Amnesty International on Thursday condemned a Thai court’s dismissal of a spyware misuse lawsuit against NSO Group Technologies, caling the court’s decision an “alarming setback.”
The rights group said:
The court’s failure to recognize NSO Group’s role in facilitating human rights abuses via the targeting of Thai human rights defenders with Pegasus spyware is deeply alarming. However, it won’t deter the fight against the unlawful use of spyware and the fight for justice for the victims of spyware in Thailand and around the world.
Bangkok Civil Court dismissed the case based on insufficient evidence and the inadequate link between the outcome of forensic investigations and the plaintiff’s conclusion that his device was targeted by spyware.
Thai activist Jatupat Boonpattararaksa, commonly known as Pai Dao Din, sued NSO Group lawsuit for allegedly failing to prevent him from being targeted with the group’s Pegasus spyware. Pai first brought the tort complaint in July 2023 based on a warning email sent by Apple and a 2022 joint report by Thai civil society groups and Citizen Lab. The report found that the Pegasus spyware attacked at least 30 people, most of whom were involved in the 2020-2021 protests for Thailand’s Pro-Democracy Movement. Pai claimed that NSO Group violated the activists’ right to privacy by misusing the Pegasus spyware to target them. Pai further claimed that the collected information was duplicated before being sent to the government agencies.
According to Amnesty International’s amicus curiae brief in support of Pai’s lawsuit, NSO has not disclosed any details of that process despite its promise to investigate any misuse in response to the Pegasus Project revelations in 2021. The brief stated that most governments attempt to justify the use of cyber-surveillance tools like Pegasus spyware as a ‘national security’ concern. Even though the product is promoted as a tool to facilitate the government to fight crime and terror, spyware is reportedly misused by several governments.
In response to Pai’s claim about NSO’s awareness of the spyware’s misuse, NSO Group argued that it only licensed the use of Pegasus spyware, provided training on how to use the Spyware after the purchase, and examined if there was any misuse of the Spyware.
Thailand has an obligation to guarantee the right to privacy of individuals under Article 32 of the Thai Constitution, Article 12 of the Universal Declaration of Human Rights (UDHR), and Article 17 of the International Covenant on Civil and Political Rights (ICCPR). According to the UN Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, the right to privacy includes the right to know who holds information and how that information is used.
Under the UN Guiding Principles on Business and Human Rights (UN Guiding Principles), NSO Group has a corporate responsibility to conduct human rights due diligence to “identify, prevent, mitigate and account for how they address their adverse human rights impacts.” Under the UN Guiding Principles, Thailand must protect individuals against human rights abuses by business enterprises by taking appropriate steps to provide access to effective remedies.
