The Thai civil court dismissed the Pegasus spyware case, finding that NSO Group, the manufacturer of Pegasus spyware, did not infringe against the plaintiff. The court did not believe that the plaintiff had actually received an alert notification from Apple, and no investigator from Citizen Lab came to testify to confirm the details of the inspection. Therefore, the inspection results were inadmissible.
On 21 November 2024, the civil court scheduled a hearing for the verdict in the case where ‘Pai’ Jatupat sued NSO for using Pegasus spyware to hack into his device and extract his personal information. In courtroom no. 608 at 9:35 a.m., Judge Nattada Inchat presided over the hearing and read the verdict. The gist of the case was that the plaintiff alleged that the defendant was an Israeli juristic person with Q Cybers as the major shareholder, developing, manufacturing and distributing Pegasus spyware, which was designed to unlawfully hack into, surveil and access personal information on the plaintiff’s mobile phone, and the target could not protect himself. And even though the license was sold to government agencies, it is still incumbent on the defendant to supervise and control the use of Pegasus spyware in accordance with the agreement and for the purpose of preventing serious crimes only.
The defendant stated that the defendant did not supervise, control or use Pegasus spyware against the target. The defendant was only a company that invented and developed it and sold it to the governments of various countries that have undergone the defendant’s internal vetting process under the strict export license of the Israeli government. If it was found that there was improper use, the license would be immediately revoked. The defendant was only a developer and provided the license to its clients, while helping to maintain it, but was not involved in the use. Only the clients are the end users. The defendant did not control the use, so there was no way to know who the clients’ targets were and did not access the data on the target’s electronic devices.
There were 3 issues in dispute:
- Did the defendant commit a tort against the plaintiff?
- How much damage was there?
- Did the plaintiff’s lawsuit exceed the statute of limitations, while the plaintiff is obliged to provide the burden of proof.
The court had an issue to decide: Did the defendant commit a tort? The plaintiff had Asst. Prof. Dr. Pariyakorn Pusawiro testified that the defendant was a spyware manufacturer with the ability to hack into a system, intercept and send data to the spyware server exploiting a vulnerability that the target did not know from a distance. Just knowing the phone number was enough to attack and there is no way to prevent the attack. The spyware is capable of intercepting and copying data sent to users. Traces can be inspected from log files and abnormal server connection data.
The plaintiff allegedly received threat notifications from Apple. Then, Yingcheep Atchanon, Director of iLaw, contacted and coordinated with the plaintiff to investigate the attack by Pegasus spyware. Later, Citizen Lab made a report which could be concluded that the plaintiff was attacked by Pegasus spyware. It was also confirmed by a parallel investigation led by Amnesty International. Results from the two investigations matched. The investigation results were then sent to the plaintiff.
The court found that even though the plaintiff claimed to have received threat notifications, but the email address that appeared in the plaintiff’s document did not match the plaintiff’s email address. It indicates a bad faith (in submitting such evidence). It is believed that the data has been altered. The court does not believe that the plaintiff had received the notification messages.
Although the plaintiff presented evidence that Citizen Lab confirmed that the plaintiff’s mobile phone was attacked on 23 and 28 June 2021 and 9 July 2021, the ForcedEntry report referred to a general case, not specifically the defendant. Meanwhile, the Hide and Seek report mentioned cases that took place since 2018. There was only the GeckoSpy report, which was published on 17 July 2022, whose last paragraph listed the names of those attacked by the Pegasus spyware, using log files linked to the Pegasus spyware obtained from some previous cases, and with time stamps, allowing them to identify the dates of infection. Citizen Lab took the plaintiff’s phone data to Amnesty International to confirm the results, as a result of which the outcomes matched.
The plaintiff had Asst. Prof. Dr. Pariyakon testified that the examination relies on the inspection of the log files stored on the server, which, when examined, revealed unusual IP addresses that matched the structure of the Pegasus spyware. However, in Citizen Lab’s documents, it was found that the plaintiff was infected with Pegasus spyware, but no forensic evidence including examples of abnormal codes, indicators in the stored log files and unusual IP addresses could be found.
The plaintiff only had witnesses who referred to the collection of examination data, but no eyewitnesses who were the examiners to come to testify. Asst. Prof. Dr. Pariyakorn testified that the examiners must look at the content to see if there were any unusual patterns or log files and how the data was modified. The plaintiff did not, however, bring in an expert from Citizen Lab to testify about how the plaintiff’s dataset was altered, how the data was analyzed, and there was no reason why the witness could not testify. The results of the Citizen Lab’s examination are therefore considered inadmissible under Section 95/1 of the Civil Procedure Code.
After reviewing the case, it was found that the defendant did not commit a tort against the plaintiff, so there is no need to consider other issues. The court dismissed the case.
In this case, Jatupat ‘Pai’ Boonpattararaksa filed a lawsuit on 13 July 2023. This case is the first in the world in which NSO was held accountable as a defendant and fought the case until the examination of the plaintiff’s and defendant’s witnesses was completed on 3-6 and 10 September 2024.
