USCA4 Appeal: 23-2234 Doc: 58 Filed: 05/21/2025 Pg: 1 of 20
PUBLISHED
UNITED STATES COURT OF APPEALS FOR THE FOURTH CIRCUIT
No. 23-2234
HANAN ELATR KHASHOGGI,
Plaintiff - Appellant,
v.
NSO GROUP TECHNOLOGIES LIMITED; Q CYBER TECHNOLOGIES LIMITED,
Defendants - Appellees.
No. 23-2241
Plaintiff - Appellee,
NSO GROUP TECHNOLOGIES LIMITED; Q CYBER TECHNOLOGIES LIMITED,
Defendants - Appellants.
Appeal from the United States District Court for the Eastern District of Virginia, at Alexandria. Leonie M. Brinkema, District Judge. (1:23-cv-00779-LMB-LRV)
Argued: October 30, 2024 Decided: May 21, 2025 USCA4 Appeal: 23-2234 Doc: 58 Filed: 05/21/2025 Pg: 2 of 20
Before AGEE and RUSHING, Circuit Judges, and FLOYD, Senior Circuit Judge.
Affirmed by published opinion. Senior Judge Floyd wrote the opinion in which Judge Agee and Judge Rushing joined.
ARGUED: Michael J. Quirk, MOTLEY RICE LLC, Philadelphia, Pennsylvania, for Appellant/Cross-Appellee. Ashley Charles Parrish, KING & SPALDING LLP, Washington, D.C., for Appellees/Cross-Appellants. ON BRIEF: Michael J. Pendell, MOTLEY RICE LLC, Hartford, Connecticut, for Appellant/Cross-Appellee. Joseph N. Akrotirianakis, Aaron Craig, Matthew H. Dawson, Matthew V.H. Noller, Los Angeles, California, Edmund Power, KING & SPALDING LLP, Washington, D.C., for Appellees/Cross-Appellants.
2 USCA4 Appeal: 23-2234 Doc: 58 Filed: 05/21/2025 Pg: 3 of 20
FLOYD, Senior Circuit Judge:
Hanan Elatr Khashoggi brought this action following the assassination of her
husband, Saudi Arabian journalist and human rights activist Jamal Khashoggi. She alleged
that at least one cell phone she owned and used to communicate with Jamal had been the
subject of unlawful surveillance using a technology developed and licensed by defendant
NSO Group Technologies, and that this surveillance culminated in his death. NSO, an
Israeli company, moved to dismiss, arguing that the district court lacked personal
jurisdiction. The court granted the motion, and Khashoggi1 timely appealed. We agree
with the district court, and we therefore affirm its order dismissing Khashoggi’s claims for
a lack of personal jurisdiction.
I.
A.
In June 2023, Khashoggi, a citizen of Egypt and lawful resident of the United States
who has been granted refugee status, filed a seven-count complaint in the Eastern District
of Virginia alleging that NSO was responsible for illegal surveillance of her electronic
devices beginning in 2017. She alleged that this surveillance was conducted by agents of
the Kingdom of Saudi Arabia and the United Arab Emirates (UAE) using spyware called
Pegasus. Pegasus is developed and licensed to users by defendant NSO Group. NSO’s
1 This opinion uses “Khashoggi” to refer to the Plaintiff-Appellant in this case, Hanan Khashoggi. Her late husband, Jamal Khashoggi, is referred to as “Jamal.”
3 USCA4 Appeal: 23-2234 Doc: 58 Filed: 05/21/2025 Pg: 4 of 20
parent company, Q Cyber Technologies, is also a named defendant; for clarity, we
collectively refer to the defendants as “NSO.” Neither Saudi Arabia nor the UAE are
parties to this action.
According to the complaint, Pegasus is “an advanced surveillance tool designed to
be undetectable” that is “installed on the user’s device without their knowledge or consent.”
