v. NSO Group on September 30, 2026, throwing out a lawsuit filed by journalists at the independent Salvadoran news outlet El Faro who were targeted with Pegasus spyware. According to reporting from The Record published October 2, 2026, the plaintiffs — led by El Faro co-founder Carlos Dada — failed to convince the court that their case belonged in California, with Donato writing that "none of this has anything to do with California." It is the second time the same judge has dismissed the case, and the Knight First Amendment Institute, which represents the journalists, says it will appeal again.

Details

Attribute	Value
Case	Dada v. NSO Group
Court	U.S. District Court for the Northern District of California
Judge	James Donato
Ruling date	September 30, 2026 (second dismissal)
Filed	November 2022, by the Knight First Amendment Institute
Plaintiffs	Carlos Dada and current/former El Faro journalists
Defendant	NSO Group
Ruling basis	Lack of personal jurisdiction in California
Prior history	Dismissed March 2024 on forum non conveniens grounds; revived by the Ninth Circuit on July 8, 2025
Next step	Knight Institute says it will appeal to the Ninth Circuit again

Background on the Case

El Faro is an independent, investigative outlet that has published extensive reporting critical of Salvadoran President Nayib Bukele's administration, including allegations of secret gang negotiations. Between June 2020 and November 2021, forensic analysis found that Pegasus — spyware built by the Israeli firm NSO Group — was deployed against Dada and his colleagues at least 226 times, with the surveillance campaign intensifying around the publication of major investigative stories. The targeting was first documented by Citizen Lab and Access Now.

The Knight First Amendment Institute at Columbia University filed suit on the journalists' behalf in November 2022, invoking the federal Computer Fraud and Abuse Act and California's state hacking statutes. The suit sought to compel NSO Group to disclose which government client ordered the surveillance and to delete any data collected from the journalists' devices — no U.S. court has yet ruled on the underlying hacking allegations themselves.

Why the Case Was Dismissed

The case has bounced between courts for nearly three years. Donato first dismissed it in March 2024 on forum non conveniens grounds, siding with NSO Group's argument that the suit "belongs in a court in Israel or El Salvador, and not here," and warning that ruling otherwise would "open the doors of the federal courts to lawsuits by foreign entities for conduct that occurred entirely outside the United States."

A Ninth Circuit panel reversed that decision in a 2-1 ruling on July 8, 2025, finding Donato had abused his discretion by not properly weighing the plaintiffs' allegation that NSO Group executed the Pegasus attacks by creating Apple ID accounts and routing activity through Apple's California-based servers. The appellate panel sent the case back to Donato with instructions to reconsider jurisdiction.

On remand, Donato dismissed the case again — this time on lack of personal jurisdiction rather than forum non conveniens. The ruling lands in the same N.D. Cal. courthouse where WhatsApp successfully sued NSO Group: a federal jury found NSO liable in May 2025 and awarded $168 million in damages (later reduced to roughly $4 million in punitive damages after a judge capped the punitive-to-compensatory ratio at 9-to-1, while preserving a permanent injunction against targeting WhatsApp users). WhatsApp cleared the jurisdictional bar because Pegasus code passed directly through WhatsApp's own California servers. El Faro's only identified California connection was Apple's infrastructure — a link Donato ultimately found too thin to establish personal jurisdiction over NSO Group.

What's Next for the Plaintiffs

The Knight Institute confirmed it intends to appeal the dismissal a second time. Carrie DeCell, senior staff attorney at the Knight Institute, said: "The court's decision is disappointing, but we intend to appeal. Spyware manufacturers that participate in the persecution of journalists shouldn't be able to operate with impunity." Press freedom organizations and major technology companies, including Apple and Meta, filed amicus support during the 2025 appeal, underscoring the case's significance beyond the plaintiffs themselves.

Critically, the dismissal addresses only where the case can be heard — no U.S. court has ruled on whether the alleged hacking occurred, who ordered it, or whether NSO Group is liable. Refiling in Israel or El Salvador remains theoretically possible, but advocates view both venues skeptically: Israel is NSO Group's home jurisdiction, and El Salvador's government is the entity the plaintiffs suspect ordered the surveillance in the first place.

Impact Assessment

Impact Area	Description
Press freedom	Journalists investigating a sitting government were under sustained phone surveillance with still no U.S. judicial remedy after nearly four years of litigation
Legal precedent	Demonstrates how narrow personal-jurisdiction doctrine makes it for foreign plaintiffs to sue foreign spyware vendors in U.S. courts absent a direct corporate nexus like WhatsApp's own servers
Accountability gap	The government client that allegedly ordered the surveillance remains undisclosed, and no court has ordered NSO Group to delete the collected data
NSO Group exposure	NSO Group remains on the U.S. Commerce Department's Entity List (since November 2021) and subject to the WhatsApp injunction, but a second U.S. suit against it has now failed on venue grounds twice

Recommendations

For Newsrooms and Investigative Journalists

Treat personal devices as potential targets when reporting on powerful state actors; enable hardened modes such as iOS Lockdown Mode for high-risk staff.
Seek free forensic analysis from organizations like Citizen Lab or Access Now's Digital Security Helpline if spyware targeting is suspected.
Compartmentalize sensitive sourcing across separate devices — end-to-end encrypted messaging does not protect against on-device spyware that captures content before encryption.

For Press Freedom and Civil Society Organizations

Continue filing amicus briefs in spyware litigation to help build jurisdictional and evidentiary precedent as similar cases proceed through U.S. courts.
Advocate for legislative clarification of personal-jurisdiction standards for extraterritorial cyber-harms so victims aren't blocked purely on venue technicalities.

For Policymakers

Expand export-control and procurement restrictions on commercial spyware vendors beyond the Entity List, since litigation alone has proven an unreliable accountability path.
Support multilateral enforcement mechanisms, since domestic venue fights can consume years of litigation without ever reaching the merits of a case.

Key Takeaways

Judge James Donato dismissed Dada v. NSO Group for lack of personal jurisdiction — a ruling about venue, not about whether the alleged hacking occurred.
Pegasus was deployed against El Faro's Carlos Dada and colleagues at least 226 times between June 2020 and November 2021.
The Ninth Circuit had revived the case in 2025 over NSO Group's alleged use of Apple's California servers, but Donato found that link insufficient for jurisdiction this time.
The ruling contrasts with WhatsApp's 2025 trial win against NSO Group in the same courthouse, where Pegasus code passed directly through WhatsApp's own California infrastructure.
The Knight First Amendment Institute plans to appeal again; the identity of the government client behind the surveillance remains undisclosed.
The outcome highlights how jurisdictional doctrine, rather than the merits of spyware abuse allegations, continues to determine whether victims get their day in U.S. court.