In a groundbreaking ruling, a federal judge in Portland has granted Saudi women’s rights activist Loujain Hathloul Alhathloul the opportunity to pursue her civil lawsuit against three former executives of DarkMatter Group, a private technology firm based in the United Arab Emirates.
The lawsuit centers on accusations of computer fraud and abuse, asserting that the executives unlawfully hacked into her iPhone and monitored her private communications during her attendance at a women’s conference in Washington, D.C., in 2017.
U.S. District Judge Karin J. Immergut made the decision in a detailed 56-page opinion, stating that Alhathloul can argue that the hacking was a deliberate act targeting her in the U.S.
The judge’s ruling dismisses the motions to dismiss the claims put forth by the defendants, all of whom were former leaders of DarkMatter. This group provided cyber-intelligence services to the government of the United Arab Emirates, according to a report by the U.S. State Department.
Alhathloul’s attorneys claim that DarkMatter deliberately recruited intelligence personnel, appointed them as executives, and invested in U.S. technology. They allege that the company engineered a specialized hacking tool named Karm that was routed through Apple’s U.S.-based servers to avoid detection.
The lawsuit asserts that the former DarkMatter executives utilized U.S. cybersurveillance technology and their American intelligence training to install spyware on Alhathloul’s device. This spyware reportedly enabled them to extract data from her iPhone, tracking her communications with U.S. contacts during her stay in America.
According to the suit, the executives were able to access the contents of Alhathloul’s phone, extract personal messages from platforms like Facebook and WhatsApp, upload this data to a server managed by DarkMatter, and monitor her location, as well as her private discussions with other human rights advocates, researchers, and journalists.
Court records indicate that Alhathloul was assigned the code name “Purple Sword” during these alleged hacking efforts.
Attorney David Greene, the Civil Liberties Director and Senior Staff Attorney at the Electronic Frontier Foundation who assisted in filing the lawsuit, stated that this ruling marks a historic moment. It is the first time that a U.S. federal court has allowed a lawsuit from an alleged victim of foreign governmental abuses facilitated by American-made spyware to proceed.
Greene expressed eagerness to prove their case, highlighting the significance of the ruling.
In contrast, Cliff Davidson, representing the former DarkMatter executives, chose not to comment on the judge’s opinion.
Previously, attorneys for the defendants argued against the court’s jurisdiction, claiming that the alleged hacking began overseas prior to Alhathloul’s visit to the U.S.
However, Judge Immergut rejected this claim, emphasizing that the former executives were aware of her whereabouts while she was attending the public conference titled “Driving Forward: Women in the Gulf Access a Changing Leadership.” This event was publicized on social media by both the Arab Gulf States Institute in Washington and Alhathloul herself.
Immergut noted that the case’s facts support a compelling inference that the executives deliberately targeted Alhathloul while extracting data from her device in the U.S.
After she participated in the conference, Alhathloul was reportedly detained by UAE security services and returned to Saudi Arabia in March 2018, where she was imprisoned and reportedly tortured. Although she is no longer in prison, Alhathloul remains under a travel ban and is unable to leave the country.
At 36, Alhathloul has gained international recognition, having been nominated for the Nobel Peace Prize in both 2019 and 2020. She has been a long-time advocate for women’s rights in Saudi Arabia, playing a pivotal role in the campaign for women’s right to drive and publicly criticizing the country’s male guardianship system.
While the judge permitted most claims to move forward, she dismissed one aspect of the lawsuit alleging that the former executives and DarkMatter engaged in “discriminatory persecution” under the Alien Tort Statute. This statute permits non-U.S. citizens to be heard in U.S. federal courts for civil offenses that violate international law.
Judge Immergut remarked that acknowledging such a cause of action could have severe implications for U.S.-UAE relations, citing the latter as a critical ally in the region.
The lawsuit was initiated in Portland due to initial assumptions that one of the former intelligence workers owned properties in Oregon, but that claim was later amended.
Previously, Immergut had dismissed Alhathloul’s initial lawsuit in our 2021 ruling, stating that the U.S. court lacked jurisdiction. Notably, the landscape has evolved following a ruling by the 9th U.S. Circuit Court of Appeals, which has redefined jurisdictional precedents in data privacy cases.
The case cited was Briskin v. Shopify, where the court decided that personal data sharing could confer jurisdiction, as it was linked to actions occurring in California.
In 2021, the former DarkMatter executives—Marc Baier, Ryan Adams, and Daniel Gericke—entered into an agreement to pay $1.68 million in fines, thus avoiding criminal prosecution for providing unauthorized defense services to the UAE.
They were charged with various offenses, including conspiring to commit computer and device fraud, as well as violations of the Arms Export Control Act and International Traffic in Arms regulations.
As part of the settlement, they agreed to resign from positions with UAE intelligence or defense agencies, cooperate with the FBI, and relinquish any security clearances held by the U.S. or UAE governments.
image source from：oregonlive
