Israeli spyware Pegasus can face criminal prosecution in the United States

The U.S. court ruled that NSO Group’s use of servers located in the U.S. to hack a Salvadoran media outlet allows a trial to be held in California.

A California appellate court ruled on July 8, 2025, that U.S. courts have jurisdiction over the hacking of the Salvadoran investigative media outlet El Faro by the Pegasus spyware. The use of U.S.-based servers by NSO Group, the Israeli spyware developer, establishes sufficient territorial connection to permit a trial in the United States. This decision overturns an earlier dismissal by a California court of El Faro’s lawsuit.

Between 2020 and 2021, Pegasus infected the phones of at least 22 members of the media while they were investigating sensitive topics related to the Salvadoran government. The Israeli spyware has been at the center of many scandals involving illegal surveillance of journalists, political activists, or civil society members, usually by governments.

El Faro is seeking a court order compelling NSO Group to reveal the identity of the hacking sponsor and to delete all collected data. This trial could be the first to hold NSO Group criminally accountable in the United States for the espionage activities carried out with Pegasus.

Although NSO Group was ordered in March 2025 to pay $167 million in damages to Meta, that civil case concerned the hacking of 1,400 WhatsApp accounts, and did not address the illegal spying and data collection involved.