Activist Jatupat Boonpattararaksa has refused a settlement in the lawsuit against the NSO Group, an Israeli company which developed the Pegasus spyware, after the NSO Group refused to admit that the spyware has been used in Thailand and instead offered to pay Jatupat on condition that he must not publish the settlement agreement.

iLaw said that a hearing for the settlement of issue took place on 21 June. Ahead of the hearing, Jatupat’s lawyers offered to withdraw the lawsuit if the NSO Group released the contract between the company and the Thai government for the purchase of the spyware, or reduce the damages in half if the company release certain information, such as the name of the agency that bought the spyware or a list of targets.

During the hearing, however, the company’s lawyers did not say which of the settlement options it would accept. Instead, they declared to the court that the NSO Group is the developer of the Pegasus spyware and it took care not to violate human rights, but do not admit to the spyware’s use in Thailand or against Jatupat. The company also offered to pay Jatupat 1,250,000 baht, but did not admit that the money is to be paid as damages.

Jatupat’s lawyers tried to get the company to agree to promise to investigate any wrongful use of the spyware in Thailand. However, the company’s lawyers did not say that it will investigate such use, only that such cases “would be investigated” if the spyware “was in the country,” without specifying that the agreement is made regarding the situation in Thailand.

According to iLaw, the two parties almost reached a settlement. However, the NSO Group proposed that, as a condition to the settlement, the agreement must not be released to other parties, or Jatupat will have to return the payment along with a 5% interest. Jatupat did not agree to this condition, since he would have to return the payment under this condition even if the NSO Group itself released the agreement.

Since an agreement could not be reached, the case will proceed to witness examination, which is scheduled in September.

Jatupat is suing the NSO Group for 2,500,000 baht in damages for violation of privacy after learning in July 2022 that the Pegasus spyware was being used to access information on his mobile phone. He is also asking the Court to order the company to release information on the Thai government’s spyware purchase and to end the spyware’s use in Thailand.

The complaint noted that, after selling the spyware to a government, the NSO Group is still responsible for accessing the targeted devices and delivering information to government agencies. The company also ran training sessions for state officials on how to use the spyware and is responsible for checking whether its customers are wrongfully using the spyware.

The company’s defence was that it does not oversee how its customers use the spyware. Although it will revoke the right to use the spyware if a customer does not use the programme for its intended purposes, it does not control how the spyware is used and is not aware of who the targets are.

The settlement hearing was initially scheduled in November 2023, but was postponed by the court as the documents giving the defence lawyers the power of attorney to represent the NSO Group were incomplete. The lawyers also claimed that they are unable to reach the relevant Israeli authorities to complete the necessary paperwork because the country is at war.

According to a July 2022 report by iLaw, at least 30 activists, academics, and other critics of the government of former Prime Minister Gen Prayut Chan-o-cha were targeted using the Pegasus spyware, which is referred to as a “highly sophisticated spyware produced by the Israel-based cybersecurity company NSO Group, and is licensed only to government agencies with the approval of the Israeli government.”

The spyware can infiltrate a target’s device without the use of click bait lures employed in other hacks, and an automatic tracking record erasure that removes software footprints. It allows attackers to gain complete control over an infected phone, providing access to photos, videos, messages and call records. It can also be used to turn on phone cameras and microphones, allowing hackers to observe real-time situations without the knowledge of the phone owners.