The Thai Civil Court has dismissed a case filed by Thai activist Jatupat Boonpattararaksa against the NSO Group, the Israeli manufacturer of the Pegasus spyware, saying the plaintiff had insufficient evidence to prove that the company had violated his privacy. Meanwhile, his lawyer pointed out the unequal footing between the plaintiff and the defendant.

Thai Civil Court ruled on Thursday (21 November) to dismiss the case in which Jatupat requested the company to stop the use of the Pegasus spyware, delete his personal information from its database, and pay damages of 2,500,000 baht for violation of his privacy.

Jatupat Boonpattararaksa

Jatupat was one of 35 Thai citizens whose mobile phones were infiltrated by the spyware during the mass protests in 2020-2021.

Shmuel Sunray, general counsel and chief legal counsel of the NSO Group, testified that the NSO Group is merely the manufacturer and supplier for governments in various countries, asserting that It conducts customer screenings before making any sales, and in cases where a customer misuses the product, the company halts operations and terminates the contract.

He further testified that the company did not provide service operations where data is transferred between the service provider and its customers, noting that the company cannot access the customers’ activity logs unless allowed, and it does not know who the customers’ targets are.

The Civil Court dismissed the case on the grounds that the plaintiff’s evidence was insufficient to prove the alleged privacy violations. Jatupat claimed to have received threat notifications from Apple, but the email presented as evidence did not match the plaintiff's email address and was not actually linked to him.

The plaintiff did not call a witness from Citizen Lab, the organisation that inspected his mobile phone and confirmed its infiltration by the Pegasus spyware. The plaintiff also failed to demonstrate the forensic evidence and methods used in the analysis.

The court concluded that the documentary evidence and witnesses presented to prove the NSO Group’s violations were merely hearsay, making them inadmissible. The Court ruled that the company did not violate the plaintiff’s rights as alleged.

Jatupat’s lawyer Chatmanee Taisonthi revealed that the court’s decision placed the burden of proof completely onto the plaintiff, arguing that an ordinary person typically cannot access such insightful information. Moreover, Citizen Lab was hesitant to disclose its spyware detection methods out of concerns that the spyware manufacturer might modify its programs to evade future detection.

She also pointed out an unequal footing between the plaintiff and the defendant. As a spyware manufacturer, the defendant generally has greater access to relevant information.

Jatupat stated that his ultimate goal was not seeking financial compensation but justice. This case involves an individual plaintiff and a defendant who is a spyware manufacturer, while the actual users of the spyware remain unidentified.

He argued that a key issue was whether the plaintiff could obtain critical evidence, such as the purchase agreement between NSO Group and the Thai government, which could reveal which agency was responsible. He added that the defendant often claims to be the manufacturer and not the user, while government agencies deny the plaintiff’s access to such information, citing national security concerns.

Meanwhile, Yingcheep Atchanont, iLaw director, stated that the plaintiff faced a significant disadvantage in gathering evidence, noting that while the principle that the burden of proof lies with the plaintiff is legally valid, he argued that it does not align with the realities of this case.

Yingcheep expressed concern that the verdict sets a dangerous precedent. He noted that other than 35 known spyware victims, there are likely more victims, and spyware remains in active use. The Court’s decision would make it more difficult for future victims who wish to file lawsuits.

In this case, Jatupat filed his lawsuit on 13 July 2023. It marks the first lawsuit globally in which NSO has been named as a defendant and the first Pegasus-related case to reach a verdict.

The fact that Pegasus spyware had been used to spy on political dissidents in Thailand since 2014 was revealed only in 2021 after Apple notified mobile phone owners that they were likely targets of the state-sponsored spyware.

Previously, 8 people subjected to secret surveillance by Pegasus filed a joint petition with the Civil Court to claim damages from the NSO Group, but the Court did not accept the case on the grounds that each individual has to file a petition separately due to the different circumstances they faced.

Later, human rights lawyer Anon Nampa and iLaw’s Programme Manager Yingcheep Atchanont filed a petition against 9 government agencies with the Administrative Court, but the Court also refused to accept it, saying the case was not within its jurisdiction. The case is currently pending appeal.

In this case, both parties previously failed to reach an out-of-court agreement. Jatupat proposed that NSO Group disclose the purchase agreement it made with Thai government agencies in exchange for withdrawing the lawsuit without seeking any financial compensation. In response, the company proposed a settlement of 1,250,000 baht without specifying it as “damages” and without admitting fault. It also required that Jatupat sign a non-disclosure agreement on the terms of the compromise deal on penalty of repaying the full amount of compensation with 5% interest.