On November 6, 2023, at 1.30 p.m., the Civil Court appointed the hearing between Jatupat Boonpattararaksa (Pai), the plaintiff, and the NSO Group, the defendant. Pai sued the NSO group, the Israeli cyber-intelligence firm that developed and distributed Spyware, for the misuse of technology in stealing information from the phone. Pai demanded 2,5000,000 baht as compensation for the alleged infringement. It was the first time that the plaintiff and the defendant confronted one another in the Court of Justice proceeding. Also, it was the first time for the NSO Group to appoint a representative to resolve disputes in Thailand.
At 1.34 p.m., the hearing began. The plaintiff’s lawyer claimed that the NSO Group’s power of attorney, which transferred its power to the law firm and the defence lawyer, was inconsistent with Section 47 of the Civil Procedure Code. Therefore, the defendant was not deemed to have a legal representative nor have sent the documents, such as testimony and evidence list, against the lawsuit. The defence lawyer argued that due to the ongoing war in Israel, the appointment was postponed until they could contact the government agency that had the authority to affect a power of attorney under Section 47 of the Civil Procedure Code. After that, the trial was suspended because the Judge stepped down to have a discussion with another judge who is also responsible for the case.
When the trial resumed, the Judge called for the plaintiff’s lawyer and the defendant’s lawyer for further questioning. The defence lawyer asked for the proceedings to be postponed until the war situation in Israel is improved, and they could find a government agency that would approve the power of attorney in accordance with the Civil Procedure Code. However, the plaintiff’s lawyer contended the defendant’s power of attorney was arose from September 21, 2023, to September 24, 2023, which was prior to the Israeli war on October 7, 2023. Nevertheless, the Court decided to postpone the case for three months so the defendant would get the opportunity to revise the power of attorney and make it consistent with the law. The Court reappointed on February 5, 2024, at 9 a.m. for the hearing on the modification of power of attorney and the second pre-trial conference.
Pegasus Spyware is the most advanced surveillance tools at one point. The developers specified that it is a tool that facilitates the government in preventing the terrorist and suppressing illicit drugs together with money laundering. Nevertheless, in practice, several governments used Pegasus Spyware to surveil and suppress people with opposite political views. Particularly, the Pegasus Spyware is utilised by authoritarian states, leading to the destruction of human rights principles.
Pegasus Spyware became widely known in Thailand after November 2021 when Apple sent threat notifications to inform iPhone users who are activists, scholars, and those who work for Civil Society that they might have been targeted by state-sponsored attackers. For this reason, the cooperation between Citizen Lab and DigitalReach SEA was formed to investigate the facts summarised in the report that was published in July 2022. The report found that at least 35 people were attacked by Pegasus Spyware, and most of them were involved in the 2020-2021 protests for democracy.
Three cases have arisen from the discovered information. Two of them are still in trial, including the civil case of Jatupat (Pai) and the administrative case of Arnon Nampa and Yingcheep Atchanont. In Pai’s case, he was attacked by the Pegasus Spyware three times. According to the report published on July 18, 2022, these attacks took place on June 23 and 28, as well as on July 9, 2021.
The plaintiff claimed that the NSO Group was aware of the violating use of the Spyware, while the defendant argued that the NSO Group only licensed the use of Pegasus Spyware.
The plaintiff claimed that after licensing Pegasus Spyware to governments, the NSO Group also had a duty to provide support and directed Pegasus Spyware to the targeted people. When a government who had purchased Pegasus Spyware identified a target, the NSO Group would be the one controlling hacking a system and spying on the targeted person. Then, the NSO Group would duplicate the information and send it to government agencies. In Thailand, after the purchase, the NSO Group not only provides training for government officials on how to use Pegasus Spyware against the plaintiff but also examines whether governments who purchased Pegasus Spyware have misused Pegasus Spyware or not.
Afterwards, the defendant authorised the legal representative in Thailand to defend himself by making an answer in this complaint that the NSO Group did not provide support. Likewise, the NSO Group did not control, and/or use Pegasus Spyware against the targeted person. Instead, the NSO Group was only the inventor and developer of Pegasus Spyware, which is to be sold under an internal screening and subject to a strict process of acquiring an export license. Likewise, the purchaser of Pegasus Spyware must follow the contract terms that such purchaser will use Pegasus Spyware according to the objective; otherwise, the license will be revoked. However, the NSO Group was not involved in the use of Pegasus Spyware; NSO Group was not the controller of the use and did not know the purchaser’s targets.
Nonetheless, the defence lawyer of the NSO Group has never denied using Pegasus Spyware to search for Jatupat’s information nor selling or using Pegasus Spyware in Thailand.
The lapse of prescription regarding the claim of the plaintiff.
In this case, the plaintiff—Pai—filed the complaint on July 13, 2023, in which he indicated that he became aware of the attacks on July 18, 2022. However, the defendant contested that the plaintiff had, in fact, known of the attacks since November 2021. Essentially, in suing for the damages on the ground of tort, it is required that the case must be filed to the court within one year since the plaintiff knew. Hence, the prescription has lapsed in this case.
That said, the criminal court had ordered against releasing Pai on bail in the case of ‘sculpture against the state power’ on August 9, 2021. As a result, Pai had been in prison since then until February 10, 2022. On the first inspection, Pai had no access to the notification of his email. In consequence, he was uncertain whether he was under attack or not. It was not until July 17, 2022, that Pai was assured by the report published by Citizen Lab on the “GeckoSpy Pegasus Spyware Used against Thailand’s Pro-Democracy Movement” that he was factually attacked by the Pegasus Spyware. Subsequently, the information was also confirmed on July 18, 2022, by a joint report between iLaw and DigitalReach Asia on the ‘Parasite in your phone: report on the discovery of the use of Pegasus Spyware in Thailand.’
Apart from that, the defendant also argued that the plaintiff could not claim for the damages, providing that the plaintiff failed to illustrate the impacts on his life and demonstrate the calculation of the damages. Furthermore, damages for mental injury are also not recognised by any law that the plaintiff had brought to claim the damages. Concerning this case, the plaintiff has claimed for the damages in the amount of 2,500,000 baht. In contrast, the actual damages, the violation of rights to privacy from the intrusion of Spyware attacks to the information related to a political movement, private issues, and financial matters, are non-pecuniary damages. The stated damages do not even cover mental injuries. Furthermore, in suing for damages, the plaintiff is obliged to deposit a fee of two percent of the amount of the claims for damages. Hence, the plaintiff would have the amount of 50,000 baht for the court fees.
