In a significant step in the fight against transnational repression and misuse of surveillance technology, the High Court in London has given human rights defender Yahya Assiri the go-ahead to serve a legal claim against Saudi Arabia over cyberattacks on him using Pegasus and QuaDream spyware.
Assiri, the founder of ALQST for Human Rights and a founding member of the Saudi National Assembly Party, is claiming misuse of his private information, harassment, and wrongful interference with his mobile phones by the Saudi state. By granting him permission to serve his claim, the Court has agreed there is an arguable case to be made.
The veteran human rights defender has, however, offered to withdraw the claim in exchange for the release of an unspecified number of prisoners of conscience.
“I want to use this legal action as a means to put pressure on the Saudi authorities,” Assiri says. “I am willing to withdraw the case should they agree to release Saudi prisoners of conscience instead. This would be a win-win outcome for both the prisoners of conscience and the Saudi authorities, who would earn respect for releasing them.”
Pegasus and QuaDream attacks targeting Yahya Assiri
Pegasus is a highly invasive spyware programme developed by Israeli technology firm NSO Group. In 2021 an international investigation by the Pegasus Project revealed that it was being used by repressive states such as Saudi Arabia, the UAE and Bahrain to hack thousands of citizens around the world, including journalists, opposition politicians and activists. The late Alaa Al-Siddiq, ALQST’s Executive Director, was one of those targeted.
QuaDream spyware, developed by Israeli company QuaDream Ltd and sold to state customers under the brand name “Reign”, is a suite of exploits and malware for targeting mobile phone devices. In April 2023 an investigation by the Citizen Lab revealed that journalists, political opposition figures and an NGO worker had been targeted. A week later, the company allegedly fired its staff and shut down its operations; it is not clear whether QuaDream is still being deployed today.
Assiri was subjected to Pegasus and QuaDream cyberattacks between 2018 and 2020 while residing in the United Kingdom. Independent analysis by Citizen Lab confirmed that his devices were infected with Pegasus and QuaDream spyware and used by the Saudi Arabian authorities to secretly gather and extract data. These attacks not only violated Assiri’s privacy but also endangered those with whom he had been communicating.
Assiri comments: “I am fully aware that the authorities will want to target me. However, it is outrageous for them also to target individuals such as the victims of rights abuses and their families in Saudi Arabia simply because these people have been in contact with me. We have no idea how the authorities might use the information found on my device against them.”
Legal case against Saudi Arabia
On 28 May 2024 Assiri filed a legal action against Saudi Arabia in the High Court of England and Wales, through British law firm Bindmans LLP, for subjecting him to cyberattacks using Pegasus and QuaDream spyware. The claims he brought against Saudi Arabia were: (i) misuse of private information; (ii) harassment; and (iii) trespass to goods. On 5 September 2024, an application for permission to serve the claim on Saudi Arabia was filed with the Court.
On 11 October 2024, the High Court ordered that Assiri can serve his legal challenge against Saudi Arabia through UK diplomatic channels – a process reserved for claims against states – thereby agreeing that there is an arguable case to be made. The claim must now be served by the UK Foreign, Commonwealth and Development Office on the Saudi Arabian Ministry of Foreign Affairs. Once it has been served, Saudi Arabia will have approximately two months before deadlines begin to run for them to respond.
Bindmans partner Monika Sobiecki says: “This is a critical moment in Yahya Assiri’s case. The High Court has had regard to extensive evidence filed in support of the application, including evidence that the claim has reasonable prospects of success if the matter were to go to a trial – in other words, that Yahya has a good chance of winning his claim. The High Court has therefore granted permission to serve the claim on the Kingdom of Saudi Arabia. The abuse of my client’s privacy rights now formally calls for an explanation from the State.”
The High Court’s decision marks a significant moment in the fight against transnational repression and the misuse of surveillance technology by authoritarian states. In recent years, the Saudi authorities’ sweeping repression at home has increasingly extended to the online space both domestically and further afield. By bringing his case, Assiri is highlighting the far-reaching implications of their cyberattacks on dissidents and human rights defenders. The outcome of the case is likely to set an important precedent in questions of accountability for cybersurveillance of activists.
Assiri concludes: “We are very optimistic, and we believe that the judicial system will stand with us. Yes, they spy on us, they have arrested our friends and tortured and killed some of them, but we believe that the side of justice and rights will prevail in the end.”