J.A. 15. Once installed, a Pegasus user is purportedly able to view “every piece of data
stored on the phone.” Id. The complaint also alleges three means by which Pegasus can
be installed on a particular device. First, if a Pegasus user gains physical control over the
target’s device, that user can manually install the software on the device. Second, a target
might be sent a text message containing a web address accompanied by a message inducing
them to click the link, commonly referred to as “phishing.” J.A. 18. Pegasus would then
be installed, without the target’s knowledge, if the target clicked the link and visited the
associated web address. Finally, a “zero click” feature allows a Pegasus user to install the
spyware without any physical interaction with the target’s device. J.A. 15.
Khashoggi alleges that attempts to infiltrate her devices began in November 2017,
“just as she was growing closer with Jamal.” J.A. 30. She highlights a particular text
message she received on November 26, 2017, stating flowers had been sent to her and
encouraging her to visit a linked web address to learn more about the supposed delivery.
Khashoggi states that later investigation showed the link was in fact to a webpage that
would initiate installation of Pegasus on her device. She also alleges at least five more
similar attempts were made in November 2017 to induce her to click malicious links that
would result in Pegasus being installed on her device.
4 USCA4 Appeal: 23-2234 Doc: 58 Filed: 05/21/2025 Pg: 5 of 20
In April 2018, when Khashoggi was working as a flight attendant for the UAE-
based Emirates airline, she alleges she was detained by Emirati intelligence officers at
Dubai International Airport. She states she was blindfolded, handcuffed, and taken to a
remote location where she was “questioned about Jamal and his activities for over 17
hours.” J.A. 31. Two cell phones she was carrying at the time were confiscated.
Khashoggi alleges that the agents manually installed Pegasus on at least one of those two
devices while she was detained. She alleges that UAE agents were involved in the
surveillance because Saudi Arabia “leveraged its relationship with a key ally,” the UAE,
to “install Pegasus on her phones, which would then allow [Saudi Crown Prince
Muhammad bin Salman] to monitor and track Jamal.” Id.
Khashoggi alleges that she was then placed under house arrest in the UAE for
approximately a month, and following her release, she returned to the United States. In
June 2018, Khashoggi and Jamal married in Virginia. She states that although each
continued traveling internationally following their wedding, the couple frequently
communicated through “text messages, WhatsApp, phone calls, and various other apps,”
and “anytime [Khashoggi] was able to be, she was home with Jamal” in Virginia. J.A. 32.
Khashoggi alleges that all of her conversations with Jamal by this time—whether “by
phone, message, or in person”—were relayed to members of the Saudi Arabian royal
family via UAE agents using the Pegasus spyware. J.A. 33. She alleges that this
surveillance continued whenever she was in Virginia as well.
In late September 2018, Jamal traveled to Turkey. He was last seen visiting the
Saudi Arabian consulate in Istanbul on October 2, 2018. Following his disappearance, the
5 USCA4 Appeal: 23-2234 Doc: 58 Filed: 05/21/2025 Pg: 6 of 20
United States Office of the Director of National Intelligence issued a report concluding that
Jamal had been murdered, and that Saudi Arabian Crown Prince Muhammad bin Salman
had approved the operation to capture or kill Jamal.
B.
Khashoggi filed the complaint providing the basis of this appeal in June 2023,
alleging seven counts. First, she alleged that NSO intentionally accessed her devices
without authorization in violation of the Computer Fraud and Abuse Act, 18 U.S.C. §§
1030(a)(2)(C), 1030(b). She also alleged NSO committed computer trespass, which is
actionable under the Virginia Computer Crimes Act. See Va. Code Ann. § 18.2-152.
Lastly, Khashoggi brought Virginia common law claims for negligence, trespass to
chattels, negligent and intentional infliction of emotional distress, and she asked the court
to require NSO to disclose the identity of any of its clients that used the software to surveil
her devices.
Relevant to this appeal, NSO moved to dismiss Khashoggi’s claims for a lack of
subject matter jurisdiction and personal jurisdiction under Federal Rule of Civil Procedure
12(b)(1) and 12(b)(2). NSO argued the Foreign Sovereign Immunities Act deprived the
district court of subject matter jurisdiction because Khashoggi sought relief for acts taken
on behalf of foreign sovereigns—Saudi Arabia and the UAE. See 28 U.S.C. § 1604 (“a
foreign state shall be immune from the jurisdiction of the courts of the United States”); see
also id. § 1603(a) (defining “foreign state” to include “political subdivision of a foreign
state or an agency or instrumentality of a foreign state”).
