On 21 June 2024, a meeting was scheduled in the Thai Civil Court to mediate in a case involving Mr. Jatupat Boonpattararaksa, or “Pai,” who filed a lawsuit against NSO Group, an Israeli cyber weapon manufacturer, for allegedly infringing on privacy rights. The defendant’s legal representatives arrived from Israel to negotiate, but failed to reach an agreement as the company refused to admit fault and insisted on partial financial compensation. As part of the proposed deal, the defendant also imposed a non-disclosure term on the settlement agreement, a failure to which the world-notorious company would demand full repayment plus interests. The two parties ultimately were not able to find an agreement.
Jatupat accused NSO Group of manufacturing and employing the Pegasus spyware to steal data from the mobile phones of 35 Thai activists, including himself. He sought the Thai Civil Court’s order to “halt” the use of Pegasus, disclose the sale of the spyware to the Thai government, and claim 2,500,000 baht in damages for privacy rights violations.
After filing the lawsuit, NSO Group appointed attorneys in Thailand to represent the company. According to the defendant’s testimony, the NSO Group claims that they merely are the spyware’s developers for licensed distribution with no control over its clients’ usage or knowledge of its target. However, they neither accept nor deny that the Pegasus spyware was used to spy on Jatupat’s personal device. A round of mediation was asked by the defendant and took place on 21 June 2024, with Shmuel Sunray, Chief Legal Counsel of NSO Group, personally attending.
Jatupat put forward a proposal that the NSO Group should disclose the purchase agreement it made with the Thai government’s agencies in return for the withdrawal of the lawsuit without seeking any financial compensation. Alternatively, if the company opted to partially disclose some information, such as the name of its Thai clients or targets, Jatupat would seek half the damages, 1,250,000 baht, and withdraw the case.
During the negotiation, the defendant asked observers to remain outside the room and did not concede to any of Jatupat’s demands. The spyware manufacturer insisted that NSO Group is the developer of Pegasus spyware with charters regulating its operation. In addition, the Israeli company doubled down on its opposition to the usage that may result in human rights violation. Nonetheless, the defendant refused to acknowledge the violations on Jatupat or the operation of Pegasus spyware in Thailand. They proposed a settlement of 1,250,000 baht without specifying it as “damages.”
Jatupat proposed to the defendant that NSO Group will launch an investigation if there were any misuse of the spyware in Thailand. However, NSO Group refused to explicitly state that they “will investigate,” but only agreed to say they “would investigate,” implying that the investigation had already been done, in the case of usage found in a country without mentioning Thailand specifically.
Despite the agreement nearly coming into fruition, NSO Group insisted on a clause preventing Jatupat from disclosing the settlement terms to others. If breached, Jatupat would have to repay the full amount plus 5% interest, which he refused. Jatupat argued that although he agreed to not disclose the agreement, he would have to bear the burden in the case of the disclosure by the defendant. With both sides refusing to back down, the case will proceed to trials.
Trials are scheduled for 3-6 and 10 September 2024. Witnesses on Jatupat’s side are computer experts, mobile phone inspectors, and researchers tracking the operation of Pegasus. NSO Group’s Shmuel Sunray will also take the stand.
