Slain Journalist's Widow Sues Cyber Intelligence Firm in Privacy Suit

Cyber intelligence company NSO Group and Q Cyber Technologies should have known their clients “routinely utilized relational targeting” that has been “incredibly effective at accomplishing the goals of authoritarian regimes,” alleges Hanan Elatr Khashoggi, widow of assassinated journalist Jamal Khashoggi, in a complaint Thursday (docket 1:23-cv-00779) in U.S. District Court for Eastern Virginia in Alexandria.

Jamal Khashoggi was assassinated in the Saudi Arabian consulate in Istanbul for his writings and critiques of the Saudi regime, said the complaint. Saudi Crown Prince Mohammed bin Salman publicly accepted responsibility for the death of Khashoggi in 2019 but said he wasn't involved in it.

Hanan Khashoggi, an Egyptian citizen and U.S. resident living in Virginia who's seeking asylum in the U.S., is seeking justice for her husband “and on her own behalf through this action,” said the complaint, alleging violation of the Computer Fraud and Abuse Act. Defendants attempted to access her devices, which held private communications, photos and videos “on multiple occasions, without authorization,” the complaint said.

A forensic investigation by the University of Toronto’s Citizen Lab in December 2021 indicated the presence of Pegasus -- a surveillance tool that can remotely infect a target’s cell phone using a text message -- and “NSO Group-related infiltration evidence” on Hanan Khashoggi’s devices, said the complaint. “Upon information and belief, Defendants and their clients obtained both stored and real-time data and surveillance” from her targeted devices by April 2018 “and likely earlier,” it said. Attempts on her devices dated back to November 2017, it said.

On Nov. 26, 2017, the plaintiff received a text about a purported flower bouquet for her. When she clicked the link, she was rerouted to a disabled Pegasus link, which Citizen Lab attributed to the domain name in the link, an agency of the United Arab Emirates, said the complaint. Five more attempts were made via enhanced social engineering messages (ESEM) messages to her phone that month, it said.

The “infiltration allowed for all information stored on Plaintiff’s phones to become accessible,” said the complaint. It also gave defendants access to all of her future communications, plus the ability for defendants to activate the cameras and mics of her phones, without her knowledge, “turning her phones into sophisticated listening and recording devices,” it said.

In April 2018, Hanan Khashoggi, a flight attendant, was detained and questioned by Emirati intelligence officers waiting for her at the Dubai International Airport about her husband and his activities, said the complaint. The officers took both cellphones she had been using to communicate with her husband. Citizen Lab’s analysis said it was likely during that time that Pegasus was “manually installed onto at least one of her phones.” She was placed under house arrest in UAE until May, when she returned to the U.S.

The complaint cited a 2021 article in the Washington Post saying a UAE agency put Pegasus software on her phone “months before his murder.” Jamal Khashoggi disappeared after visiting the Saudi consulate in Istanbul in October. The Post article quoted NSO’s attorney Thomas Clare saying NSO Group did a review that determined Pegasus "was not used to listen to, monitor, track, or collect information about Ms. Elatr." Pegasus is installed remotely, Clare said, so it would be “'completely unnecessary and make no sense' that a human would type the address of a Pegasus-linked website into a target’s phone."

Khashoggi also claims violations of the Virginia Computer Crimes Act, alleging defendants and their clients used “false pretenses to commit larceny regarding” her and her husband’s private information, the complaint said. Defendants used “false pretenses by sending ESEM messages to Plaintiff’s devices in order to entice her to engage with the links thus activating Pegasus on her devices,” it said.

Additional charges in the complaint are negligence, trespass to chattels, intentional infliction of emotional distress and negligent infliction of emotional distress. Khashoggi seeks the identities of defendants’ clients and agents, disclosure of all contracting documents between defendants and their clients that targeted and accessed her devices, and the “permanent cessation” of all monitoring of her personal electronic devices.

She seeks past and future damages to compensate her for physical and emotional injuries sustained as a result of defendants’ conduct, including loss of earning capacity; damages to compensate for “loss of consortium, companionship, services, society, love, and comforts”; exemplary, treble, and/or punitive damages; plus attorneys’ fees and legal costs. NSO Group didn't comment Friday.