6 USCA4 Appeal: 23-2234 Doc: 58 Filed: 05/21/2025 Pg: 7 of 20
NSO also contended that it was not subject to personal jurisdiction in Virginia.
First, it argued that it lacked systematic contacts with the Commonwealth to render it
subject to the district court’s general personal jurisdiction. See Daimler AG v. Bauman,
571 U.S. 117, 122 (2014) (contacts must be “so constant and pervasive ‘as to render [it]
essentially at home in the forum State’” (quoting Goodyear Dunlop Tires Operations, S.A.
v. Brown, 564 U.S. 915, 919 (2011))). Turning to specific personal jurisdiction, NSO
similarly argued it had (1) not directed any conduct at Virginia; (2) that it conducted no
business in Virginia; and (3) that it would be constitutionally unreasonable to exercise
personal jurisdiction over the company. See, e.g., UMG Recordings, Inc. v. Kurbanov, 963
F.3d 344, 351–52 (4th Cir. 2020) (setting forth the requirements for the exercise of specific
personal jurisdiction).
In an order entered in October 2023, the district court found it possessed subject
matter jurisdiction because NSO was not subject to common-law foreign sovereign
immunity, which extends to “an individual acting in his official capacity on behalf of a
foreign state.” Khashoggi v. NSO Group Techs. Ltd., 700 F. Supp. 3d 384, 393 (E.D. Va.
2023) (quoting Velasco v. Gov’t of Indon., 370 F.3d 392, 398 (4th Cir. 2004)).
However, the court granted NSO’s motion to dismiss for a lack of personal
jurisdiction. The court found that Khashoggi had not met her burden to “allege plausible
facts that indicate a significant connection between NSO Group and its alleged conduct
and this forum” to justify asserting personal jurisdiction. Id. at 395. The court weighed
whether it could assert specific personal jurisdiction and concluded that it could not. First,
it determined that NSO had not “purposefully availed” itself of the privileges of conducting
7 USCA4 Appeal: 23-2234 Doc: 58 Filed: 05/21/2025 Pg: 8 of 20
business in Virginia as it had not directed activity at the Commonwealth; second, it found
that Khashoggi had not “adequately alleged that her claims arose out of conduct defendants
directed at and conducted in Virginia”; and third, the court found that exercising
jurisdiction over the defendants in this case would not be constitutionally reasonable. See
id. at 395–401.
Khashoggi timely filed this appeal, arguing the district court erroneously dismissed
her complaint for a lack of personal jurisdiction. NSO timely filed a cross-appeal, arguing
the district court erred in finding it was not immune to suit.
II.
We resolve this matter on the issue of personal jurisdiction. Dismissals for a lack
of jurisdiction are reviewed de novo, and we review the underlying factual findings for
clear error. See Grayson v. Anderson, 816 F.3d 262, 270 (4th Cir. 2016). “A finding is
clearly erroneous ‘when although there is evidence to support it, the reviewing court on the
entire evidence is left with the definite and firm conviction that a mistake has been
committed.’” Butts v. United States, 930 F.3d 234, 238 (4th Cir. 2019) (quoting Anderson
v. City of Bessemer City, 470 U.S. 564, 573 (1985)). A plaintiff “must establish personal
jurisdiction by a preponderance of the evidence but need only make a prima facie
showing.” UMG Recordings, 963 F.3d at 350. And a court must “construe all relevant
pleading allegations in the light most favorable to the plaintiff, assume credibility, and
8 USCA4 Appeal: 23-2234 Doc: 58 Filed: 05/21/2025 Pg: 9 of 20
draw the most favorable inferences for the existence of jurisdiction.” Id. (quoting Combs
v. Bakker, 886 F.2d 673, 676 (4th Cir. 1989)).
