A federal judge in California has dismissed a lawsuit brought by journalists at the Salvadoran news outlet El Faro against Israeli spyware maker NSO Group, ruling that the case does not belong in a California court, The Record reported Friday. The decision, issued Wednesday, is the second time the case has been thrown out on similar grounds, and the Knight First Amendment Institute, which represents the journalists, plans to appeal.

What Happened

The suit was filed in November 2022 by the Knight Institute on behalf of El Faro co-founder Carlos Dada and colleagues at the outlet. According to the complaint, NSO's Pegasus spyware was used against Dada and his co-workers at least 226 times between June 2020 and November 2021.

The plaintiffs argued that California was a proper venue because the attacks relied on compromised infrastructure located in the state. The judge was not persuaded and found the court lacked jurisdiction. The Record's report did not name the judge.

RelatedSuspected Chinese Spies Exploited BeyondTrust Remote Support Flaw Since August, Google Says

A different judge dismissed the case in March 2024, describing it as "entirely foreign" and unsuited to a California court. The latest ruling arrives at the same result.

The journalists had asked the court to order NSO to delete any information collected from their phones and to identify the client that commissioned the surveillance. They also said the infections grew more frequent in the days before El Faro published major investigations. NSO did not immediately respond to The Record's request for comment.

Why It Matters

The ruling shows how hard it is for foreign victims of commercial spyware to use American courts when the targets, the alleged government client and the company are all outside the U.S. The plaintiffs' theory, that routing attacks through servers in California creates enough of a connection, has now failed twice. If the reasoning holds on appeal, it would make U.S. courts an unlikely venue for journalists and activists in other countries seeking to force disclosure from spyware vendors.

The unanswered question at the center of the case is who ordered the hacking. NSO has long said it sells Pegasus only to government agencies, and an order to name the client would have been an unusual window into how the spyware was deployed in El Salvador.

Context

El Faro is known for investigative reporting on El Salvador's government. In January 2022, researchers at Citizen Lab and Access Now reported finding Pegasus infections on the phones of dozens of Salvadoran journalists and civil society members, many of them at El Faro.

Other litigation against NSO in the U.S. has fared differently where a U.S. party was directly involved. WhatsApp, owned by California-based Meta, sued NSO over attacks that abused its messaging service and won a jury verdict against the company in 2025.

What to Watch

The Knight Institute's appeal would go to the U.S. Court of Appeals for the Ninth Circuit, which covers California. Watch whether the appeals court takes a broader view of what counts as a connection to the state when attacks run through U.S.-based infrastructure. NSO has not commented on the ruling, and the identity of the client behind the El Faro infections remains undisclosed.