General counsel for the Israeli spyware firm NSO Group has testified in the Pegasus spyware case filed by a Thai activist for allegedly infringing privacy rights. This is the first time he has taken the stand as a defence witness to provide insight into how Pegasus functions. The verdict is scheduled for 21 November.

Shmuel Sunray, 60-year-old general counsel and chief legal counsel, appeared in the Thai Civil Court on Tuesday (10 September) as the NSO Group’s representative in the case where the company is accused of providing its Pegasus spyware to be used by Thai authorities to spy on at least 35 pro-democracy activists and academics in 2020-2021.

Jatupat Boonpattararaksa, one of the activists whose mobile phones were infiltrated by spyware, filed a lawsuit against the NSO Group with the Thai Civil Court, requesting the company to stop the use of Pegasus and disclose the sale and purchase contract between the NSO Group and the Thai government, and claiming damages of 2,500,000 baht for violation of his privacy.

Witness examination was held on 3-10 September, with Shmuel being the last defence witness to testify. Prior to this, the NSO Group released a statement in response to an amicus curiae brief submitted by Amnesty International, saying that “it is not possible to disclose or even acknowledge the existence of specific investigations”.

In the courtroom, Shmuel testified that Pegasus was developed in 2010 to help governments tackle terrorists and criminals, asserting that Pegasus was sold only to law enforcement and government agencies, which committed not to misuse it. He also reiterated that the NSO Group is a private enterprise, over which the Israeli government has no authority except to regulate the company’s sales, which are controlled by the Defence Exports Control Authority of the Defence Ministry. Pegasus can be sold in two ways: directly through contracts with governments or through resellers, depending on regulations in each country.

Importantly, the General Counsel asserted several times that he did not wish Pegasus to be called “spyware”, as it is only software aimed at lawful interception.

He explained that before selling Pegasus, the NSO Group will conduct an assessment based on a country’s human rights records, press freedom, and level of corruption. However, the NSO Group’s representative refused to answer any questions that could link to its customers, saying it may destroy the relationship and trust between them and the NSO Group. He also refused to disclose whether Pegasus was used against the plaintiff in this case.

Sending Pegasus to targets’ mobile phones and transferring information back to the customers must be done through infrastructure installed in the customers’ premises. While the NSO Group helps build the infrastructure, it is up to the customers to operate it.

Shmuel stated that the company did not provide service operations where data is transferred between the service provider and its customers, noting that the company cannot access the customers’ activity logs unless allowed, and it does not know who the customers’ targets are. He said that if Pegasus is misused, or the customer country violates human rights, the company would use a “kill switch” to disconnect.

When asked about a Thai parliament document referring to “Minotaur” spyware manufactured by Q Cyber, a company that plays a key role in managing some of NSO Group’s operations, Shmuel did not comment on the matter. He admitted that Q Cyber is responsible for Pegasus marketing.

He reiterated that the NSO Group adheres to international regulations, such as the United Nations Guiding Principles on Business and Human Rights. However, the company will not be legally responsible for any misuse.

Question without answer

To prevent any misuse, Shmuel testified that the company conducts “due diligence” and investigates if there is credible evidence showing  misuse by a customer. It was observed that Shmuel repeatedly testified about the measures to investigate the misuse of Pegasus. However, it was not clear at some points.

He said the NSO Group is not allowed to see the customers’ activity logs, but he did not clarify how the company could prove misuse if customers did not allow access. Another point is that customers could not arbitrarily add or change their targets without notifying the company. Shmuel testified that the company is the only one capable of making such changes. However, the question remains as to what extent the company could access the programme.

Prachatai approached Shmuel for clarification, but he refused to give an interview.

Pegasus cases in Thailand

It was also reported that Pegasus spyware had been used to spy on political dissidents in Thailand since 2014 before it was revealed in 2021 after Apple notified mobile phone owners that they were. likely targets of the state-sponsored spyware.

Previously, 8 people subjected to secret surveillance by Pegasus filed a joint petition with the Civil Court to claim damages from the NSO Group, but the Court did not accept the case on the grounds that each individual has to file a petition separately due to the different circumstances they faced.

Later, human rights lawyer Anon Nampa and iLaw’s Programme Manager Yingcheep Atchanont filed a petition against 9 government agencies with the Administrative Court, but the Court also refused to accept it, saying the case was not within its jurisdiction. The case is currently pending appeal.

In this case, both parties previously failed to reach an out-of-court agreement. Jatupat proposed that NSO Group disclose the purchase agreement it made with Thai government agencies in exchange for withdrawing the lawsuit without seeking any financial compensation. Meanwhile, the company did not acknowledge any accusation and proposed a settlement of 1,250,000 baht without specifying it as “damages”. The defendant also required that Jatupat not disclose the compromise agreement to a third party; otherwise, he would have to repay the full amount of money with 5% interest.

Incomplete testimony

Chatmanee Taisonthi, one of the plaintiff’s lawyers, said in terms of business, she understood why Shmuel could not disclose any information about NSO Group’s customers, but the company should take greater responsibility by investigating whether its product was used to violate the plaintiff’s privacy rights.

Apirak Nantaseree, another lawyer for the plaintiff, said the defendant did not even disclose any terms or blank contracts. He commented that it was not fair to shift the burden onto the victim, believing that the NSO Group could have taken further action.

Jatupat’s lawyers were unable to finish questioning Shmuel because it was the last day scheduled for witness hearings. Shmuel also claimed that he was to fly back to Israel the following day, and due to the unrest between Israel and Palestine, it was uncertain whether he could return to attend the next witness hearing.

Both parties, therefore, agreed to terminate the witness hearing. The Court is scheduled to deliver the verdict on 21 November.