This appeal is about specific personal jurisdiction. Its counterpart, general personal
jurisdiction, requires “continuous and systematic” contacts with the forum state “such that
a defendant may be sued in that state for any reason.” CFA Inst. v. Inst. of Chartered Fin.
Analysts of India, 551 F.3d 285, 292 n.15 (4th Cir. 2009). For an assertion of general
personal jurisdiction, the physical location of alleged harmful conduct is irrelevant because
the defendant’s preexisting, extensive contacts with the forum suffice to establish
jurisdiction. See id. But the parties to this case agree that NSO lacks the sort of persistent
contacts with the Commonwealth of Virginia to render it subject to the district court’s
general personal jurisdiction. Accordingly, the district court was required to assure itself
of specific personal jurisdiction over NSO to properly adjudicate Khashoggi’s claims.
Rule 4(k)(1) permits the district court to exercise specific personal jurisdiction over
a nonresident defendant, like NSO, if the defendant is “subject to the jurisdiction of a court
of general jurisdiction in the state where the district court is located.” Fed. R. Civ. P.
4(k)(1). We have held that personal jurisdiction under Rule 4(k)(1) is lawful “if [1] such
jurisdiction is authorized by the long-arm statute of the state in which it sits and [2] the
application of the long-arm statute is consistent with the due process clause of the
Fourteenth Amendment.” UMG Recordings, 963 F.3d at 350 (quoting Consulting Eng’rs
Corp. v. Geometric Ltd., 561 F.3d 273, 277 (4th Cir. 2009)). And we have also recognized
that Virginia’s long-arm statute, Va. Code Ann. § 8.01-328.1(A), “extends personal
jurisdiction over nonresident defendants to the full extent permitted by the Fourteenth
9 USCA4 Appeal: 23-2234 Doc: 58 Filed: 05/21/2025 Pg: 10 of 20
Amendment’s Due Process Clause.” UMG Recordings, 963 F.3d at 350–51. That means
“the statutory and constitutional inquiries merge into one inquiry,” and the district court
can exercise personal jurisdiction in this case when such an exercise would not offend due
constitutional due process. See id. at 351.
A constitutionally permissible exercise of specific personal jurisdiction in this case
requires NSO to have “minimum contacts” with Virginia such that “the maintenance of the
suit does not offend traditional notions of fair play and substantial justice.” Consulting
Eng’rs Corp., 561 F.3d at 277 (quoting Int’l Shoe Co. v. Wash., 326 U.S. 310, 316 (1945)).
This inquiry focuses “on the nature and extent of ‘the defendant’s relationship to the forum
State.’” Ford Motor Co. v. Mont. Eighth Jud. Dist. Ct., 592 U.S. 351, 352 (2021) (quoting
Bristol-Myers Squibb Co. v. Superior Ct. 582 U.S. 255, 262 (2017)).
The due process inquiry for an exercise of specific personal jurisdiction can be
distilled to a three-pronged test: “(1) the extent to which the defendant purposefully
availed itself of the privilege of conducting activities in the State; (2) whether the plaintiffs’
claims arise out of those activities directed at the State; and (3) whether the exercise of
personal jurisdiction would be constitutionally reasonable.” UMG Recordings, 963 F.3d
at 352 (quoting Consulting Eng’rs Corp., 561 F.3d at 278).
The district court performed this analysis and determined that it lacked personal
jurisdiction over NSO because the Israel-based company had not intentionally directed
conduct at Virginia, Khashoggi’s claims did not arise out of conduct directed at Virginia,
and an exercise of jurisdiction would be constitutionally unreasonable. See Khashoggi,
10 USCA4 Appeal: 23-2234 Doc: 58 Filed: 05/21/2025 Pg: 11 of 20
700 F. Supp. 3d at 396–401. We agree with the district court and now address Khashoggi’s
arguments to the contrary.
Specific personal jurisdiction can be exercised over a foreign defendant who
commits acts outside the forum if the conduct was “expressly aimed” at the forum. Calder
v. Jones, 465 U.S. 783, 789 (1984); see also Hawkins v. i-TV Digitalis Tavkozlesi zrt., 935
F.3d 211, 230 (4th Cir. 2019).
In Calder, a libel suit, the Supreme Court held that a California court possessed
personal jurisdiction over Florida-based reporters for an allegedly libelous article they had
written about a California actress. 465 U.S. at 788–89. The Court reasoned that “California
[was] the focal point both of the story and of the harm suffered.” Id. at 789. That was
because the authors’ “actions were expressly aimed at California” and they were aware that
harm from the defamatory article would be felt in California due to the actress’s work there
and the fact the publication had extensive circulation in California. Id. at 789–90. The
Court concluded that personal jurisdiction may lie because the reporters, due to their
actions, could “reasonably anticipate being haled” into a California court. Id. at 790
(quoting World-Wide Volkswagen Corp. v. Woodson, 444 U.S. 286, 297 (1980)).
We have acknowledged the continuing validity of the Calder “effects” test, as well
as its limitations. See Hawkins, 935 F.3d at 230 (“It is true that the in-forum effects of out-
of-forum conduct can constitute minimum contacts with the forum sufficient to support
personal jurisdiction.”). The effects of the act for which a plaintiff seeks relief must create
11 USCA4 Appeal: 23-2234 Doc: 58 Filed: 05/21/2025 Pg: 12 of 20
a connection to the forum itself, “not just to parties who happen to live there.” Id. The
connection must be “substantial,” so that “a person cannot be haled into the forum simply
because he knew that his conduct would have incidental effects there.” Id. (quoting Walden
v. Fiore, 571 U.S. 277, 284 (2014)). Finally, the charged conduct must be “expressly
aimed” at the forum, or, in other words, the forum must be the “focal point” of the conduct.
Id. (first quoting Walden, 571 U.S. at 288 n.7; and then quoting Consulting Eng’rs, 561
F.3d at 280).
The district court, despite Khashoggi’s assertions that NSO “intentionally
target[ed] . . . her devices in Virginia,” found that she had “not support[ed] that allegation
with sufficient, non-conclusory facts or plausible assertions.” Khashoggi, 700 F. Supp. 3d
at 397 (quoting J.A. 12). The court noted that the complaint failed to allege with sufficient
specificity where and how long Khashoggi lived in Virginia during the alleged
surveillance. Id. Lastly, the district court found that Khashoggi had not adequately alleged
that it was the NSO Group, as opposed to the Saudi or Emirati governments, that conducted
surveillance of her devices using the Pegasus spyware. See id. Accordingly, the court
determined Khashoggi had not plausibly alleged any “specific Virginia-related conduct by
NSO Group.” Id. at 399.
Khashoggi raises several arguments on appeal that NSO directed conduct at and
committed acts in Virginia. She argues NSO “intentionally accessed her smartphones in
Virginia without authorization” based upon the company’s own representations of the
Pegasus spyware’s general capabilities. Opening Br. 23. She also alleges that NSO copied
data from her devices and rerouted it through their servers to “conceal their surveillance”
12 USCA4 Appeal: 23-2234 Doc: 58 Filed: 05/21/2025 Pg: 13 of 20
and then ultimately routed it to their client, the UAE—who in turn shared the information
with Saudi Arabia. Id. Khashoggi also argues the court erred in finding she had failed to
allege where and when she was in Virginia, and that third parties conducted the
surveillance. She argues that the acts she alleges NSO committed, taken together, justify
an assertion of jurisdiction.
We agree with the district court’s reasoning and affirm its judgment on personal
jurisdiction. Khashoggi is correct that a single act can support jurisdiction if that act
suffices to create a substantial connection with the forum. See Carefirst of Md., Inc. v.
Carefirst Pregnancy Ctrs. Inc., 334 F.3d 390, 397 (4th Cir. 2003). But whether one act or
many, it is the “quality and nature” of the defendant’s connections with the forum that
justify personal jurisdiction, “not merely the number of contacts between the defendant and
the forum state.” UMG Recordings, 963 F.3d at 352 (emphasis in original). The quality
and nature of the connections between the forum and NSO in this case fail to support an
assertion of personal jurisdiction by the district court, and Khashoggi’s arguments to the
contrary fail.
First, we note that Khashoggi’s allegations regarding how Pegasus was ultimately
installed on her device say nothing about whether a Virginia court has personal jurisdiction.
The “phishing” text messages sent to Khashoggi, supposedly designed to induce her to
install Pegasus, were not alleged to have been sent from NSO itself and Khashoggi’s
allegations as to her own location when she received those messages are vague at best and
do not place her within Virginia at that time. Indeed, the fact that the link’s domain name
was later attributed to an agency of the UAE is suggestive of that country’s agents being
13 USCA4 Appeal: 23-2234 Doc: 58 Filed: 05/21/2025 Pg: 14 of 20
responsible for those messages. And in any event, Khashoggi’s allegations regarding
Pegasus’s eventual installation on her device by Emirati agents places those events in the
UAE at the Dubai airport when she was detained there, not Virginia.
This leaves Khashoggi’s argument that jurisdiction is justified by her allegations of
Pegasus’s general capabilities and surveillance of her devices when she was present in the
Commonwealth at various times after she married Jamal. Khashoggi argues that the district
court erred in finding she failed to include any “non-conclusory allegations regarding how
long and where” she lived in Virginia or “how NSO group specifically participated in the
surveillance of her phones while she was in Virginia, as opposed to conduct that may have
happened while she was overseas or travelling for work as a flight attendant.” Khashoggi,
700 F. Supp. 3d at 397. However, we need not address the argument as to whether the
district court’s conclusion was clearly erroneous. That is because the court also found that,
regardless of whether Khashoggi had made more specific allegations regarding the timing
of her presence in Virginia, her allegations do not support the conclusion that NSO directed
conduct at the Virginia forum.
Khashoggi’s allegations that her data was captured and rerouted to the UAE (and
ultimately Saudi Arabia) when she was home with Jamal in Virginia do not suffice to create
a substantial connection with Virginia for purposes of personal jurisdiction. As the district
court found, Khashoggi’s allegations do not suggest that NSO was the “direct actor” who
injured her. Id.at 398. Instead, it appears that Saudi Arabia and the UAE directed the
targeting of Khashoggi, her detainment at the Dubai airport, the installation of Pegasus on
14 USCA4 Appeal: 23-2234 Doc: 58 Filed: 05/21/2025 Pg: 15 of 20
her device, and the alleged surveillance of that device during times when Khashoggi was
present in Virginia.
Our precedent counsels against permitting an exercise of jurisdiction over NSO
here. In a similar factual context—the direction of electronic activity at a forum—we have
affirmed the district court’s finding it lacked personal jurisdiction when the defendant’s
electronic activity in the forum was “at most, passive.” ALS Scan, Inc. v. Digit. Serv.
Consultants, Inc., 293 F.3d 707, 714 (4th Cir. 2002).
ALS Scan, a Maryland corporation, sued Digital Service Consultants and several of
its customers for copyright infringement based upon internet activity. See id. at 709. We
fashioned a personal jurisdiction analysis to acknowledge both “due process concepts of
personal jurisdiction” and a state’s “limited judicial authority over out-of-state persons”
who make electronic contacts with a forum state via the internet. Id. at 713. The first step
of this analysis, and the one most relevant here, requires that the defendant have “direct[ed]
electronic activity into the State.”2 Id. at 714. We described this test as “not dissimilar” to
the Calder analysis—which makes sense, considering their shared requirement of some
kind of conduct directed at the forum. Id. Turning to the facts of ALS Scan, Digital had
provided internet service to another Georgia-based party, called Alternative Products,
2 Beyond the requirement that a defendant must direct conduct at the forum state, a court may exercise its judicial power over a person outside the state only if it also concludes that person directed that conduct into the state with “manifested intent of engaging in business or other interactions within the State” and that that activity “creates, in a person within the State, a potential cause of action.” ALS Scan, 293 F.3d at 714. But because Khashoggi’s allegations do not signal that NSO expressly aimed conduct at Virginia, we need not and do not address these additional requirements.
15 USCA4 Appeal: 23-2234 Doc: 58 Filed: 05/21/2025 Pg: 16 of 20
which in turn made a website available online and accessible in Maryland, the forum state.
See id. According to the plaintiffs, Digital could be haled into court in Maryland because
it facilitated the availability of a website displaying infringing images in the state. See id.
at 712.
We held that Georgia-based Digital had not directed conduct at Maryland “even
though electronic signals from Digital’s facility were concededly received in Maryland.”
Id. at 714. Specific personal jurisdiction could not lie because “the only direct contact that
Digital had with Maryland” was the “general publication of its website on the Internet.”
Id. at 715 (emphasis in original). Accordingly, we affirmed the district court’s order
dismissing the case for a lack of personal jurisdiction. Id. at 709.
Similarly, in this case, NSO does not appear to have directed electronic activity into
Virginia. Instead, its conduct is more analogous to the passive conduct of the internet
service provider in ALS Scan. If there was any express aiming of conduct towards Virginia,
it was at the direction of Saudi Arabia and the UAE, not NSO. In the same way electronic
signals originating from Digital were received in Maryland in ALS Scan, electronic
signals—in the form of NSO’s Pegasus spyware—were allegedly directed at Khashoggi’s
devices in Virginia, but upon the direction of third parties. 293 F.3d at 714–15.
Accordingly, we cannot say upon these facts that NSO “purposefully availed itself” of the
Virginia forum by directing conduct at the state. See id. (recognizing Digital did not
“select or knowingly transmit infringing photographs specifically to Maryland with the
intent of engaging in business or any other transaction in Maryland”).
16 USCA4 Appeal: 23-2234 Doc: 58 Filed: 05/21/2025 Pg: 17 of 20
Later decisions applying ALS Scan are in accord. See, e.g., Carefirst, 334 F.3d at
401 (no personal jurisdiction in Maryland in trademark infringement action regarding
website directed at Chicago, Illinois); Fidrych v. Marriott Int’l, Inc., 952 F.3d 124, 143
(4th Cir. 2020) (no personal jurisdiction in South Carolina in tort action for injury at Italian
hotel, despite website’s general availability in the forum). Most importantly for our
purposes here, we have continued to emphasize that “the key issue in a specific jurisdiction
case” is the extent to which a defendant has purposefully availed itself of the forum,
including by directing conduct at the forum. Fidrych, 952 F.3d at 142–43 (“As the
Supreme Court has made clear . . . the connection between the defendant and the forum
‘must arise out of contacts that the defendant himself creates with the forum State.’”)
(quoting Walden, 571 U.S. at 284) (emphasis in original). And simply put, Khashoggi has
not shown that NSO has “create[d] a connection to the forum, not just to parties who happen
to live there.” Hawkins, 935 F.3d at 230 (declining to hold that foreign defendant aiding
and abetting the violation of an injunction satisfies personal jurisdiction in forum state)
(emphasis in original). We agree with the district court and conclude NSO did not
expressly aim conduct at the Commonwealth of Virginia. See id.
A lawsuit filed by WhatsApp against NSO in the Northern District of California
provides helpful contrast here. See WhatsApp Inc. v. NSO Group Techs. Ltd., 472 F. Supp.
3d 649 (N.D. Cal. 2020), aff’d on other grounds, 17 F.4th 930 (9th Cir. 2021), cert. denied,
143 S.Ct. 562 (Mem) (2023). WhatsApp levied claims like those Khashoggi brings against
NSO; the company alleged violations of the Computer Fraud and Abuse Act, 18 U.S.C. §
17 USCA4 Appeal: 23-2234 Doc: 58 Filed: 05/21/2025 Pg: 18 of 20
1030, and a similar California computer privacy statute. See id.at 658–59. WhatsApp also
alleged breach of contract and trespass to chattels. Id. at 659.
NSO argued that it was beyond the reach of California’s long-arm statute, but the
district court found that it possessed personal jurisdiction to adjudicate WhatsApp’s
allegations of tortious conduct. See id. at 669–674. The court concluded that NSO had
expressly aimed conduct at California. Id. It found that NSO targeted WhatsApp’s
California-based servers for the purposes of transmitting malicious computer codes—the
Pegasus spyware—through those servers to facilitate the sort of surveillance Pegasus offers
to its clients. See id. at 671–72. It emphasized that NSO had “sought out and accessed
[WhatsApp’s] servers,” “reverse-engineered the WhatsApp app,” and “developed a
program that emulated legitimate WhatsApp network traffic” to transmit the Pegasus
Spyware over the company’s servers. Id. at 672. Ultimately, the court held that NSO’s
connections to the California forum were substantial owing to this express aiming; the
California litigation also shows that NSO’s connections to Virginia are not substantial due
to a lack of express aiming.
Finally, we are not persuaded by Khashoggi’s arguments that Luis v. Zang, 833 F.3d
619 (6th Cir. 2016), and Popa v. Harriet Carter Gifts, Inc., 52 F.4th 121 (3d Cir. 2022)
support reversing the district court’s finding that it lacked personal jurisdiction. Khashoggi
points out that these holdings teach that an unlawful interception of data occurs “where the
data is first captured and rerouted.” Opening Br. 27 (emphasis omitted). And that is
correct. See Luis, 833 F.3d at 633 (unlawful intercept by spyware occurs at location of
user’s device); Popa, 52 F.4th at 131 (same). But neither Luis nor Popa was about the
18 USCA4 Appeal: 23-2234 Doc: 58 Filed: 05/21/2025 Pg: 19 of 20
district court’s specific personal jurisdiction. The Luis court considered if the plaintiff had
adequately stated a claim under Rule 12(b)(6), see 833 F.3d at 633–34, and Popa concerned
whether a genuine issue of material fact existed as to exactly where plaintiff’s data had
been intercepted for summary judgment purposes. See 52 F.4th at 131–32.
Khashoggi places too much weight on the extent to which those considerations bear
on specific personal jurisdiction. We have held that “[a]lthough the place that the plaintiff
feels the alleged injury is plainly relevant to the [jurisdictional] inquiry, it must ultimately
be accompanied by the defendant’s own [sufficient minimum] contacts with the state if
jurisdiction . . . is to be upheld.” Carefirst, 334 F.3d at 401 (quoting Young v. New Haven
Advoc., 315 F.3d 256, 262 (4th Cir. 2002)). So, while it could be true that an interception
of Khashoggi’s data occurred in Virginia, we have explained that NSO has not directed
conduct at the Commonwealth so as to create a substantial connection justifying an
assertion of specific personal jurisdiction. Neither Popa nor Luis command a different
conclusion.
Khashoggi’s argument that the district court has personal jurisdiction to adjudicate
her claim against NSO “falters on the first prong.” Perdue Foods LLC v. BRF S.A., 814
F.3d 185, 189 (4th Cir. 2016) (resolving personal jurisdiction appeal on purposeful
availment). So, we do not address the remaining considerations in our jurisdictional
analysis. Khashoggi has not alleged that NSO directed conduct at Virginia so much as she
has alleged that NSO licensed its spyware for use by Saudia Arabia and the UAE, who
targeted Khashoggi and her late husband, Jamal. We decline to hold that these allegations
justify permitting a Virginia district court to assert specific personal jurisdiction.
19 USCA4 Appeal: 23-2234 Doc: 58 Filed: 05/21/2025 Pg: 20 of 20
* * * * *
Because we resolve this case on the issue of personal jurisdiction, we need not assess
NSO’s arguments regarding the district court’s subject matter jurisdiction. We therefore
leave those questions of the applicability of the Foreign Sovereign Immunities Act, 28
U.S.C. § 1604, to an entity like NSO for another day.
III.
For the foregoing reasons, the judgment of the district court dismissing Hanan
Khashoggi’s complaint for a lack of personal jurisdiction is
AFFIRMED.